module Rodauth

    # File lib/rodauth/features/oauth_dynamic_client_registration.rb
108 def _before_register
109   raise %{dynamic client registration requires authentication.
110     Override ´before_register` to perform it.
111     example:
112 
113       before_register do
114         account = _account_from_login(request.env["HTTP_X_USER_EMAIL"])
115         authorization_required unless account
116         @oauth_application_params[:account_id] = account[:id]
117       end
118   }
119 end

   # File lib/rodauth/features/oauth_authorization_code_grant.rb
69 def _do_authorize_code
70   create_params = {
71     oauth_grants_type_column => "authorization_code",
72     **resource_owner_params
73   }
74 
75   { "code" => create_oauth_grant(create_params) }
76 end

   # File lib/rodauth/features/oauth_implicit_grant.rb
58 def _do_authorize_token(grant_params = {})
59   grant_params = {
60     oauth_grants_type_column => "implicit",
61     oauth_grants_oauth_application_id_column => oauth_application[oauth_applications_id_column],
62     oauth_grants_scopes_column => scopes,
63     **resource_owner_params
64   }.merge(grant_params)
65 
66   generate_token(grant_params, false)
67 end

    # File lib/rodauth/features/oauth_base.rb
494 def _generate_access_token(params = {})
495   token = oauth_unique_id_generator
496 
497   if oauth_grants_token_hash_column
498     params[oauth_grants_token_hash_column] = generate_token_hash(token)
499   else
500     params[oauth_grants_token_column] = token
501   end
502 
503   token
504 end

    # File lib/rodauth/features/oauth_jwt.rb
 97 def _generate_jwt_access_token(oauth_grant)
 98   claims = jwt_claims(oauth_grant)
 99 
100   # one of the points of using jwt is avoiding database lookups, so we put here all relevant
101   # token data.
102   claims[:scope] = oauth_grant[oauth_grants_scopes_column]
103 
104   # RFC8725 section 3.11: Use Explicit Typing
105   # RFC9068 section 2.1 : The "typ" value used SHOULD be "at+jwt".
106   jwt_encode(claims, headers: { typ: "at+jwt" })
107 end

    # File lib/rodauth/features/oauth_base.rb
506 def _generate_refresh_token(params)
507   token = oauth_unique_id_generator
508 
509   if oauth_grants_refresh_token_hash_column
510     params[oauth_grants_refresh_token_hash_column] = generate_token_hash(token)
511   else
512     params[oauth_grants_refresh_token_column] = token
513   end
514 
515   token
516 end

    # File lib/rodauth/features/oauth_base.rb
518 def _grant_with_access_token?(oauth_grant)
519   if oauth_grants_token_hash_column
520     oauth_grant[oauth_grants_token_hash_column]
521   else
522     oauth_grant[oauth_grants_token_column]
523   end
524 end

    # File lib/rodauth/features/oauth_base.rb
836 def _json_response_body(hash)
837   return super if features.include?(:json)
838 
839   if request.respond_to?(:convert_to_json)
840     request.send(:convert_to_json, hash)
841   else
842     JSON.dump(hash)
843   end
844 end

   # File lib/rodauth/features/oauth_jwt_base.rb
81 def _jwt_key
82   @_jwt_key ||= (oauth_application_jwks(oauth_application) if oauth_application)
83 end

   # File lib/rodauth/features/oidc_frontchannel_logout.rb
35 def _logout_response
36   visited_sites = @visited_sites
37 
38   return super unless visited_sites
39 
40   logout_urls = db[oauth_applications_table]
41                 .where(oauth_applications_client_id_column => visited_sites.map(&:first))
42                 .as_hash(oauth_applications_client_id_column, oauth_applications_frontchannel_logout_uri_column)
43 
44   return super if logout_urls.empty?
45 
46   generate_frontchannel_logout_urls(visited_sites, logout_urls)
47 
48   @frontchannel_logout_redirect = logout_redirect
49 
50   set_notice_flash logout_notice_flash
51   return_response frontchannel_logout_view
52 end

   # File lib/rodauth/features/oidc_frontchannel_logout.rb
55 def _oidc_logout_response
56   visited_sites = @visited_sites
57 
58   return super unless visited_sites
59 
60   logout_urls = db[oauth_applications_table]
61                 .where(oauth_applications_client_id_column => visited_sites.map(&:first))
62                 .as_hash(oauth_applications_client_id_column, oauth_applications_frontchannel_logout_uri_column)
63 
64   return super if logout_urls.empty?
65 
66   generate_frontchannel_logout_urls(visited_sites, logout_urls)
67 
68   @frontchannel_logout_redirect = oidc_logout_redirect
69 
70   set_notice_flash logout_notice_flash
71   return_response frontchannel_logout_view
72 end

    # File lib/rodauth/features/oauth_authorization_code_grant.rb
 96 def _redirect_response_error(redirect_url, params)
 97   response_mode = param_or_nil("response_mode") || oauth_response_mode
 98 
 99   case response_mode
100   when "form_post"
101     response["Content-Type"] = "text/html"
102     error_body = form_post_error_response_html(redirect_url) do
103       params.map do |name, value|
104         "<input type=\"hidden\" name=\"#{name}\" value=\"#{scope.h(value)}\" />"
105       end.join
106     end
107     response.write(error_body)
108     request.halt
109   else
110     super
111   end
112 end

    # File lib/rodauth/features/oauth_base.rb
188 def accepts_json?
189   return true if only_json?
190 
191   (accept = request.env["HTTP_ACCEPT"]) && accept =~ json_request_regexp
192 end

   # File lib/rodauth/features/oauth_assertion_base.rb
43 def account_from_bearer_assertion_subject(subject)
44   __insert_or_do_nothing_and_return__(
45     db[accounts_table],
46     account_id_column,
47     [login_column],
48     login_column => subject
49   )
50 end

   # File lib/rodauth/features/oauth_jwt_bearer_grant.rb
75 def account_from_jwt_bearer_assertion(assertion)
76   claims = jwt_assertion(assertion)
77 
78   return unless claims
79 
80   account_from_bearer_assertion_subject(claims["sub"])
81 end

   # File lib/rodauth/features/oauth_saml_bearer_grant.rb
64 def account_from_saml2_bearer_assertion(assertion)
65   parse_saml_assertion(assertion)
66 
67   return unless @assertion
68 
69   account_from_bearer_assertion_subject(@assertion.nameid)
70 end

   # File lib/rodauth/features/oidc_logout_base.rb
20 def active_sessions?(session_id)
21   !active_sessions_ds.where(active_sessions_session_id_column => session_id).empty?
22 end

    # File lib/rodauth/features/oidc.rb
839 def allow_cors(request)
840   return unless request.request_method == "OPTIONS"
841 
842   response["Access-Control-Allow-Origin"] = "*"
843   response["Access-Control-Allow-Methods"] = "GET, OPTIONS"
844   response["Access-Control-Max-Age"] = "3600"
845   response.status = 200
846   return_response
847 end

   # File lib/rodauth/features/oauth_assertion_base.rb
84 def assertion_grant_type(grant_type = param("grant_type"))
85   grant_type.delete_prefix("urn:ietf:params:oauth:grant-type:").tr("-", "_")
86 end

   # File lib/rodauth/features/oauth_assertion_base.rb
76 def assertion_grant_type?(grant_type = param("grant_type"))
77   grant_type.start_with?("urn:ietf:params:oauth:grant-type:")
78 end

   # File lib/rodauth/features/oauth_jwt_base.rb
88 def auth_server_jwks_set
89   metadata = authorization_server_metadata
90 
91   return unless metadata && (jwks_uri = metadata[:jwks_uri])
92 
93   jwks_uri = URI(jwks_uri)
94 
95   http_request_with_cache(jwks_uri)
96 end

   # File lib/rodauth/features/oauth_jwt_secured_authorization_response_mode.rb
33 def authorization_encryption_alg_values_supported
34   oauth_jwt_jwe_algorithms_supported
35 end

   # File lib/rodauth/features/oauth_jwt_secured_authorization_response_mode.rb
37 def authorization_encryption_enc_values_supported
38   oauth_jwt_jwe_encryption_methods_supported
39 end

    # File lib/rodauth/features/oauth_authorize_base.rb
166 def authorization_required
167   if accepts_json?
168     throw_json_response_error(oauth_authorization_required_error_status, "invalid_client")
169   else
170     set_redirect_error_flash(require_authorization_error_flash)
171     redirect(authorize_path)
172   end
173 end

    # File lib/rodauth/features/oauth_base.rb
873 def authorization_server_metadata
874   auth_url = URI(authorization_server_url).dup
875   auth_url.path = "/.well-known/oauth-authorization-server"
876 
877   http_request_with_cache(auth_url)
878 end

    # File lib/rodauth/features/oauth_base.rb
346 def authorization_server_url
347   base_url
348 end

   # File lib/rodauth/features/oauth_jwt_secured_authorization_response_mode.rb
29 def authorization_signing_alg_values_supported
30   oauth_jwt_jws_algorithms_supported
31 end

    # File lib/rodauth/features/oauth_base.rb
260 def authorization_token
261   return @authorization_token if defined?(@authorization_token)
262 
263   # check if there is a token
264   access_token = fetch_access_token
265 
266   return unless access_token
267 
268   @authorization_token = oauth_grant_by_token(access_token)
269 end

   # File lib/rodauth/features/oauth_authorization_code_grant.rb
78 def authorize_response(params, mode)
79   redirect_url = URI.parse(redirect_uri)
80   case mode
81   when "query"
82     params = [URI.encode_www_form(params)]
83     params << redirect_url.query if redirect_url.query
84     redirect_url.query = params.join("&")
85     redirect(redirect_url.to_s)
86   when "form_post"
87     inline_html = form_post_response_html(redirect_uri) do
88       params.map do |name, value|
89         "<input type=\"hidden\" name=\"#{scope.h(name)}\" value=\"#{scope.h(value)}\" />"
90       end.join
91     end
92     scope.view layout: false, inline: inline_html
93   end
94 end

   # File lib/rodauth/features/oauth_authorize_base.rb
70 def authorize_scopes
71   scopes || begin
72     oauth_application[oauth_applications_scopes_column].split(oauth_scope_separator)
73   end
74 end

    # File lib/rodauth/features/oidc.rb
239 def before_authorize_route
240   if (ui_locales = param_or_nil("ui_locales"))
241     ui_locales = ui_locales.split(" ").map(&:to_sym)
242     ui_locales &= ::I18n.available_locales
243 
244     ::I18n.locale = ui_locales.first unless ui_locales.empty?
245   end
246 
247   super
248 end

   # File lib/rodauth/features/oauth_resource_server.rb
57 def before_introspection_request(request); end

   # File lib/rodauth/features/oauth_authorize_base.rb
61 def check_csrf?
62   case request.path
63   when authorize_path
64     only_json? ? false : super
65   else
66     super
67   end
68 end

    # File lib/rodauth/features/oauth_authorize_base.rb
113 def check_valid_access_type?
114   return true unless use_oauth_access_type?
115 
116   access_type = param_or_nil("access_type")
117   !access_type || OAUTH_ACCESS_TYPES.include?(access_type)
118 end

    # File lib/rodauth/features/oauth_authorize_base.rb
120 def check_valid_approval_prompt?
121   return true unless use_oauth_access_type?
122 
123   approval_prompt = param_or_nil("approval_prompt")
124   !approval_prompt || OAUTH_APPROVAL_PROMPTS.include?(approval_prompt)
125 end

   # File lib/rodauth/features/oauth_pkce.rb
72 def check_valid_grant_challenge?(grant, verifier)
73   challenge = grant[oauth_grants_code_challenge_column]
74 
75   case grant[oauth_grants_code_challenge_method_column]
76   when "plain"
77     challenge == verifier
78   when "S256"
79     generated_challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(verifier), padding: false)
80 
81     challenge == generated_challenge
82   else
83     redirect_response_error("unsupported_transform_algorithm")
84   end
85 end

    # File lib/rodauth/features/oauth_base.rb
867 def check_valid_no_fragment_uri?(uri)
868   check_valid_uri?(uri) && URI.parse(uri).fragment.nil?
869 end

    # File lib/rodauth/features/oauth_authorization_code_grant.rb
153 def check_valid_response_type?
154   response_type = param_or_nil("response_type")
155 
156   response_type == "code" || response_type == "none" || super
157 end

    # File lib/rodauth/features/oauth_authorize_base.rb
105 def check_valid_scopes?(scp = scopes)
106   super(scp - %w[offline_access])
107 end

    # File lib/rodauth/features/oauth_base.rb
863 def check_valid_uri?(uri)
864   URI::DEFAULT_PARSER.make_regexp(oauth_valid_uri_schemes).match?(uri)
865 end

   # File lib/rodauth/features/oidc_session_management.rb
30 def clear_session
31   super
32 
33   # update user agent state in the process
34   # TODO: dangerous if this gets overidden by the user
35 
36   user_agent_state_cookie_opts = Hash[oauth_oidc_user_agent_state_cookie_options]
37   user_agent_state_cookie_opts[:value] = oauth_unique_id_generator
38   user_agent_state_cookie_opts[:secure] = true
39   if oauth_oidc_user_agent_state_cookie_expires_in
40     user_agent_state_cookie_opts[:expires] = convert_timestamp(Time.now + oauth_oidc_user_agent_state_cookie_expires_in)
41   end
42   ::Rack::Utils.set_cookie_header!(response.headers, oauth_oidc_user_agent_state_cookie_key, user_agent_state_cookie_opts)
43 end

   # File lib/rodauth/features/oauth_assertion_base.rb
88 def client_assertion_type(assertion_type = param("client_assertion_type"))
89   assertion_type.delete_prefix("urn:ietf:params:oauth:client-assertion-type:").tr("-", "_")
90 end

   # File lib/rodauth/features/oauth_assertion_base.rb
80 def client_assertion_type?(client_assertion_type = param("client_assertion_type"))
81   client_assertion_type.start_with?("urn:ietf:params:oauth:client-assertion-type:")
82 end

    # File lib/rodauth/features/oauth_tls_client_auth.rb
126 def client_certificate
127   return @client_certificate if defined?(@client_certificate)
128 
129   unless (pem_cert = request.env["SSL_CLIENT_CERT"] || request.env["HTTP_SSL_CLIENT_CERT"] || request.env["HTTP_X_SSL_CLIENT_CERT"])
130     return
131   end
132 
133   return if pem_cert.empty?
134 
135   @certificate = OpenSSL::X509::Certificate.new(pem_cert)
136 end

    # File lib/rodauth/features/oauth_tls_client_auth.rb
138 def client_certificate_sans
139   return @client_certificate_sans if defined?(@client_certificate_sans)
140 
141   @client_certificate_sans = begin
142     return [] unless client_certificate
143 
144     san = client_certificate.extensions.find { |ext| ext.oid == "subjectAltName" }
145 
146     return [] unless san
147 
148     ostr = OpenSSL::ASN1.decode(san.to_der).value.last
149 
150     sans = OpenSSL::ASN1.decode(ostr.value)
151 
152     return [] unless sans
153 
154     sans.value
155   end
156 end

    # File lib/rodauth/features/oauth_dynamic_client_registration.rb
389 def convert_to_boolean(key, value)
390   case value
391   when true, false then value
392   when "true" then true
393   when "false" then false
394   else
395     register_throw_json_response_error(
396       "invalid_client_metadata",
397       register_invalid_param_message(key)
398     )
399   end
400 end

    # File lib/rodauth/features/oauth_application_management.rb
184 def create_oauth_application
185   create_params = {
186     oauth_applications_account_id_column => account_id,
187     oauth_applications_name_column => oauth_application_params[oauth_application_name_param],
188     oauth_applications_description_column => oauth_application_params[oauth_application_description_param],
189     oauth_applications_scopes_column => oauth_application_params[oauth_application_scopes_param],
190     oauth_applications_homepage_url_column => oauth_application_params[oauth_application_homepage_url_param]
191   }
192 
193   redirect_uris = oauth_application_params[oauth_application_redirect_uri_param]
194   redirect_uris = redirect_uris.to_a.reject(&:empty?).join(" ") if redirect_uris.respond_to?(:each)
195   create_params[oauth_applications_redirect_uri_column] = redirect_uris unless redirect_uris.empty?
196 
197   # set client ID/secret pairs
198   set_client_secret(create_params, oauth_application_params[oauth_application_client_secret_param])
199 
200   if create_params[oauth_applications_scopes_column]
201     create_params[oauth_applications_scopes_column] = create_params[oauth_applications_scopes_column].join(oauth_scope_separator)
202   end
203 
204   rescue_from_uniqueness_error do
205     create_params[oauth_applications_client_id_column] = oauth_unique_id_generator
206     db[oauth_applications_table].insert(create_params)
207   end
208 end

    # File lib/rodauth/features/oauth_authorize_base.rb
188 def create_oauth_grant(create_params = {})
189   create_params[oauth_grants_oauth_application_id_column] ||= oauth_application[oauth_applications_id_column]
190   create_params[oauth_grants_redirect_uri_column] ||= redirect_uri
191   create_params[oauth_grants_expires_in_column] ||= Sequel.date_add(Sequel::CURRENT_TIMESTAMP, seconds: oauth_grant_expires_in)
192   create_params[oauth_grants_scopes_column] ||= scopes.join(oauth_scope_separator)
193 
194   if use_oauth_access_type? && (access_type = param_or_nil("access_type"))
195     create_params[oauth_grants_access_type_column] = access_type
196   end
197 
198   ds = db[oauth_grants_table]
199 
200   create_params[oauth_grants_code_column] = oauth_unique_id_generator
201 
202   if oauth_reuse_access_token
203     unique_conds = Hash[oauth_grants_unique_columns.map { |column| [column, create_params[column]] }]
204     valid_grant = valid_oauth_grant_ds(unique_conds).select(oauth_grants_id_column).first
205     if valid_grant
206       create_params[oauth_grants_id_column] = valid_grant[oauth_grants_id_column]
207       rescue_from_uniqueness_error do
208         __insert_or_update_and_return__(
209           ds,
210           oauth_grants_id_column,
211           [oauth_grants_id_column],
212           create_params
213         )
214       end
215       return create_params[oauth_grants_code_column]
216     end
217   end
218 
219   rescue_from_uniqueness_error do
220     if __one_oauth_token_per_account
221       __insert_or_update_and_return__(
222         ds,
223         oauth_grants_id_column,
224         oauth_grants_unique_columns,
225         create_params,
226         nil,
227         {
228           oauth_grants_expires_in_column => Sequel.date_add(Sequel::CURRENT_TIMESTAMP, seconds: oauth_grant_expires_in),
229           oauth_grants_revoked_at_column => nil
230         }
231       )
232     else
233       __insert_and_return__(ds, oauth_grants_id_column, create_params)
234     end
235   end
236   create_params[oauth_grants_code_column]
237 end

    # File lib/rodauth/features/oidc.rb
487 def create_oauth_grant_with_token(create_params = {})
488   create_params.merge!(resource_owner_params)
489   create_params[oauth_grants_type_column] = "hybrid"
490   create_params[oauth_grants_expires_in_column] = Sequel.date_add(Sequel::CURRENT_TIMESTAMP, seconds: oauth_access_token_expires_in)
491   authorization_code = create_oauth_grant(create_params)
492   access_token = if oauth_jwt_access_tokens
493                    _generate_jwt_access_token(create_params)
494                  else
495                    oauth_grant = valid_oauth_grant_ds.where(oauth_grants_code_column => authorization_code).first
496                    _generate_access_token(oauth_grant)
497                  end
498 
499   json_access_token_payload(oauth_grants_token_column => access_token).merge("code" => authorization_code)
500 end

   # File lib/rodauth/features/oauth_assertion_base.rb
52 def create_token(grant_type)
53   return super unless assertion_grant_type?(grant_type) && supported_grant_type?(grant_type)
54 
55   account = __send__(:"account_from_#{assertion_grant_type}_assertion", param("assertion"))
56 
57   redirect_response_error("invalid_grant") unless account
58 
59   grant_scopes = if param_or_nil("scope")
60                    redirect_response_error("invalid_scope") unless check_valid_scopes?
61                    scopes
62                  else
63                    @oauth_application[oauth_applications_scopes_column]
64                  end
65 
66   grant_params = {
67     oauth_grants_type_column => grant_type,
68     oauth_grants_account_id_column => account[account_id_column],
69     oauth_grants_oauth_application_id_column => @oauth_application[oauth_applications_id_column],
70     oauth_grants_scopes_column => grant_scopes
71   }
72 
73   generate_token(grant_params, false)
74 end

    # File lib/rodauth/features/oauth_authorize_base.rb
179 def create_token_from_authorization_code(grant_params, should_generate_refresh_token = !use_oauth_access_type?, oauth_grant: nil)
180   # fetch oauth grant
181   oauth_grant ||= valid_locked_oauth_grant(grant_params)
182 
183   should_generate_refresh_token ||= oauth_grant[oauth_grants_access_type_column] == "offline"
184 
185   generate_token(oauth_grant, should_generate_refresh_token)
186 end

    # File lib/rodauth/features/oauth_base.rb
695 def create_token_from_token(oauth_grant, update_params)
696   redirect_response_error("invalid_grant") unless grant_from_application?(oauth_grant, oauth_application)
697 
698   rescue_from_uniqueness_error do
699     oauth_grants_ds = db[oauth_grants_table].where(oauth_grants_id_column => oauth_grant[oauth_grants_id_column])
700     access_token = _generate_access_token(update_params)
701     oauth_grant = __update_and_return__(oauth_grants_ds, update_params)
702 
703     oauth_grant[oauth_grants_token_column] = access_token
704     oauth_grant
705   end
706 end

    # File lib/rodauth/features/oauth_base.rb
176 def current_oauth_account
177   account_id = authorization_token[oauth_grants_account_id_column]
178 
179   return unless account_id
180 
181   oauth_account_ds(account_id).first
182 end

    # File lib/rodauth/features/oauth_base.rb
184 def current_oauth_application
185   oauth_application_ds(authorization_token[oauth_grants_oauth_application_id_column]).first
186 end

   # File lib/rodauth/features/oauth_jwt.rb
63 def decode_access_token(access_token = fetch_access_token)
64   return unless access_token
65 
66   jwt_claims = jwt_decode(access_token, verify_headers: method(:verify_access_token_headers))
67 
68   return unless jwt_claims
69 
70   return unless jwt_claims["sub"]
71 
72   return unless jwt_claims["aud"]
73 
74   jwt_claims
75 end

    # File lib/rodauth/features/oauth_jwt_secured_authorization_request.rb
103 def decode_request_object(request_object)
104   request_sig_enc_opts = {
105     jws_algorithm: oauth_application[oauth_applications_request_object_signing_alg_column],
106     jws_encryption_algorithm: oauth_application[oauth_applications_request_object_encryption_alg_column],
107     jws_encryption_method: oauth_application[oauth_applications_request_object_encryption_enc_column]
108   }.compact
109 
110   request_sig_enc_opts[:jws_algorithm] ||= "none" if oauth_request_object_signing_alg_allow_none
111 
112   if request_sig_enc_opts[:jws_algorithm] == "none"
113     redirect_response_error("invalid_request_object") if require_signed_request_object?
114 
115     jwks = nil
116   elsif (jwks = oauth_application_jwks(oauth_application))
117     jwks = JSON.parse(jwks, symbolize_names: true) if jwks.is_a?(String)
118   else
119     redirect_response_error("invalid_request_object")
120   end
121 
122   claims = jwt_decode(request_object,
123                       jwks: jwks,
124                       verify_jti: false,
125                       verify_iss: false,
126                       verify_aud: false,
127                       **request_sig_enc_opts)
128 
129   redirect_response_error("invalid_request_object") unless claims
130 
131   claims
132 end

    # File lib/rodauth/features/oauth_tls_client_auth.rb
158 def distinguished_name_match?(sub1, sub2)
159   sub1 = OpenSSL::X509::Name.parse(sub1) if sub1.is_a?(String)
160   sub2 = OpenSSL::X509::Name.parse(sub2) if sub2.is_a?(String)
161   # OpenSSL::X509::Name#cp calls X509_NAME_cmp via openssl.
162   # https://www.openssl.org/docs/manmaster/man3/X509_NAME_cmp.html
163   # This procedure adheres to the matching rules for Distinguished Names (DN) given in
164   # RFC 4517 section 4.2.15 and RFC 5280 section 7.1.
165   sub1.cmp(sub2).zero?
166 end

   # File lib/rodauth/features/oauth_authorization_code_grant.rb
50 def do_authorize(response_params = {}, response_mode = param_or_nil("response_mode"))
51   response_mode ||= oauth_response_mode
52 
53   redirect_response_error("invalid_request") unless response_mode.nil? || supported_response_mode?(response_mode)
54 
55   response_type = param_or_nil("response_type")
56 
57   redirect_response_error("invalid_request") unless response_type.nil? || supported_response_type?(response_type)
58 
59   case response_type
60   when "code", nil
61     response_params.replace(_do_authorize_code)
62   end
63 
64   response_params["state"] = param("state") if param_or_nil("state")
65 
66   [response_params, response_mode]
67 end

    # File lib/rodauth/features/oauth_dynamic_client_registration.rb
283 def do_register(return_params = request.params.dup)
284   applications_ds = db[oauth_applications_table]
285   application_columns = applications_ds.columns
286 
287   # set defaults
288   create_params = @oauth_application_params
289 
290   # If omitted, an authorization server MAY register a client with a default set of scopes
291   create_params[oauth_applications_scopes_column] ||= return_params["scopes"] = oauth_application_scopes.join(" ")
292 
293   # https://datatracker.ietf.org/doc/html/rfc7591#section-2
294   if create_params[oauth_applications_grant_types_column] ||= begin
295     # If omitted, the default behavior is that the client will use only the "authorization_code" Grant Type.
296     return_params["grant_types"] = %w[authorization_code] # rubocop:disable Lint/AssignmentInCondition
297     "authorization_code"
298   end
299     create_params[oauth_applications_token_endpoint_auth_method_column] ||= begin
300       # If unspecified or omitted, the default is "client_secret_basic", denoting the HTTP Basic
301       # authentication scheme as specified in Section 2.3.1 of OAuth 2.0.
302       return_params["token_endpoint_auth_method"] =
303         "client_secret_basic"
304       "client_secret_basic"
305     end
306   end
307   create_params[oauth_applications_response_types_column] ||= begin
308     # If omitted, the default is that the client will use only the "code" response type.
309     return_params["response_types"] = %w[code]
310     "code"
311   end
312   rescue_from_uniqueness_error do
313     initialize_register_params(create_params, return_params)
314     create_params.delete_if { |k, _| !application_columns.include?(k) }
315     applications_ds.insert(create_params)
316   end
317 
318   return_params
319 end

    # File lib/rodauth/features/oauth_dpop.rb
305 def dpop_bound_access_tokens_required?
306   oauth_dpop_bound_access_tokens || (oauth_application && oauth_application[oauth_applications_dpop_bound_access_tokens_column])
307 end

    # File lib/rodauth/features/oauth_dpop.rb
153 def dpop_decode(dpop)
154   # decode first without verifying!
155   _, headers = jwt_decode_no_key(dpop)
156 
157   redirect_response_error("invalid_dpop_proof") unless verify_dpop_jwt_headers(headers)
158 
159   dpop_jwk = headers["jwk"]
160 
161   jwt_decode(
162     dpop,
163     jws_key: jwk_key(dpop_jwk),
164     jws_algorithm: headers["alg"],
165     verify_iss: false,
166     verify_aud: false,
167     verify_jti: false
168   )
169 end

    # File lib/rodauth/features/oauth_dpop.rb
322 def dpop_nonce_required(dpop_claims)
323   response["DPoP-Nonce"] = generate_dpop_nonce(dpop_claims)
324 
325   if @dpop_access_token
326     # protected resource access
327     throw_json_response_error(401, "use_dpop_nonce")
328   else
329     redirect_response_error("use_dpop_nonce")
330   end
331 end

    # File lib/rodauth/features/oauth_dpop.rb
309 def dpop_use_nonce?
310   oauth_dpop_use_nonce || (oauth_application && oauth_application[oauth_applications_dpop_bound_access_tokens_column])
311 end

    # File lib/rodauth/features/oauth_base.rb
233 def fetch_access_token
234   if (token = request.params["access_token"])
235     if request.post? && !(request.content_type.start_with?("application/x-www-form-urlencoded") &&
236                     request.params.size == 1)
237       return
238     end
239   else
240     token = fetch_access_token_from_authorization_header
241   end
242 
243   return if token.nil? || token.empty?
244 
245   token
246 end

    # File lib/rodauth/features/oauth_base.rb
248 def fetch_access_token_from_authorization_header(token_type = oauth_token_type)
249   value = request.env["HTTP_AUTHORIZATION"]
250 
251   return unless value && !value.empty?
252 
253   scheme, token = value.split(" ", 2)
254 
255   return unless scheme.downcase == token_type
256 
257   token
258 end

    # File lib/rodauth/features/oauth_dpop.rb
294 def fetch_dpop_token
295   dpop = request.env["HTTP_DPOP"]
296 
297   return if dpop.nil? || dpop.empty?
298 
299   # 4.3.1 - There is not more than one DPoP HTTP request header field.
300   redirect_response_error("multiple_dpop_proofs") if dpop.split(";").size > 1
301 
302   dpop
303 end

    # File lib/rodauth/features/oidc.rb
581 def fill_with_account_claims(claims, account, scopes, claims_locales)
582   additional_claims_info = {}
583 
584   scopes_by_claim = scopes.each_with_object({}) do |scope, by_oidc|
585     next if scope == "openid"
586 
587     if scope.is_a?(Array)
588       # essential claims
589       param, additional_info = scope
590 
591       param = param.to_sym
592 
593       oidc, = OIDC_SCOPES_MAP.find do |_, oidc_scopes|
594         oidc_scopes.include?(param)
595       end || param.to_s
596 
597       param = nil if oidc == param.to_s
598 
599       additional_claims_info[param] = additional_info
600     else
601 
602       oidc, param = scope.split(".", 2)
603 
604       param = param.to_sym if param
605     end
606 
607     by_oidc[oidc] ||= []
608 
609     by_oidc[oidc] << param.to_sym if param
610   end
611 
612   oidc_scopes, additional_scopes = scopes_by_claim.keys.partition { |key| OIDC_SCOPES_MAP.key?(key) }
613 
614   claims_locales = claims_locales.split(" ").map(&:to_sym) if claims_locales
615 
616   unless oidc_scopes.empty?
617     if respond_to?(:get_oidc_param)
618       get_oidc_param = proxy_get_param(:get_oidc_param, claims, claims_locales, additional_claims_info)
619 
620       oidc_scopes.each do |scope|
621         scope_claims = claims
622         params = scopes_by_claim[scope]
623         params = params.empty? ? OIDC_SCOPES_MAP[scope] : (OIDC_SCOPES_MAP[scope] & params)
624 
625         scope_claims = (claims["address"] = {}) if scope == "address"
626 
627         params.each do |param|
628           get_oidc_param[account, param, scope_claims]
629         end
630       end
631     else
632       warn "`get_oidc_param(account, claim)` must be implemented to use oidc scopes."
633     end
634   end
635 
636   return if additional_scopes.empty?
637 
638   if respond_to?(:get_additional_param)
639     get_additional_param = proxy_get_param(:get_additional_param, claims, claims_locales, additional_claims_info)
640 
641     additional_scopes.each do |scope|
642       get_additional_param[account, scope.to_sym]
643     end
644   else
645     warn "`get_additional_param(account, claim)` must be implemented to use oidc scopes."
646   end
647 end

    # File lib/rodauth/features/oauth_authorization_code_grant.rb
128     def form_post_error_response_html(url)
129       <<-FORM
130         <html>
131           <head><title></title></head>
132           <body onload="javascript:document.forms[0].submit()">
133             <form method="post" action="#{url}">
134               #{yield}
135             </form>
136           </body>
137         </html>
138       FORM
139     end

    # File lib/rodauth/features/oauth_authorization_code_grant.rb
114     def form_post_response_html(url)
115       <<-FORM
116         <html>
117           <head><title>Authorized</title></head>
118           <body onload="javascript:document.forms[0].submit()">
119             <form method="post" action="#{url}">
120               #{yield}
121               <input type="submit" class="btn btn-outline-primary" value="#{scope.h(oauth_authorize_post_button)}"/>
122             </form>
123           </body>
124         </html>
125       FORM
126     end

    # File lib/rodauth/features/oauth_dpop.rb
357 def generate_dpop_nonce(dpop_claims)
358   issued_at = Time.now.to_i
359 
360   aud = "#{dpop_claims['htm']}:#{dpop_claims['htu']}"
361 
362   nonce_claims = {
363     iss: oauth_jwt_issuer,
364     iat: issued_at,
365     exp: issued_at + oauth_dpop_nonce_expires_in,
366     aud: aud
367   }
368 
369   jwt_encode(nonce_claims)
370 end

    # File lib/rodauth/features/oidc_frontchannel_logout.rb
 76 def generate_frontchannel_logout_urls(visited_sites, logout_urls)
 77   @frontchannel_logout_urls = logout_urls.flat_map do |client_id, logout_url|
 78     next unless logout_url
 79 
 80     sids = visited_sites.select { |cid, _| cid == client_id }.map(&:last)
 81 
 82     sids.map do |sid|
 83       logout_url = URI(logout_url)
 84 
 85       if sid
 86         query = logout_url.query
 87         query = if query
 88                   URI.decode_www_form(query)
 89                 else
 90                   []
 91                 end
 92         query << ["iss", oauth_jwt_issuer]
 93         query << ["sid", sid]
 94         logout_url.query = URI.encode_www_form(query)
 95       end
 96 
 97       logout_url
 98     end
 99   end.compact
100 end

    # File lib/rodauth/features/oidc.rb
508 def generate_id_token(oauth_grant, include_claims = false)
509   oauth_scopes = oauth_grant[oauth_grants_scopes_column].split(oauth_scope_separator)
510 
511   return unless oauth_scopes.include?("openid")
512 
513   signing_algorithm = oauth_application[oauth_applications_id_token_signed_response_alg_column] ||
514                       oauth_jwt_keys.keys.first
515 
516   id_claims = id_token_claims(oauth_grant, signing_algorithm)
517 
518   account = db[accounts_table].where(account_id_column => oauth_grant[oauth_grants_account_id_column]).first
519 
520   # this should never happen!
521   # a newly minted oauth token from a grant should have been assigned to an account
522   # who just authorized its generation.
523   return unless account
524 
525   if (claims = oauth_grant[oauth_grants_claims_column])
526     claims = JSON.parse(claims)
527     if (id_token_essential_claims = claims["id_token"])
528       oauth_scopes |= id_token_essential_claims.to_a
529 
530       include_claims = true
531     end
532   end
533 
534   # OpenID Connect Core 1.0's 5.4 Requesting Claims using Scope Values:
535   # If standard claims (profile, email, etc) are requested as scope values in the Authorization Request,
536   # include in the response.
537   include_claims ||= (OIDC_SCOPES_MAP.keys & oauth_scopes).any?
538 
539   # However, when no Access Token is issued (which is the case for the response_type value id_token),
540   # the resulting Claims are returned in the ID Token.
541   fill_with_account_claims(id_claims, account, oauth_scopes, param_or_nil("claims_locales")) if include_claims
542 
543   params = {
544     jwks: oauth_application_jwks(oauth_application),
545     signing_algorithm: signing_algorithm,
546     encryption_algorithm: oauth_application[oauth_applications_id_token_encrypted_response_alg_column],
547     encryption_method: oauth_application[oauth_applications_id_token_encrypted_response_enc_column],
548 
549     # Not officially part of the spec, but some providers follow this convention.
550     # This is useful for distinguishing between ID Tokens and JWT Access Tokens.
551     headers: { typ: "id_token+jwt" }
552   }.compact
553 
554   oauth_grant[:id_token] = jwt_encode(id_claims, **params)
555 end

    # File lib/rodauth/features/oauth_jwt_base.rb
 98 def generate_jti(payload)
 99   # Use the key and iat to create a unique key per request to prevent replay attacks
100   jti_raw = [
101     payload[:aud] || payload["aud"],
102     payload[:iat] || payload["iat"]
103   ].join(":").to_s
104   Digest::SHA256.hexdigest(jti_raw)
105 end

   # File lib/rodauth/features/oidc_backchannel_logout.rb
50 def generate_logout_token(oauth_application, sid)
51   issued_at = Time.now.to_i
52 
53   logout_claims = {
54     iss: oauth_jwt_issuer, # issuer
55     iat: issued_at, # issued at
56     exp: issued_at + oauth_logout_token_expires_in,
57     aud: oauth_application[oauth_applications_client_id_column],
58     events: {
59       "http://schemas.openid.net/event/backchannel-logout": {}
60     }
61   }
62 
63   logout_claims[:sid] = sid if sid
64 
65   signing_algorithm = oauth_application[oauth_applications_id_token_signed_response_alg_column] ||
66                       oauth_jwt_keys.keys.first
67 
68   params = {
69     jwks: oauth_application_jwks(oauth_application),
70     headers: { typ: "logout+jwt" },
71     signing_algorithm: signing_algorithm,
72     encryption_algorithm: oauth_application[oauth_applications_id_token_encrypted_response_alg_column],
73     encryption_method: oauth_application[oauth_applications_id_token_encrypted_response_enc_column]
74   }.compact
75 
76   jwt_encode(logout_claims, **params)
77 end

   # File lib/rodauth/features/oauth_saml_bearer_grant.rb
72 def generate_saml_settings(saml_settings)
73   settings = OneLogin::RubySaml::Settings.new
74 
75   # issuer
76   settings.idp_entity_id = saml_settings[oauth_saml_settings_issuer_column]
77 
78   # audience
79   settings.sp_entity_id = saml_settings[oauth_saml_settings_audience_column] || token_url
80 
81   # recipient
82   settings.assertion_consumer_service_url = token_url
83 
84   settings.idp_cert = saml_settings[oauth_saml_settings_idp_cert_column]
85   settings.idp_cert_fingerprint = saml_settings[oauth_saml_settings_idp_cert_fingerprint_column]
86   settings.idp_cert_fingerprint_algorithm = saml_settings[oauth_saml_settings_idp_cert_fingerprint_algorithm_column]
87 
88   if settings.idp_cert
89     check_idp_cert_expiration = saml_settings[oauth_saml_settings_idp_cert_check_expiration_column]
90     check_idp_cert_expiration = oauth_saml_idp_cert_check_expiration if check_idp_cert_expiration.nil?
91     settings.security[:check_idp_cert_expiration] = check_idp_cert_expiration
92   end
93   settings.security[:strict_audience_validation] = true
94   settings.security[:want_name_id] = true
95 
96   settings.name_identifier_format = saml_settings[oauth_saml_settings_name_identifier_format_column] ||
97                                     oauth_saml_name_identifier_format
98   settings
99 end

   # File lib/rodauth/features/oidc_session_management.rb
64 def generate_session_state
65   salt = oauth_oidc_session_management_salt
66 
67   uri = URI(redirect_uri)
68   origin = if uri.respond_to?(:origin)
69              uri.origin
70            else
71              # TODO: remove when not supporting uri < 0.11
72              "#{uri.scheme}://#{uri.host}#{":#{uri.port}" if uri.port != uri.default_port}"
73            end
74   session_id = "#{oauth_application[oauth_applications_client_id_column]} " \
75                "#{origin} " \
76                "#{request.cookies[oauth_oidc_user_agent_state_cookie_key]} #{salt}"
77 
78   "#{Digest::SHA256.hexdigest(session_id)}.#{salt}"
79 end

    # File lib/rodauth/features/oauth_base.rb
464 def generate_token(grant_params = {}, should_generate_refresh_token = true)
465   if grant_params[oauth_grants_id_column] && oauth_reuse_access_token &&
466      (
467        if oauth_grants_token_hash_column
468          grant_params[oauth_grants_token_hash_column]
469        else
470          grant_params[oauth_grants_token_column]
471        end
472      )
473     return grant_params
474   end
475 
476   update_params = {
477     oauth_grants_expires_in_column => Sequel.date_add(Sequel::CURRENT_TIMESTAMP, seconds: oauth_access_token_expires_in),
478     oauth_grants_code_column => nil
479   }
480 
481   rescue_from_uniqueness_error do
482     access_token = _generate_access_token(update_params)
483     refresh_token = _generate_refresh_token(update_params) if should_generate_refresh_token
484     oauth_grant = store_token(grant_params, update_params)
485 
486     return unless oauth_grant
487 
488     oauth_grant[oauth_grants_token_column] = access_token
489     oauth_grant[oauth_grants_refresh_token_column] = refresh_token if refresh_token
490     oauth_grant
491   end
492 end

    # File lib/rodauth/features/oauth_base.rb
450 def generate_token_hash(token)
451   Base64.urlsafe_encode64(Digest::SHA256.digest(token))
452 end

    # File lib/rodauth/features/oauth_device_code_grant.rb
120 def generate_user_code
121   user_code_size = oauth_device_code_grant_user_code_size
122   SecureRandom.random_number(36**user_code_size)
123               .to_s(36) # 0 to 9, a to z
124               .upcase
125               .rjust(user_code_size, "0")
126 end

    # File lib/rodauth/features/oidc.rb
350 def get_oidc_account_last_login_at(account_id)
351   return get_activity_timestamp(account_id, account_activity_last_activity_column) if features.include?(:account_expiration)
352 
353   # active sessions based
354   ds = db[active_sessions_table].where(active_sessions_account_id_column => account_id)
355 
356   ds = ds.order(Sequel.desc(active_sessions_created_at_column))
357 
358   convert_timestamp(ds.get(active_sessions_created_at_column))
359 end

    # File lib/rodauth/features/oauth_base.rb
454 def grant_from_application?(oauth_grant, oauth_application)
455   oauth_grant[oauth_grants_oauth_application_id_column] == oauth_application[oauth_applications_id_column]
456 end

    # File lib/rodauth/features/oidc.rb
557 def id_token_claims(oauth_grant, signing_algorithm)
558   claims = jwt_claims(oauth_grant)
559 
560   claims[:nonce] = oauth_grant[oauth_grants_nonce_column] if oauth_grant[oauth_grants_nonce_column]
561 
562   claims[:acr] = oauth_grant[oauth_grants_acr_column] if oauth_grant[oauth_grants_acr_column]
563 
564   # Time when the End-User authentication occurred.
565   claims[:auth_time] = get_oidc_account_last_login_at(oauth_grant[oauth_grants_account_id_column]).to_i
566 
567   # Access Token hash value.
568   if (access_token = oauth_grant[oauth_grants_token_column])
569     claims[:at_hash] = id_token_hash(access_token, signing_algorithm)
570   end
571 
572   # code hash value.
573   if (code = oauth_grant[oauth_grants_code_column])
574     claims[:c_hash] = id_token_hash(code, signing_algorithm)
575   end
576 
577   claims
578 end

    # File lib/rodauth/features/oidc.rb
863 def id_token_hash(hash, algo)
864   digest = case algo
865            when /256/ then Digest::SHA256
866            when /384/ then Digest::SHA384
867            when /512/ then Digest::SHA512
868            end
869 
870   return unless digest
871 
872   hash = digest.digest(hash)
873   hash = hash[0...(hash.size / 2)]
874   Base64.urlsafe_encode64(hash).tr("=", "")
875 end

    # File lib/rodauth/features/oauth_dynamic_client_registration.rb
321 def initialize_register_params(create_params, return_params)
322   client_id = oauth_unique_id_generator
323   create_params[oauth_applications_client_id_column] = client_id
324   return_params["client_id"] = client_id
325   return_params["client_id_issued_at"] = Time.now.utc.iso8601
326 
327   registration_access_token = oauth_unique_id_generator
328   create_params[oauth_applications_registration_access_token_column] = secret_hash(registration_access_token)
329   return_params["registration_access_token"] = registration_access_token
330   return_params["registration_client_uri"] = "#{base_url}/#{registration_client_uri_route}/#{return_params['client_id']}"
331 
332   if create_params.key?(oauth_applications_client_secret_column)
333     set_client_secret(create_params, create_params[oauth_applications_client_secret_column])
334     return_params.delete("client_secret")
335   else
336     client_secret = oauth_unique_id_generator
337     set_client_secret(create_params, client_secret)
338     return_params["client_secret"] = client_secret
339     return_params["client_secret_expires_at"] = 0
340 
341   end
342 end

   # File lib/rodauth/features/oauth_resource_server.rb
47 def introspection_request(token_type_hint, token)
48   introspect_url = URI("#{authorization_server_url}#{introspect_path}")
49 
50   response = http_request(introspect_url, { "token_type_hint" => token_type_hint, "token" => token }) do |request|
51     before_introspection_request(request)
52   end
53 
54   JSON.parse(response.body)
55 end

    # File lib/rodauth/features/oauth_base.rb
644 def json_access_token_payload(oauth_grant)
645   payload = {
646     "access_token" => oauth_grant[oauth_grants_token_column],
647     "token_type" => oauth_token_type,
648     "expires_in" => oauth_access_token_expires_in
649   }
650   payload["refresh_token"] = oauth_grant[oauth_grants_refresh_token_column] if oauth_grant[oauth_grants_refresh_token_column]
651   payload
652 end

    # File lib/rodauth/features/oauth_base.rb
195 def json_request?
196   return super if features.include?(:jsonn)
197   return @json_request if defined?(@json_request)
198 
199   @json_request = request.content_type =~ json_request_regexp
200 end

    # File lib/rodauth/features/oauth_dynamic_client_registration.rb
402 def json_response_oauth_application(oauth_application)
403   params = methods.map { |k| k.to_s[/\Aoauth_applications_(\w+)_column\z/, 1] }.compact
404 
405   body = params.each_with_object({}) do |k, hash|
406     next if %w[id account_id client_id client_secret cliennt_secret_hash].include?(k)
407 
408     value = oauth_application[__send__(:"oauth_applications_#{k}_column")]
409 
410     next unless value
411 
412     case k
413     when "redirect_uri"
414       hash["redirect_uris"] = value.split(" ")
415     when "token_endpoint_auth_method", "grant_types", "response_types", "request_uris", "post_logout_redirect_uris"
416       hash[k] = value.split(" ")
417     when "scopes"
418       hash["scope"] = value
419     when "jwks"
420       hash[k] = value.is_a?(String) ? JSON.parse(value) : value
421     when "homepage_url"
422       hash["client_uri"] = value
423     when "name"
424       hash["client_name"] = value
425     else
426       hash[k] = value
427     end
428   end
429 
430   response.status = 200
431   response["Content-Type"] ||= json_response_content_type
432   response["Cache-Control"] = "no-store"
433   response["Pragma"] = "no-cache"
434   json_payload = _json_response_body(body)
435   return_response(json_payload)
436 end

    # File lib/rodauth/features/oauth_base.rb
808 def json_response_success(body, cache = false)
809   response.status = 200
810   response["Content-Type"] ||= json_response_content_type
811   if cache
812     # defaulting to 1-day for everyone, for now at least
813     max_age = 60 * 60 * 24
814     response["Cache-Control"] = "private, max-age=#{max_age}"
815   else
816     response["Cache-Control"] = "no-store"
817     response["Pragma"] = "no-cache"
818   end
819   json_payload = _json_response_body(body)
820   return_response(json_payload)
821 end

    # File lib/rodauth/features/oauth_dpop.rb
390 def json_token_introspect_payload(grant_or_claims)
391   claims = super
392 
393   return claims unless grant_or_claims
394 
395   if (jkt = grant_or_claims.dig("cnf", "jkt"))
396     (claims[:cnf] ||= {})[:jkt] = jkt
397     claims[:token_type] = "DPoP"
398   end
399 
400   claims
401 end

    # File lib/rodauth/features/oidc.rb
781 def json_webfinger_payload
782   JSON.dump({
783               subject: param("resource"),
784               links: [{
785                 rel: "http://openid.net/specs/connect/1.0/issuer",
786                 href: authorization_server_url
787               }]
788             })
789 end

    # File lib/rodauth/features/oauth_jwt_base.rb
152 def jwk_export(key)
153   key_to_jwk(key)
154 end

    # File lib/rodauth/features/oauth_jwt_base.rb
156 def jwk_import(jwk)
157   JSON::JWK.new(jwk)
158 end

    # File lib/rodauth/features/oauth_jwt_base.rb
160 def jwk_key(jwk)
161   jwk = jwk_import(jwk) unless jwk.is_a?(JSON::JWK)
162   jwk.to_key
163 end

    # File lib/rodauth/features/oauth_jwt_base.rb
165 def jwk_thumbprint(jwk)
166   jwk = jwk_import(jwk) if jwk.is_a?(Hash)
167   jwk.thumbprint
168 end

   # File lib/rodauth/features/oauth_jwt_jwks.rb
28 def jwks_set
29   @jwks_set ||= [
30     *(
31       unless oauth_jwt_public_keys.empty?
32         oauth_jwt_public_keys.flat_map { |algo, pkeys| Array(pkeys).map { |pkey| jwk_export(pkey).merge(use: "sig", alg: algo) } }
33       end
34     ),
35     *(
36       unless oauth_jwt_jwe_public_keys.empty?
37         oauth_jwt_jwe_public_keys.flat_map do |(algo, _enc), pkeys|
38           Array(pkeys).map do |pkey|
39             jwk_export(pkey).merge(use: "enc", alg: algo)
40           end
41         end
42       end
43     )
44   ].compact
45 end

   # File lib/rodauth/features/oauth_jwt_bearer_grant.rb
83 def jwt_assertion(assertion, **kwargs)
84   claims = jwt_decode(assertion, verify_iss: false, verify_aud: false, verify_jti: false, **kwargs)
85 
86   return unless claims && verify_aud(request.url, claims["aud"])
87 
88   claims
89 end

    # File lib/rodauth/features/oauth_dpop.rb
234 def jwt_claims(oauth_grant)
235   claims = super
236   if @dpop_thumbprint
237     # the authorization server associates the issued access token with the
238     # public key from the DPoP proof
239     claims[:cnf] = { jkt: @dpop_thumbprint }
240   end
241   claims
242 end

    # File lib/rodauth/features/oauth_jwt_base.rb
217 def jwt_decode(
218   token,
219   jwks: nil,
220   jws_algorithm: oauth_jwt_public_keys.keys.first || oauth_jwt_keys.keys.first,
221   jws_key: oauth_jwt_keys[jws_algorithm] || _jwt_key,
222   jws_encryption_algorithm: oauth_jwt_jwe_keys.keys.dig(0, 0),
223   jws_encryption_method: oauth_jwt_jwe_keys.keys.dig(0, 1),
224   jwe_key: oauth_jwt_jwe_keys[[jws_encryption_algorithm, jws_encryption_method]] || oauth_jwt_jwe_keys.values.first,
225   verify_claims: true,
226   verify_jti: true,
227   verify_iss: true,
228   verify_aud: true,
229   verify_headers: nil,
230   **
231 )
232   jws_key = jws_key.first if jws_key.is_a?(Array)
233 
234   if jwe_key
235     jwe_key = jwe_key.first if jwe_key.is_a?(Array)
236     token = JSON::JWT.decode(token, jwe_key).plain_text
237   end
238 
239   claims = if is_authorization_server?
240              if jwks
241                jwks = jwks[:keys] if jwks.is_a?(Hash)
242 
243                enc_algs = [jws_encryption_algorithm].compact
244                enc_meths = [jws_encryption_method].compact
245 
246                sig_algs = jws_algorithm ? [jws_algorithm] : jwks.select { |k| k[:use] == "sig" }.map { |k| k[:alg] }
247                sig_algs = sig_algs.compact.map(&:to_sym)
248 
249                # JWKs may be set up without a KID, when there's a single one
250                if jwks.size == 1 && !jwks[0][:kid]
251                  key = jwks[0]
252                  jwk_key = JSON::JWK.new(key)
253                  jws = JSON::JWT.decode(token, jwk_key)
254                else
255                  jws = JSON::JWT.decode(token, JSON::JWK::Set.new({ keys: jwks }), enc_algs + sig_algs, enc_meths)
256                  jws = JSON::JWT.decode(jws.plain_text, JSON::JWK::Set.new({ keys: jwks }), sig_algs) if jws.is_a?(JSON::JWE)
257                end
258                jws
259              elsif jws_key
260                JSON::JWT.decode(token, jws_key)
261              else
262                JSON::JWT.decode(token, nil, jws_algorithm)
263              end
264            elsif (jwks = auth_server_jwks_set)
265              JSON::JWT.decode(token, JSON::JWK::Set.new(jwks))
266            end
267 
268   now = Time.now
269   if verify_claims &&
270      (!claims[:exp] || Time.at(claims[:exp]) < now) &&
271      claims[:nbf] && Time.at(claims[:nbf]) < now &&
272      claims[:iat] && Time.at(claims[:iat]) < now &&
273      verify_iss && claims[:iss] != oauth_jwt_issuer &&
274      verify_aud && !verify_aud(claims[:aud], claims[:client_id]) &&
275      verify_jti && !verify_jti(claims[:jti], claims)
276 
277     return
278   end
279 
280   return if verify_headers && !verify_headers.call(claims.header)
281 
282   claims
283 rescue JSON::JWT::Exception
284   nil
285 end

    # File lib/rodauth/features/oauth_jwt_base.rb
287 def jwt_decode_no_key(token)
288   jws = JSON::JWT.decode(token, :skip_verification)
289   [jws.to_h, jws.header]
290 end

    # File lib/rodauth/features/oauth_jwt_base.rb
469 def jwt_decode_with_jwe(
470   token,
471   jwks: nil,
472   jws_encryption_algorithm: oauth_jwt_jwe_keys.keys.dig(0, 0),
473   jws_encryption_method: oauth_jwt_jwe_keys.keys.dig(0, 1),
474   jwe_key: oauth_jwt_jwe_keys[[jws_encryption_algorithm, jws_encryption_method]] || oauth_jwt_jwe_keys.values.first,
475   **args
476 )
477   token = if jwks && jwks.any? { |k| k[:use] == "enc" }
478             JWE.__rodauth_oauth_decrypt_from_jwks(token, jwks, alg: jws_encryption_algorithm, enc: jws_encryption_method)
479           elsif jwe_key
480             jwe_key = jwe_key.first if jwe_key.is_a?(Array)
481             JWE.decrypt(token, jwe_key)
482           else
483             token
484           end
485 
486   jwt_decode_without_jwe(token, jwks: jwks, **args)
487 rescue JWE::DecodeError => e
488   jwt_decode_without_jwe(token, jwks: jwks, **args) if e.message.include?("Not enough or too many segments")
489 end

    # File lib/rodauth/features/oauth_jwt_base.rb
174 def jwt_encode(payload,
175                jwks: nil,
176                headers: {},
177                encryption_algorithm: oauth_jwt_jwe_keys.keys.dig(0, 0),
178                encryption_method: oauth_jwt_jwe_keys.keys.dig(0, 1),
179                jwe_key: oauth_jwt_jwe_keys[[encryption_algorithm,
180                                             encryption_method]],
181                signing_algorithm: oauth_jwt_keys.keys.first)
182   payload[:jti] = generate_jti(payload)
183   jwt = JSON::JWT.new(payload)
184 
185   key = oauth_jwt_keys[signing_algorithm] || _jwt_key
186   key = key.first if key.is_a?(Array)
187 
188   jwk = JSON::JWK.new(key || "")
189 
190   # update headers
191   headers.each_key do |k|
192     if jwt.respond_to?(:"#{k}=")
193       jwt.send(:"#{k}=", headers[k])
194       headers.delete(k)
195     end
196   end
197   jwt.header.merge(headers) unless headers.empty?
198 
199   jwt = jwt.sign(jwk, signing_algorithm)
200 
201   return jwt.to_s unless encryption_algorithm && encryption_method
202 
203   if jwks && (jwk = jwks.find { |k| k[:use] == "enc" && k[:alg] == encryption_algorithm && k[:enc] == encryption_method })
204     jwk = JSON::JWK.new(jwk)
205     jwe = jwt.encrypt(jwk, encryption_algorithm.to_sym, encryption_method.to_sym)
206     jwe.to_s
207   elsif jwe_key
208     jwe_key = jwe_key.first if jwe_key.is_a?(Array)
209     algorithm = encryption_algorithm.to_sym
210     meth = encryption_method.to_sym
211     jwt.encrypt(jwe_key, algorithm, meth)
212   else
213     jwt.to_s
214   end
215 end

    # File lib/rodauth/features/oauth_jwt_secured_authorization_response_mode.rb
 99 def jwt_encode_authorization_response_mode(params)
100   now = Time.now.to_i
101   claims = {
102     iss: oauth_jwt_issuer,
103     aud: oauth_application[oauth_applications_client_id_column],
104     exp: now + oauth_authorization_response_mode_expires_in,
105     iat: now
106   }.merge(params)
107 
108   encode_params = {
109     jwks: oauth_application_jwks(oauth_application),
110     signing_algorithm: oauth_application[oauth_applications_authorization_signed_response_alg_column],
111     encryption_algorithm: oauth_application[oauth_applications_authorization_encrypted_response_alg_column],
112     encryption_method: oauth_application[oauth_applications_authorization_encrypted_response_enc_column]
113   }.compact
114 
115   jwt_encode(claims, **encode_params)
116 end

    # File lib/rodauth/features/oauth_jwt_base.rb
367 def jwt_encode_with_jwe(
368   payload,
369   jwks: nil,
370   encryption_algorithm: oauth_jwt_jwe_keys.keys.dig(0, 0),
371   encryption_method: oauth_jwt_jwe_keys.keys.dig(0, 1),
372   jwe_key: oauth_jwt_jwe_keys[[encryption_algorithm, encryption_method]],
373   **args
374 )
375   token = jwt_encode_without_jwe(payload, **args)
376 
377   return token unless encryption_algorithm && encryption_method
378 
379   if jwks && jwks.any? { |k| k[:use] == "enc" }
380     JWE.__rodauth_oauth_encrypt_from_jwks(token, jwks, alg: encryption_algorithm, enc: encryption_method)
381   elsif jwe_key
382     jwe_key = jwe_key.first if jwe_key.is_a?(Array)
383     params = {
384       zip: "DEF",
385       copyright: oauth_jwt_jwe_copyright
386     }
387     params[:enc] = encryption_method if encryption_method
388     params[:alg] = encryption_algorithm if encryption_algorithm
389     JWE.encrypt(token, jwe_key, **params)
390   else
391     token
392   end
393 end

    # File lib/rodauth/features/oidc.rb
849 def jwt_response_success(jwt, cache = false)
850   response.status = 200
851   response["Content-Type"] ||= "application/jwt"
852   if cache
853     # defaulting to 1-day for everyone, for now at least
854     max_age = 60 * 60 * 24
855     response["Cache-Control"] = "private, max-age=#{max_age}"
856   else
857     response["Cache-Control"] = "no-store"
858     response["Pragma"] = "no-cache"
859   end
860   return_response(jwt)
861 end

   # File lib/rodauth/features/oauth_jwt_base.rb
66 def jwt_subject(account_unique_id, client_application = oauth_application)
67   (account_unique_id || client_application[oauth_applications_client_id_column]).to_s
68 end

    # File lib/rodauth/features/oauth_jwt_base.rb
148 def key_to_jwk(key)
149   JSON::JWK.new(key)
150 end

    # File lib/rodauth/features/oauth_application_management.rb
 73 def load_oauth_application_management_routes
 74   request.on(oauth_applications_route) do
 75     check_csrf if check_csrf?
 76     require_account
 77 
 78     request.get "new" do
 79       new_oauth_application_view
 80     end
 81 
 82     request.on(oauth_applications_id_pattern) do |id|
 83       oauth_application = db[oauth_applications_table]
 84                           .where(oauth_applications_id_column => id)
 85                           .where(oauth_applications_account_id_column => account_id)
 86                           .first
 87       next unless oauth_application
 88 
 89       scope.instance_variable_set(:@oauth_application, oauth_application)
 90 
 91       request.is do
 92         request.get do
 93           oauth_application_view
 94         end
 95       end
 96 
 97       request.on(oauth_applications_oauth_grants_path) do
 98         page = Integer(param_or_nil("page") || 1)
 99         per_page = per_page_param(oauth_grants_per_page)
100         oauth_grants = db[oauth_grants_table]
101                        .where(oauth_grants_oauth_application_id_column => id)
102                        .order(Sequel.desc(oauth_grants_id_column))
103         scope.instance_variable_set(:@oauth_grants, oauth_grants.paginate(page, per_page))
104         request.is do
105           request.get do
106             oauth_application_oauth_grants_view
107           end
108         end
109       end
110     end
111 
112     request.is do
113       request.get do
114         page = Integer(param_or_nil("page") || 1)
115         per_page = per_page_param(oauth_applications_per_page)
116         scope.instance_variable_set(:@oauth_applications, db[oauth_applications_table]
117           .where(oauth_applications_account_id_column => account_id)
118           .order(Sequel.desc(oauth_applications_id_column))
119           .paginate(page, per_page))
120 
121         oauth_applications_view
122       end
123 
124       request.post do
125         catch_error do
126           validate_oauth_application_params
127 
128           transaction do
129             before_create_oauth_application
130             id = create_oauth_application
131             after_create_oauth_application
132             set_notice_flash create_oauth_application_notice_flash
133             redirect "#{request.path}/#{id}"
134           end
135         end
136         set_error_flash create_oauth_application_error_flash
137         new_oauth_application_view
138       end
139     end
140   end
141 end

   # File lib/rodauth/features/oauth_grant_management.rb
36 def load_oauth_grant_management_routes
37   request.on(oauth_grants_route) do
38     check_csrf if check_csrf?
39     require_account
40 
41     request.post(oauth_grants_id_pattern) do |id|
42       db[oauth_grants_table]
43         .where(oauth_grants_id_column => id)
44         .where(oauth_grants_account_id_column => account_id)
45         .update(oauth_grants_revoked_at_column => Sequel::CURRENT_TIMESTAMP)
46 
47       set_notice_flash revoke_oauth_grant_notice_flash
48       redirect oauth_grants_path || "/"
49     end
50 
51     request.is do
52       request.get do
53         page = Integer(param_or_nil("page") || 1)
54         per_page = per_page_param(oauth_grants_per_page)
55 
56         scope.instance_variable_set(:@oauth_grants, db[oauth_grants_table]
57           .select(Sequel[oauth_grants_table].*, Sequel[oauth_applications_table][oauth_applications_name_column])
58           .join(oauth_applications_table, Sequel[oauth_grants_table][oauth_grants_oauth_application_id_column] =>
59             Sequel[oauth_applications_table][oauth_applications_id_column])
60           .where(Sequel[oauth_grants_table][oauth_grants_account_id_column] => account_id)
61           .where(oauth_grants_revoked_at_column => nil)
62           .order(Sequel.desc(oauth_grants_id_column))
63           .paginate(page, per_page))
64         oauth_grants_view
65       end
66     end
67   end
68 end

    # File lib/rodauth/features/oauth_base.rb
150 def load_oauth_server_metadata_route(issuer = nil)
151   request.on(".well-known") do
152     request.get("oauth-authorization-server") do
153       json_response_success(oauth_server_metadata_body(issuer), true)
154     end
155   end
156 end

    # File lib/rodauth/features/oidc.rb
186 def load_openid_configuration_route(alt_issuer = nil)
187   request.on(".well-known/openid-configuration") do
188     allow_cors(request)
189 
190     request.is do
191       request.get do
192         json_response_success(openid_configuration_body(alt_issuer), cache: true)
193       end
194     end
195   end
196 end

   # File lib/rodauth/features/oauth_dynamic_client_registration.rb
17 def load_registration_client_uri_routes
18   request.on(registration_client_uri_route) do
19     # CLIENT REGISTRATION URI
20     request.on(String) do |client_id|
21       token = (v = request.env["HTTP_AUTHORIZATION"]) && v[/\A *Bearer (.*)\Z/, 1]
22 
23       next unless token
24 
25       oauth_application = db[oauth_applications_table]
26                           .where(oauth_applications_client_id_column => client_id)
27                           .first
28       next unless oauth_application
29 
30       authorization_required unless password_hash_match?(oauth_application[oauth_applications_registration_access_token_column], token)
31 
32       request.is do
33         request.get do
34           json_response_oauth_application(oauth_application)
35         end
36         request.on method: :put do
37           %w[client_id registration_access_token registration_client_uri client_secret_expires_at
38              client_id_issued_at].each do |prohibited_param|
39             if request.params.key?(prohibited_param)
40               register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message(prohibited_param))
41             end
42           end
43           validate_client_registration_params
44 
45           # if the client includes the "client_secret" field in the request, the value of this field MUST match the currently
46           # issued client secret for that client.  The client MUST NOT be allowed to overwrite its existing client secret with
47           # its own chosen value.
48           authorization_required if request.params.key?("client_secret") && secret_matches?(oauth_application,
49                                                                                             request.params["client_secret"])
50 
51           oauth_application = transaction do
52             applications_ds = db[oauth_applications_table]
53             __update_and_return__(applications_ds, @oauth_application_params)
54           end
55           json_response_oauth_application(oauth_application)
56         end
57 
58         request.on method: :delete do
59           applications_ds = db[oauth_applications_table]
60           applications_ds.where(oauth_applications_client_id_column => client_id).delete
61           response.status = 204
62           response["Cache-Control"] = "no-store"
63           response["Pragma"] = "no-cache"
64           response.finish
65         end
66       end
67     end
68   end
69 end

    # File lib/rodauth/features/oidc.rb
198 def load_webfinger_route
199   request.on(".well-known/webfinger") do
200     request.get do
201       resource = param_or_nil("resource")
202 
203       throw_json_response_error(400, "invalid_request") unless resource
204 
205       response.status = 200
206       response["Content-Type"] ||= "application/jrd+json"
207 
208       return_response(json_webfinger_payload)
209     end
210   end
211 end

   # File lib/rodauth/features/oidc_backchannel_logout.rb
18 def logout
19   visited_sites = session[visited_sites_key]
20 
21   return super unless visited_sites
22 
23   oauth_applications = db[oauth_applications_table].where(oauth_applications_client_id_column => visited_sites.map(&:first))
24                                                    .as_hash(oauth_applications_id_column)
25 
26   logout_params = oauth_applications.flat_map do |_id, oauth_application|
27     logout_url = oauth_application[oauth_applications_backchannel_logout_uri_column]
28 
29     next unless logout_url
30 
31     client_id = oauth_application[oauth_applications_client_id_column]
32 
33     sids = visited_sites.select { |cid, _| cid == client_id }.map(&:last)
34 
35     sids.map do |sid|
36       logout_token = generate_logout_token(oauth_application, sid)
37 
38       [logout_url, logout_token]
39     end
40   end.compact
41 
42   perform_logout_requests(logout_params) unless logout_params.empty?
43 
44   # now we can clear the session
45   super
46 end

    # File lib/rodauth/features/oauth_authorize_base.rb
239 def normalize_redirect_uri_for_comparison(redirect_uri)
240   uri = URI(redirect_uri)
241 
242   return redirect_uri unless uri.scheme == "http" && uri.port
243 
244   hostname = uri.hostname
245 
246   # https://www.rfc-editor.org/rfc/rfc8252#section-7.3
247   # ignore (potentially ephemeral) port number for native clients per RFC8252
248   begin
249     ip = IPAddr.new(hostname)
250     uri.port = nil if ip.loopback?
251   rescue IPAddr::InvalidAddressError
252     # https://www.rfc-editor.org/rfc/rfc8252#section-8.3
253     # Although the use of localhost is NOT RECOMMENDED, it is still allowed.
254     uri.port = nil if hostname == "localhost"
255   end
256 
257   uri.to_s
258 end

    # File lib/rodauth/features/oauth_base.rb
314 def oauth_account_ds(account_id)
315   account_ds(account_id)
316 end

    # File lib/rodauth/features/oidc.rb
275 def oauth_acr_values_supported
276   acr_values = []
277   acr_values << "phrh" if features.include?(:webauthn_login)
278   acr_values << "phr" if respond_to?(:require_two_factor_authenticated)
279   acr_values
280 end

    # File lib/rodauth/features/oauth_base.rb
221 def oauth_application
222   return @oauth_application if defined?(@oauth_application)
223 
224   @oauth_application = begin
225     client_id = param_or_nil("client_id")
226 
227     return unless client_id
228 
229     db[oauth_applications_table].filter(oauth_applications_client_id_column => client_id).first
230   end
231 end

    # File lib/rodauth/features/oauth_base.rb
318 def oauth_application_ds(oauth_application_id)
319   db[oauth_applications_table].where(oauth_applications_id_column => oauth_application_id)
320 end

   # File lib/rodauth/features/oidc_logout_base.rb
43 def oauth_application_in_visited_sites
44   visited_sites = session[visited_sites_key] || []
45 
46   session_id = yield
47 
48   visited_site = [oauth_application[oauth_applications_client_id_column], session_id]
49 
50   return if visited_sites.include?(visited_site)
51 
52   visited_sites << visited_site
53   set_session_value(visited_sites_key, visited_sites)
54 end

    # File lib/rodauth/features/oauth_jwt_base.rb
115 def oauth_application_jwks(oauth_application)
116   jwks = oauth_application[oauth_applications_jwks_column]
117 
118   if jwks
119     jwks = JSON.parse(jwks, symbolize_names: true) if jwks.is_a?(String)
120     return jwks
121   end
122 
123   jwks_uri = oauth_application[oauth_applications_jwks_uri_column]
124 
125   return unless jwks_uri
126 
127   jwks_uri = URI(jwks_uri)
128 
129   http_request_with_cache(jwks_uri)
130 end

    # File lib/rodauth/features/oauth_application_management.rb
145 def oauth_application_params
146   @oauth_application_params ||= oauth_application_required_params.each_with_object({}) do |param, params|
147     value = request.params[__send__(:"oauth_application_#{param}_param")]
148     if value && !value.empty?
149       params[param] = value
150     else
151       set_field_error(param, null_error_message)
152     end
153   end
154 end