Class: Doorkeeper::OAuth::Token

Inherits:
Object
  • Object
show all
Defined in:
lib/doorkeeper/oauth/token.rb

Constant Summary collapse

PARAMETER_EXTRACTORS =

Built-in extractors that read a request parameter, and the parameter each of them reads. RFC 6750 treats the form-encoded body (§2.2) and the URI query string (§2.3) as two distinct transmission methods, but Rack and ActionDispatch both collapse them into a single parameter hash — ActionDispatch lets the query win, Rack lets the body win — so a request carrying the parameter in both would present a single value to the extractor and never be refused. The multi-method check reads the two sources separately for these extractors; selection keeps using the extractor, so which one wins is unchanged.

{
  from_access_token_param: "access_token",
  from_bearer_param: "bearer_token",
}.freeze

Class Method Summary collapse

Class Method Details

.authenticate(request, *methods) ⇒ Object 



61
62
63
64
65
66
67
68
69
 
# File 'lib/doorkeeper/oauth/token.rb', line 61

def authenticate(request, *methods)
  if (token = from_request(request, *methods))
    access_token = Doorkeeper.config.access_token_model.by_token(token)
    if access_token.present? && Doorkeeper.config.refresh_token_enabled?
      access_token.revoke_previous_refresh_token!
    end
    access_token
  end
end

.from_access_token_param(request) ⇒ Object 



71
72
73
 
# File 'lib/doorkeeper/oauth/token.rb', line 71

def from_access_token_param(request)
  request.parameters[:access_token]
end

.from_basic_authorization(request) ⇒ Object 



85
86
87
88
89
 
# File 'lib/doorkeeper/oauth/token.rb', line 85

def from_basic_authorization(request)
  pattern = /^Basic /i
  header = request.authorization
  token_from_basic_header(header, pattern) if match?(header, pattern)
end

.from_bearer_authorization(request) ⇒ Object 



79
80
81
82
83
 
# File 'lib/doorkeeper/oauth/token.rb', line 79

def from_bearer_authorization(request)
  pattern = /^Bearer /i
  header = request.authorization
  token_from_header(header, pattern) if match?(header, pattern)
end

.from_bearer_param(request) ⇒ Object 



75
76
77
 
# File 'lib/doorkeeper/oauth/token.rb', line 75

def from_bearer_param(request)
  request.parameters[:bearer_token]
end

.from_request(request, *methods) ⇒ Object

RFC 6750 §2: "Clients MUST NOT use more than one method to transmit the token in each request", and §3.1 lists using more than one method among the conditions an invalid_request answers. Returning the first method that yields a value would discard every other token presented in the same request with no error, warning or log entry, leaving which token authorizes the request to be decided by the configured order of access_token_methods rather than by what the caller sent — so a layer in front of Doorkeeper that reads a different one of them can reach a different verdict about the very same request.

What §2 forbids is using more than one method, so the check counts transmission methods rather than comparing the tokens they carry: the same value presented twice is still two methods. Refusal answers nil: the caller is told the request carries no usable token and fails closed with the invalid_token (401) response, keeping every calling contract on this stable branch intact — the invalid_request (400) that §3.1 strictly prescribes needs a new error and render path, so it ships with 6.0 only.

Only the built-in extractors — symbols naming methods on this class, all of them side-effect-free reads of the request — take part in that check. A custom callable extractor is a configuration adapter rather than a transmission method: it keeps the historical first-wins selection and is never invoked more than once, the same exemption client authentication gives its legacy callable extractors (Request#validate_client_authentication!).



47
48
49
50
51
52
53
54
55
56
57
58
59
 
# File 'lib/doorkeeper/oauth/token.rb', line 47

def from_request(request, *methods)
  used = methods.sum do |method|
    method.is_a?(Symbol) ? transmission_methods_used(request, method) : 0
  end

  return if used > 1

  methods.inject(nil) do |_, method|
    method = self.method(method) if method.is_a?(Symbol)
    credentials = method.call(request)
    break credentials if credentials.present?
  end
end