Releases | Ecosyste.ms: Ruby

https://github.com/doorkeeper-gem/doorkeeper -

[#1755] Fix the error message for force_pkce
[#1761] Memoize authentication failure
[#1762] Allow missing client to trigger invalid client error when force_pkce is enabled
[#1767] Make sure error handling happens on a controller level opposed to action level to account for the controller being extended

- Ruby
Published by nbulaj 11 months ago

https://github.com/doorkeeper-gem/doorkeeper - v5.8.1

[#1752] Bump the range of supported Ruby and Rails versions
[#1747] Fix unknown pkce method error when configured
[#1744] Allow for expired refresh tokens to be revoked
[#1754] Fix refresh tokens with dynamic scopes

- Ruby
Published by nbulaj about 1 year ago

https://github.com/doorkeeper-gem/doorkeeper - v5.8.0

[#1739] Add support for dynamic scopes
[#1715] Fix token introspection invalid request reason
[#1714] Fix Doorkeeper::AccessToken.find_or_create_for with empty scopes which raises NoMethodError
[#1712] Add Pragma: no-cache to token response
[#1726] Refactor token introspection class.
[#1727] Allow to set null secret value for Applications if they are public.
[#1735] Add pkce_code_challenge_methods config option.

- Ruby
Published by nbulaj over 1 year ago

https://github.com/doorkeeper-gem/doorkeeper - v5.7.1

[#1705] Add force_pkce option that requires non-confidential clients to use PKCE when requesting an access_token using an authorization code

- Ruby
Published by nbulaj over 1 year ago

https://github.com/doorkeeper-gem/doorkeeper - v5.7.0

[#1696] Add missing #issued_token method to OAuth::TokenResponse
[#1697] Allow a TokenResponse body to be customized (memoize response body).
[#1702] Fix bugs for error response in the form_post and error view
[#1660] Custom access token attributes are now considered when finding matching tokens (fixes #1665). Introduce revoke_previous_client_credentials_token configuration option.

- Ruby
Published by nbulaj almost 2 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.9

[#1691] Make new Doorkeeper errors backward compatible with older extensions.

- Ruby
Published by nbulaj about 2 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.8

[#1680] Fix handle_auth_errors :raise NotImplementedError

- Ruby
Published by nbulaj over 2 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.7

[#1662] Specify uri_redirect validation class explicitly.
[#1652] Add custom attributes support to token generator.
[#1667] Pass client instead of grant.application to find_or_create_access_token.
[#1673] Honor custom_access_token_attributes in client credentials grant flow.
[#1676] Improve AuthorizationsController error response handling
[#1677] Fix URIHelper.valid_for_authorization? breaking for non url URIs.

- Ruby
Published by nbulaj over 2 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.6

[#1644] Update HTTP headers.
[#1646] Block public clients automatic authorization skip.
[#1648] Add custom token attributes to Refresh Token Request.
[#1649] Fixed custom_access_token_attributes related errors.

- Ruby
Published by nbulaj almost 3 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.5

[#1602] Allow custom data to be stored inside access grants/tokens.
[#1634] Code refactoring for custom token attributes.
[#1639] Add grant type validation to avoid Internal Server Error for DELETE /oauth/authorize endpoint.

- Ruby
Published by nbulaj about 3 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.4

[#1633] Apply ORM configuration in #to_prepare block to avoid autoloading errors.

- Ruby
Published by nbulaj about 3 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.3

[#1622] Drop support for Rubies 2.5 and 2.6
[#1605] Fix URI validation for Ruby 3.2+.
[#1625] Exclude endless access tokens from StaleRecordsCleaner.
[#1626] Remove deprecated active_record_options config option.
[#1631] Fix regression with redirect behavior after token lookup optimizations (redirect to app URI when found).
[#1630] Special case unique index creation for refresh_token on SQL Server.
[#1627] Lazy evaluate Doorkeeper config when loading files and executing initializers.

- Ruby
Published by nbulaj about 3 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.2

[#1604] Fix fetching of the application when custom application_class defined.

- Ruby
Published by nbulaj over 3 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.1

[#1593] Add support for Trilogy ActiveRecord adapter.
[#1597] Add optional support to use the url path for the native authorization code flow. Ports forward [#1143] from 4.4.3
[#1599] Remove unnecessarily re-fetch of application object when creating an access token.

- Ruby
Published by nbulaj over 3 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.0

[#1581] Consider token_type_hint when searching for access token in TokensController to avoid extra database calls.

- Ruby
Published by nbulaj over 3 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.6.0.rc1

[#1551] Change lazy loading for ORM to be Ruby standard autoload.
[#1552] Remove duplicate IDs on Auth form to improve accessibility.
[#1542] Improve performance of Doorkeeper::AccessToken#matching_token_for using database specific SQL time math.

[IMPORTANT]: API of the Doorkeeper::AccessToken#matching_token_for method has changed and now it returns
only active access tokens (previously they were just not revoked). Please remember that the idea of the
reuse_access_token option is to check for existing active token (see configuration option description).

- Ruby
Published by nbulaj about 4 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.5.4

[#1535] Revert changes introduced in #1528 to allow query params in redirect_uri as per the spec.

- Ruby
Published by nbulaj over 4 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.5.3

[#1528] Don't allow extra query params in redirect_uri.
[#1525] I18n source for forbidden token error is now doorkeeper.errors.messages.forbidden_token.missing_scope.
[#1531] Disable strict-loading for Doorkeeper models by default.
[#1532] Add support for Rails 7.

- Ruby
Published by nbulaj over 4 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.5.2

[#1502] Drop support for Ruby 2.4 because of EOL.
[#1504] Updated the url fragment in the comment for code documentation.
[#1512] Fix form behavior when response mode is form_post.
[#1511] Fix that authorization code is returned by fragment if response_mode is fragament.

- Ruby
Published by nbulaj over 4 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.5.1

[#1496] Revoke old_refresh_token if previous_refresh_token is present.
[#1495] Fix respond_to undefined in API-only mode
[#1488] Verify client authentication for Resource Owner Password Grant when
config.skip_client_authentication_for_password_grant is set and the client credentials
are sent in a HTTP Basic auth header.

- Ruby
Published by nbulaj almost 5 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.5.0

[#1482] Simplify TokenInfoController to be overridable (extract response rendering).
[#1478] Fix ownership association and Rake tasks when custom models configured.
[#1477] Respect ActiveRecord::Base.pluralize_table_names for Doorkeeper table names.

- Ruby
Published by nbulaj about 5 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.5.0.rc2

[#1473] Enable Applications and AuthorizedApplications controllers in API mode.

[IMPORTANT] you can still skip these controllers using skip_controllers in
use_doorkeeper inside routes.rb. Please do it in case you don't need them.
[#1472] Fix establish_connection configuration for custom defined models.
[#1471] Add support for Ruby 3.0.
[#1469] Check if redirect_uri exists.
[#1465] Memoize nil doorkeeper_token.
[#1459] Use built-in Ruby option to remove padding in PKCE code challenge value.
[#1457] Make owner_id a bigint for newly-generated owner migrations
[#1452] Empty previous_refresh_token only if present.
[#1440] Validate empty host in redirect_uri.
[#1438] Add form post response mode.
[#1458] Make config.skip_client_authentication_for_password_grant a long term configuration option.

- Ruby
Published by nbulaj about 5 years ago

https://github.com/doorkeeper-gem/doorkeeper - v5.5.0.rc1

[#1435] Make error response not redirectable when client is unauthorized
[#1426] Ensure ActiveRecord callbacks are executed on token revocation.
[#1407] Remove redundant and complex to support helpers froms tests (should_have_json, etc).
[#1416] Don't add introspection route if token introspection completely disabled.
[#1410] Properly memoize current_resource_owner value (consider nil and false values).
[#1415] Ignore PKCE params for non-PKCE grants.
[#1418] Add ability to register custom OAuth Grant Flows.
[#1420] Require client authentication for Resource Owner Password Grant as stated in OAuth RFC.

[IMPORTANT] you need to create a new OAuth client (Doorkeeper::Application) if yoo didn't
have it before and use client credentials in HTTP Basic auth if you previously used this grant
flow without client authentication. For migration purposes you could enable
skip_client_authentication_for_password_grant configuration option to true, but such behavior
(as well as configuration option) would be completely removed in a future version of Doorkeeper.
All the users of your provider application now need to include client credentials when they use
this grant flow.
[#1421] Add Resource Owner instance to authorization hook context for custom_access_token_expires_in
configuration option to allow resource owner based Access Tokens TTL.

- Ruby
Published by nbulaj over 5 years ago