<commit_before># Changelog

See https://github.com/doorkeeper-gem/doorkeeper/wiki/Migration-from-old-versions for
upgrade guides.

User-visible changes worth mentioning.

## master

- [#PR ID] Your PR description.
- [#1404] Make `Doorkeeper::Application#read_attribute_for_serialization` public

## 5.4.0.rc2

- [#1371] Add `#as_json` method and attributes serialization restriction for Application model.
  Fixes information disclosure vulnerability (CVE-2020-10187).
  
  **[IMPORTANT]** you need to re-implement `#as_json` method for Doorkeeper Application model
  if you previously used `#to_json` serialization with custom options or attributes or rely on
  JSON response from /oauth/applications.json or /oauth/authorized_applications.json. This change
  is a breaking change which restricts serialized attributes to a very small set of columns.

- [#1395] Fix `NameError: uninitialized constant Doorkeeper::AccessToken` for Rake tasks.
- [#1397] Add `as: :doorkeeper_application` on Doorkeeper application form in order to support
  custom configured application model.
- [#1400] Correctly yield the application instance to `allow_grant_flow_for_client?` config
  option (fixes #1398).
- [#1402] Handle trying authorization with client credentials.

## 5.4.0.rc1
- [#1366] Sets expiry of token generated using `refresh_token` to that of original token. (Fixes #1364) 
- [#1354] Add `authorize_resource_owner_for_client` option to authorize the calling user to access an application.
- [#1355] Allow to enable polymorphic Resource Owner association for Access Token & Grant
  models (`use_polymorphic_resource_owner` configuration option).
  
  **[IMPORTANT]** Review your custom patches or extensions for Doorkeeper internals if you
  have such - since now Doorkeeper passes Resource Owner instance to every objects and not
  just it's ID. See PR description for details.
  
- [#1356] Remove duplicated scopes from Access Tokens and Grants on attribute assignment.
- [#1357] Fix `Doorkeeper::OAuth::PreAuthorization#as_json` method causing 
  `Stack level too deep` error with AMS (fix #1312).
- [#1358] Deprecate `active_record_options` configuration option.
- [#1359] Refactor Doorkeeper configuration options DSL to make it easy to reuse it
  in external extensions.
- [#1360] Increase `matching_token_for` lookup size to 10 000 and make it configurable.
- [#1371] Fix controllers to use valid classes in case Doorkeeper has custom models configured.
- [#1370] Fix revocation response for invalid token and unauthorized requests to conform with RFC 7009 (fixes #1362).

  **[IMPORTANT]** now fully according to RFC 7009 nobody can do a revocation request without `client_id`
  (for public clients) and `client_secret` (for private clients). Please update your apps to include that
  info in the revocation request payload.
  
- [#1373] Make Doorkeeper routes mapper reusable in extensions.
- [#1374] Revoke and issue client credentials token in a transaction with a row lock.
- [#1384] Add context object with auth/pre_auth and issued_token for authorization hooks.
- [#1387] Add `AccessToken#create_for` and use in `RefreshTokenRequest`.
- [#1392] Fix `enable_polymorphic_resource_owner` migration template to have proper index name.
- [#1393] Improve Applications #show page with more informative data on client secret and scopes.
- [#1394] Use Ruby `autoload` feature to load Doorkeeper files.

## 5.3.2

- [#1371] Backport: add `#as_json` method and attributes serialization restriction for Application model.
  Fixes information disclosure vulnerability (CVE-2020-10187).

## 5.3.1

- [#1360] Backport: Increase `matching_token_for` batch lookup size to 10 000 and make it configurable.

## 5.3.0

- [#1339] Validate Resource Owner in `PasswordAccessTokenRequest` against `nil` and `false` values.
- [#1341] Fix `refresh_token_revoked_on_use` with `hash_token_secrets` enabled.
- [#1343] Fix ruby 2.7 kwargs warning in InvalidTokenResponse.
- [#1345] Allow to set custom classes for Doorkeeper models, extract reusable AR mixins.
- [#1346] Refactor `Doorkeeper::Application#to_json` into convenient `#as_json` (fix #1344).
- [#1349] Fix `Doorkeeper::Application` AR associations using an incorrect foreign key name when using a custom class.
- [#1318] Make existing token revocation for client credentials optional and disable it by default.

  **[IMPORTANT]** This is a change compared to the behaviour of version 5.2.
  If you were relying on access tokens being revoked once the same client
  requested a new access token, reenable it with `revoke_previous_client_credentials_token` in Doorkeeper
  initialization file.

## 5.2.5

- [#1371] Backport: add `#as_json` method and attributes serialization restriction for Application model.
  Fixes information disclosure vulnerability (CVE-2020-10187).
  
## 5.2.4
  
- [#1360] Backport: Increase `matching_token_for` batch lookup size to 10 000 and make it configurable.

## 5.2.3

- [#1334] Remove `application_secret` flash helper and `redirect_to` keyword.
- [#1331] Move redirect_uri_validator to where it is used (`Application` model).
- [#1326] Move response_type check in pre_authorization to a method to be easily to override.
- [#1329] Fix `find_in_batches` order warning.

## 5.2.2

- [#1320] Call configured `authenticate_resource_owner` method once per request.
- [#1315] Allow generation of new secret with `Doorkeeper::Application#renew_secret`.
- [#1309] Allow `Doorkeeper::Application#to_json` to work without arguments.

## 5.2.1

- [#1308] Fix flash types for `api_only` mode (no flashes for `ActionController::API`).
- [#1306] Fix interpolation of `missing_param` I18n.

## 5.2.0

- [#1305] Make `Doorkeeper::ApplicationController` to inherit from `ActionController::API` in cases
  when `api_mode` enabled (fixes #1302).

## 5.2.0.rc3

- [#1298] Slice strong params so doesn't error with Rails forms.
- [#1300] Limiting access to attributes of pre_authorization.
- [#1296] Adding client_id to strong parameters.

  **[IMPORTANT]** `Doorkeeper::Server#client_via_uid` was removed.

- [#1293] Move ar specific redirect uri validator to ar orm directory.
- [#1288] Allow to pass attributes to the `Doorkeeper::OAuth::PreAuthorization#as_json` method to customize
  the PreAuthorization response.
- [#1286] Add ability to customize grant flows per application (OAuth client) (#1245 , #1207)
- [#1283] Allow to customize base class for `Doorkeeper::ApplicationMetalController` (new configuration
  option called `base_metal_controller` (fix #1273).
- [#1277] Prevent requested scope be empty on authorization request, handle and add description for invalid request.

## 5.2.0.rc2

- [#1270] Find matching tokens in batches for `reuse_access_token` option (fix #1193).
- [#1271] Reintroduce existing token revocation for client credentials.

  **[IMPORTANT]** If you rely on being able to fetch multiple access tokens from the same
  client using client credentials flow, you should skip to version 5.3, where this behaviour
  is deactivated by default.

- [#1269] Update initializer template documentation.
- [#1266] Use strong parameters within pre-authorization.
- [#1264] Add :before_successful_authorization and :after_successful_authorization hooks in TokensController
- [#1263] Response properly when introspection fails and fix configurations's user guide.

## 5.2.0.rc1

- [#1260], [#1262] Improve Token Introspection configuration option (access to tokens, client).
- [#1257] Add constraint configuration when using client authentication on introspection endpoint.
- [#1252] Returning `unauthorized` when the revocation of the token should not be performed due to wrong permissions.
- [#1249] Specify case sensitive uniqueness to remove Rails 6 deprecation message
- [#1248] Display the Application Secret in HTML after creating a new application even when `hash_application_secrets` is used.
- [#1248] Return the unhashed Application Secret in the JSON response after creating new application even when `hash_application_secrets` is used.
- [#1238] Better support for native app with support for custom scheme and localhost redirection.

## 5.1.1

- [#1371] Backport: add `#as_json` method and attributes serialization restriction for Application model.
  Fixes information disclosure vulnerability (CVE-2020-10187).

## 5.1.0

- [#1243] Add nil check operator in token checking at token introspection.
- [#1241] Explaining foreign key options for resource owner in a single place
- [#1237] Allow to set blank redirect URI if Doorkeeper configured to use redirect URI-less grant flows.
- [#1234] Fix `StaleRecordsCleaner` to properly work with big amount of records.
- [#1228] Allow to explicitly set non-expiring tokens in `custom_access_token_expires_in` configuration
  option using `Float::INIFINITY` return value.
- [#1224] Do not try to store token if not found by fallback hashing strategy.
- [#1223] Update Hound/Rubocop rules, correct Doorkeeper codebase to follow style-guides.
- [#1220] Drop Rails 4.2 & Ruby < 2.4 support.

## 5.1.0.rc2

- [#1208] Unify hashing implementation into secret storing strategies

  **[IMPORTANT]** If you have been using the master branch of doorkeeper with bcrypt in your Gemfile.lock,
  your application secrets have been hashed using BCrypt. To restore this behavior, use the initializer option
  `hash_application_secrets using: 'Doorkeeper::SecretStoring::BCrypt`.<commit_msg>[ci skip] Update CHANGELOG.md<commit_after># Changelog

See https://github.com/doorkeeper-gem/doorkeeper/wiki/Migration-from-old-versions for
upgrade guides.

User-visible changes worth mentioning.

## master

- [#PR ID] Your PR description.
- [#1404] Make `Doorkeeper::Application#read_attribute_for_serialization` public.

## 5.4.0.rc2

- [#1371] Add `#as_json` method and attributes serialization restriction for Application model.
  Fixes information disclosure vulnerability (CVE-2020-10187).
  
  **[IMPORTANT]** you need to re-implement `#as_json` method for Doorkeeper Application model
  if you previously used `#to_json` serialization with custom options or attributes or rely on
  JSON response from /oauth/applications.json or /oauth/authorized_applications.json. This change
  is a breaking change which restricts serialized attributes to a very small set of columns.

- [#1395] Fix `NameError: uninitialized constant Doorkeeper::AccessToken` for Rake tasks.
- [#1397] Add `as: :doorkeeper_application` on Doorkeeper application form in order to support
  custom configured application model.
- [#1400] Correctly yield the application instance to `allow_grant_flow_for_client?` config
  option (fixes #1398).
- [#1402] Handle trying authorization with client credentials.

## 5.4.0.rc1
- [#1366] Sets expiry of token generated using `refresh_token` to that of original token. (Fixes #1364) 
- [#1354] Add `authorize_resource_owner_for_client` option to authorize the calling user to access an application.
- [#1355] Allow to enable polymorphic Resource Owner association for Access Token & Grant
  models (`use_polymorphic_resource_owner` configuration option).
  
  **[IMPORTANT]** Review your custom patches or extensions for Doorkeeper internals if you
  have such - since now Doorkeeper passes Resource Owner instance to every objects and not
  just it's ID. See PR description for details.
  
- [#1356] Remove duplicated scopes from Access Tokens and Grants on attribute assignment.
- [#1357] Fix `Doorkeeper::OAuth::PreAuthorization#as_json` method causing 
  `Stack level too deep` error with AMS (fix #1312).
- [#1358] Deprecate `active_record_options` configuration option.
- [#1359] Refactor Doorkeeper configuration options DSL to make it easy to reuse it
  in external extensions.
- [#1360] Increase `matching_token_for` lookup size to 10 000 and make it configurable.
- [#1371] Fix controllers to use valid classes in case Doorkeeper has custom models configured.
- [#1370] Fix revocation response for invalid token and unauthorized requests to conform with RFC 7009 (fixes #1362).

  **[IMPORTANT]** now fully according to RFC 7009 nobody can do a revocation request without `client_id`
  (for public clients) and `client_secret` (for private clients). Please update your apps to include that
  info in the revocation request payload.
  
- [#1373] Make Doorkeeper routes mapper reusable in extensions.
- [#1374] Revoke and issue client credentials token in a transaction with a row lock.
- [#1384] Add context object with auth/pre_auth and issued_token for authorization hooks.
- [#1387] Add `AccessToken#create_for` and use in `RefreshTokenRequest`.
- [#1392] Fix `enable_polymorphic_resource_owner` migration template to have proper index name.
- [#1393] Improve Applications #show page with more informative data on client secret and scopes.
- [#1394] Use Ruby `autoload` feature to load Doorkeeper files.

## 5.3.3

- [#1404] Backport: Make `Doorkeeper::Application#read_attribute_for_serialization` public.

## 5.3.2

- [#1371] Backport: add `#as_json` method and attributes serialization restriction for Application model.
  Fixes information disclosure vulnerability (CVE-2020-10187).

## 5.3.1

- [#1360] Backport: Increase `matching_token_for` batch lookup size to 10 000 and make it configurable.

## 5.3.0

- [#1339] Validate Resource Owner in `PasswordAccessTokenRequest` against `nil` and `false` values.
- [#1341] Fix `refresh_token_revoked_on_use` with `hash_token_secrets` enabled.
- [#1343] Fix ruby 2.7 kwargs warning in InvalidTokenResponse.
- [#1345] Allow to set custom classes for Doorkeeper models, extract reusable AR mixins.
- [#1346] Refactor `Doorkeeper::Application#to_json` into convenient `#as_json` (fix #1344).
- [#1349] Fix `Doorkeeper::Application` AR associations using an incorrect foreign key name when using a custom class.
- [#1318] Make existing token revocation for client credentials optional and disable it by default.

  **[IMPORTANT]** This is a change compared to the behaviour of version 5.2.
  If you were relying on access tokens being revoked once the same client
  requested a new access token, reenable it with `revoke_previous_client_credentials_token` in Doorkeeper
  initialization file.

## 5.2.6

- [#1404] Backport: Make `Doorkeeper::Application#read_attribute_for_serialization` public.

## 5.2.5

- [#1371] Backport: add `#as_json` method and attributes serialization restriction for Application model.
  Fixes information disclosure vulnerability (CVE-2020-10187).
  
## 5.2.4
  
- [#1360] Backport: Increase `matching_token_for` batch lookup size to 10 000 and make it configurable.

## 5.2.3

- [#1334] Remove `application_secret` flash helper and `redirect_to` keyword.
- [#1331] Move redirect_uri_validator to where it is used (`Application` model).
- [#1326] Move response_type check in pre_authorization to a method to be easily to override.
- [#1329] Fix `find_in_batches` order warning.

## 5.2.2

- [#1320] Call configured `authenticate_resource_owner` method once per request.
- [#1315] Allow generation of new secret with `Doorkeeper::Application#renew_secret`.
- [#1309] Allow `Doorkeeper::Application#to_json` to work without arguments.

## 5.2.1

- [#1308] Fix flash types for `api_only` mode (no flashes for `ActionController::API`).
- [#1306] Fix interpolation of `missing_param` I18n.

## 5.2.0

- [#1305] Make `Doorkeeper::ApplicationController` to inherit from `ActionController::API` in cases
  when `api_mode` enabled (fixes #1302).

## 5.2.0.rc3

- [#1298] Slice strong params so doesn't error with Rails forms.
- [#1300] Limiting access to attributes of pre_authorization.
- [#1296] Adding client_id to strong parameters.

  **[IMPORTANT]** `Doorkeeper::Server#client_via_uid` was removed.

- [#1293] Move ar specific redirect uri validator to ar orm directory.
- [#1288] Allow to pass attributes to the `Doorkeeper::OAuth::PreAuthorization#as_json` method to customize
  the PreAuthorization response.
- [#1286] Add ability to customize grant flows per application (OAuth client) (#1245 , #1207)
- [#1283] Allow to customize base class for `Doorkeeper::ApplicationMetalController` (new configuration
  option called `base_metal_controller` (fix #1273).
- [#1277] Prevent requested scope be empty on authorization request, handle and add description for invalid request.

## 5.2.0.rc2

- [#1270] Find matching tokens in batches for `reuse_access_token` option (fix #1193).
- [#1271] Reintroduce existing token revocation for client credentials.

  **[IMPORTANT]** If you rely on being able to fetch multiple access tokens from the same
  client using client credentials flow, you should skip to version 5.3, where this behaviour
  is deactivated by default.

- [#1269] Update initializer template documentation.
- [#1266] Use strong parameters within pre-authorization.
- [#1264] Add :before_successful_authorization and :after_successful_authorization hooks in TokensController
- [#1263] Response properly when introspection fails and fix configurations's user guide.

## 5.2.0.rc1

- [#1260], [#1262] Improve Token Introspection configuration option (access to tokens, client).
- [#1257] Add constraint configuration when using client authentication on introspection endpoint.
- [#1252] Returning `unauthorized` when the revocation of the token should not be performed due to wrong permissions.
- [#1249] Specify case sensitive uniqueness to remove Rails 6 deprecation message
- [#1248] Display the Application Secret in HTML after creating a new application even when `hash_application_secrets` is used.
- [#1248] Return the unhashed Application Secret in the JSON response after creating new application even when `hash_application_secrets` is used.
- [#1238] Better support for native app with support for custom scheme and localhost redirection.

## 5.1.2

- [#1404] Backport: Make `Doorkeeper::Application#read_attribute_for_serialization` public.

## 5.1.1

- [#1371] Backport: add `#as_json` method and attributes serialization restriction for Application model.
  Fixes information disclosure vulnerability (CVE-2020-10187).

## 5.1.0

- [#1243] Add nil check operator in token checking at token introspection.
- [#1241] Explaining foreign key options for resource owner in a single place
- [#1237] Allow to set blank redirect URI if Doorkeeper configured to use redirect URI-less grant flows.
- [#1234] Fix `StaleRecordsCleaner` to properly work with big amount of records.
- [#1228] Allow to explicitly set non-expiring tokens in `custom_access_token_expires_in` configuration
  option using `Float::INIFINITY` return value.
- [#1224] Do not try to store token if not found by fallback hashing strategy.
- [#1223] Update Hound/Rubocop rules, correct Doorkeeper codebase to follow style-guides.
- [#1220] Drop Rails 4.2 & Ruby < 2.4 support.

## 5.1.0.rc2

- [#1208] Unify hashing implementation into secret storing strategies

  **[IMPORTANT]** If you have been using the master branch of doorkeeper with bcrypt in your Gemfile.lock,
  your application secrets have been hashed using BCrypt. To restore this behavior, use the initializer option
  `hash_application_secrets using: 'Doorkeeper::SecretStoring::BCrypt`.
{'fraction_non_alphanumeric': 0.0870405179615706, 'fraction_numerical': 0.05049081035923141, 'mean_word_length': 4.907772979642196, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1486847', 'n_tokens_mistral': 6107, 'n_tokens_neox': 5301, 'n_words': 2268}