Releases: doorkeeper-gem/doorkeeper
v5.9.1
-
[#1781] Honor
handle_auth_errors :raiseinAuthorizationsController#authorize_response -
[#1795] Fix: detailed error 'insufficient_scope' in protected resources 403s
-
[#1797] Fix
doorkeeper:db:cleanuprake task failure on PostgreSQL -
[#1800] Set
@grant_typeinClientCredentialsRequestandRefreshTokenRequestconstructors sorequest.grant_typereturns
the correct value in hooks likebefore_successful_strategy_response. -
[#1802] Fix
filter_parametersnot applied whenDoorkeeper.configureis called inside to_prepare. -
[#1804] Use
ActiveSupport.on_load(:active_record)in ORM hooks to prevent loading ActiveRecord models too early -
[#1806] Fix token revocation bypass for public clients (RFC 7009)
-
[#1815] Expose
current_resource_owneras a view helper inDoorkeeper::ApplicationController. -
[#1818] Fix token introspection returning
exp: 0for non-expiring tokens. -
[#1784] Remove hardcoded colons from view templates, move punctuation to i18n translation strings.
[IMPORTANT]: if you have customized Doorkeeper views (
authorizations/new,authorizations/show,
applications/show) or overridden the defaulten.ymltranslations, you may need to update them.
Colons are no longer hardcoded in the views — they are now part of the translation strings.
Update the doorkeeper-i18n gem to get the
updated translations for all locales. -
[#1820] Remove dead wildcard presence check in
Scopes#dynamic_scope_match?(internal cleanup, no behavior change). -
[#1822] Update Rubocop config, auto-corrections.
-
[#1823] Update Rubocop config, part 2.
-
[#1825] Update Rubocop config, part 3.
-
[#1821] Fix noisy
Could not find command "no_previous_refresh_token_column?"Thor output during the
PreviousRefreshTokenGeneratorspec by stubbing the underlying DB column check instead of the generator's
private method (test-only change).
v.5.9.0
- [#1791] Add support for Rails read replicas with automatic role switching via
enable_multiple_database_rolesconfiguration option - [#1792] Consider expires_in when clear expired tokens with StaleRecordsCleaner.
- [#1790] Fix race condition in refresh token revocation check by moving InvalidGrantReuse check inside the lock block
- [#1788] Fix regex for basic auth to be case-insensitive
- [#1775] Fix Applications Secret Not Null Constraint generator
- [#1779] Only lock previous access token model when creating a new token from its refresh token if revoke_previous_refresh_token_on_use is false
- [#1778] Ensure that token revocation is idempotent by checking that that token has not already been revoked before revoking.
v5.8.2
- [#1755] Fix the error message for force_pkce
- [#1761] Memoize authentication failure
- [#1762] Allow missing client to trigger invalid client error when force_pkce is enabled
- [#1767] Make sure error handling happens on a controller level opposed to action level to account for the controller being extended
v5.8.1
v5.8.0
- [#1739] Add support for dynamic scopes
- [#1715] Fix token introspection invalid request reason
- [#1714] Fix
Doorkeeper::AccessToken.find_or_create_forwith empty scopes which raises NoMethodError - [#1712] Add
Pragma: no-cacheto token response - [#1726] Refactor token introspection class.
- [#1727] Allow to set null secret value for Applications if they are public.
- [#1735] Add
pkce_code_challenge_methodsconfig option.
v5.7.1
v5.7.0
- [#1696] Add missing #issued_token method to OAuth::TokenResponse
- [#1697] Allow a TokenResponse body to be customized (memoize response body).
- [#1702] Fix bugs for error response in the form_post and error view
- [#1660] Custom access token attributes are now considered when finding matching tokens (fixes #1665). Introduce revoke_previous_client_credentials_token configuration option.
v5.6.9
v5.6.8
v5.6.7
- [#1662] Specify uri_redirect validation class explicitly.
- [#1652] Add custom attributes support to token generator.
- [#1667] Pass
clientinstead ofgrant.applicationtofind_or_create_access_token. - [#1673] Honor
custom_access_token_attributesin client credentials grant flow. - [#1676] Improve AuthorizationsController error response handling
- [#1677] Fix URIHelper.valid_for_authorization? breaking for non url URIs.