Add Client Authentication Methods Registry

lib/doorkeeper/client_authentication.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require "doorkeeper/client_authentication/flow"
+require "doorkeeper/client_authentication/registry"
+
+module Doorkeeper
+  module ClientAuthentication
+    extend Registry
+
+    register(
+      :none,
+      mechanism: Doorkeeper::ClientAuthentication::Mechanisms::None,
+      authenticates_client: false
+    )
+
+    register(
+      :client_secret_post,
+      mechanism: Doorkeeper::ClientAuthentication::Mechanisms::ClientSecretPost,
+    )
+
+    register(
+      :client_secret_basic,
+      mechanism: Doorkeeper::ClientAuthentication::Mechanisms::ClientSecretBasic,
+    )
+  end
+end

lib/doorkeeper/client_authentication/credentials.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module ClientAuthentication
+    Credentials = Struct.new(:uid, :secret) do
+      # Public clients may have their secret blank, but "credentials" are
+      # still present
+      delegate :blank?, to: :uid
+    end
+  end
+end

lib/doorkeeper/client_authentication/mechanism.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module ClientAuthentication
+    class Mechanism
+      attr_reader :name, :mechanism
+
+      def initialize(name, **options)
+        @name = name
+        @mechanism = options[:mechanism]
+        @authenticates_client = options.key?(:authenticates_client) ? options[:authenticates_client] : true
+      end
+
+      def authenticates_client?
+        !!@authenticates_client
+      end
+    end
+  end
+end

lib/doorkeeper/client_authentication/mechanisms/client_secret_basic.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module ClientAuthentication
+    module Mechanisms
+      class ClientSecretBasic
+        def self.matches_request?(request)
+          request.authorization.present? && request.authorization.downcase.start_with?('basic')
+        end
+
+        def authenticate(request)
+          value = request.authorization.to_s.split(" ", 2).second
+          client_id, client_secret = Base64.decode64(value).split(':', 2)
+
+          return unless client_id.present? && client_secret.present?
+
+          Doorkeeper::ClientAuthentication::Credentials.new(client_id, client_secret)
+        end
+      end
+    end
+  end
+end

lib/doorkeeper/client_authentication/mechanisms/client_secret_post.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module ClientAuthentication
+    module Mechanisms
+      class ClientSecretPost
+        def self.matches_request?(request)
+          request.method.upcase === "POST"
+        end
+
+        def authenticate(request)
+          client_id = request.request_parameters[:client_id]
+          client_secret = request.request_parameters[:client_secret]
+
+          return unless client_id.present? && client_secret.present?
+
+          Doorkeeper::ClientAuthentication::Credentials.new(
+            client_id,
+            client_secret
+          )
+        end
+      end
+    end
+  end
+end

lib/doorkeeper/client_authentication/mechanisms/none.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module ClientAuthentication
+    module Mechanisms
+      class None
+        def self.matches_request?(request)
+          !request.authorization && request.request_parameters[:client_id] && !request.request_parameters[:client_secret]
+        end
+
+        def authenticate(request)
+          Doorkeeper::ClientAuthentication::Credentials.new(
+            request.request_parameters[:client_id], nil
+          )
+        end
+      end
+    end
+  end
+end

lib/doorkeeper/client_authentication/registry.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module GrantFlow
+    module Registry
+      mattr_accessor :mechanisms
+      self.mechanisms = {}
+
+      # Allows to register custom OAuth client authentication mechanism so that
+      # Doorkeeper could recognize and process it.
+      #
+      def register(name_or_mechanism, **options)
+        unless name_or_mechanism.is_a?(Doorkeeper::ClientAuthentication::Mechanism)
+          name_or_mechanism = Doorkeeper::ClientAuthentication::Mechanism.new(name_or_mechanism, **options)
+        end
+
+        name_key = name_or_mechanism.name.to_sym
+
+        if mechanisms.key?(name_key)
+          ::Kernel.warn <<~WARNING
+            [DOORKEEPER] '#{name_key}' client authentication strategy is already registered and will be overridden
+            in #{caller(1..1).first}
+          WARNING
+        end
+
+        mechanisms[name_key] = name_or_mechanism
+      end
+
+      # [NOTE]: make it to use #fetch after removing fallbacks
+      def get(name)
+        mechanisms[name.to_sym]
+      end
+    end
+  end
+end

lib/doorkeeper/config.rb

@@ -253,6 +253,7 @@ def configure_secrets_for(type, using:, fallback:)
     option :orm,                            default: :active_record
     option :native_redirect_uri,            default: "urn:ietf:wg:oauth:2.0:oob", deprecated: true
     option :grant_flows,                    default: %w[authorization_code client_credentials]
+    option :client_authentication,          default: %w[client_secret_basic client_secret_post none]
     option :pkce_code_challenge_methods,    default: %w[plain S256]
     option :handle_auth_errors,             default: :render
     option :token_lookup_batch_size,        default: 10_000
@@ -579,10 +580,17 @@ def pkce_code_challenge_methods_supported
       pkce_code_challenge_methods
     end
 
+    # Deprecated?
     def client_credentials_methods
       @client_credentials_methods ||= %i[from_basic from_params]
     end
 
+    def client_authentication_mechanisms
+      @client_authentication_mechanisms ||= client_authentication.map do |name|
+        Doorkeeper::ClientAuthentication.get(name)  
+      end.compact
+    end
+
     def access_token_methods
       @access_token_methods ||= %i[
         from_bearer_authorization

lib/doorkeeper/oauth/client.rb

@@ -17,6 +17,8 @@ def self.find(uid, method = Doorkeeper.config.application_model.method(:by_uid))
         new(application)
       end
 
+      # TODO: Figure out a way to have this just get the client but not assert
+      # authentication if not secret
       def self.authenticate(credentials, method = Doorkeeper.config.application_model.method(:by_uid_and_secret))
         return if credentials.blank?
         return unless (application = method.call(credentials.uid, credentials.secret))

lib/doorkeeper/request.rb

@@ -3,6 +3,16 @@
 module Doorkeeper
   module Request
     class << self
+      def client_authentication_mechanism(request)
+        client_authentication_mechanisms = client_authentication_mechanisms.detect do |mechanism|
+          mechanism.matches_request?(request)
+        end
+
+        if client_authentication_mechanisms
+          client_authentication_mechanisms.mechanism
+        end
+      end
+
       def authorization_strategy(response_type)
         grant_flow = authorization_flows.detect do |flow|
           flow.matches_response_type?(response_type)
@@ -40,6 +50,10 @@ def token_strategy(grant_type)
 
       private
 
+      def client_authentication_mechanisms
+        Doorkeeper.configuration.client_authentication_mechanisms
+      end
+
       def authorization_flows
         Doorkeeper.configuration.authorization_response_flows
       end

lib/doorkeeper/server.rb

@@ -8,6 +8,11 @@ def initialize(context)
       @context = context
     end
 
+    def client_authentication_request(strategy)
+      klass = Request.client_authentication_mechanism(context.request)
+      klass.new(self)
+    end
+
     def authorization_request(strategy)
       klass = Request.authorization_strategy(strategy)
       klass.new(self)
@@ -37,8 +42,7 @@ def resource_owner
     end
 
     def credentials
-      methods = Doorkeeper.config.client_credentials_methods
-      @credentials ||= OAuth::Client::Credentials.from_request(context.request, *methods)
+      @credentials ||= client_authentication_request.authenticate(context.request)
     end
   end
 end