feature: Respect scope grants in UserInfo response

- Support a :scope parameter when defining claims
- Remove the Models namespace since these aren't Rails models

app/controllers/doorkeeper/openid_connect/userinfo_controller.rb

@@ -6,7 +6,7 @@ class UserinfoController < ::Doorkeeper::ApplicationController
 
       def show
         resource_owner = doorkeeper_token.instance_eval(&Doorkeeper::OpenidConnect.configuration.resource_owner_from_access_token)
-        user_info = Doorkeeper::OpenidConnect::Models::UserInfo.new(resource_owner)
+        user_info = Doorkeeper::OpenidConnect::UserInfo.new(resource_owner, doorkeeper_token.scopes)
         render json: user_info, status: :ok
       end
     end

lib/doorkeeper/openid_connect.rb

@@ -3,17 +3,16 @@
 require 'json/jwt'
 
 require 'doorkeeper/openid_connect/claims_builder'
+require 'doorkeeper/openid_connect/claims/claim'
+require 'doorkeeper/openid_connect/claims/normal_claim'
 require 'doorkeeper/openid_connect/config'
 require 'doorkeeper/openid_connect/engine'
+require 'doorkeeper/openid_connect/id_token'
+require 'doorkeeper/openid_connect/user_info'
 require 'doorkeeper/openid_connect/version'
 
 require 'doorkeeper/openid_connect/helpers/controller'
 
-require 'doorkeeper/openid_connect/models/id_token'
-require 'doorkeeper/openid_connect/models/user_info'
-require 'doorkeeper/openid_connect/models/claims/claim'
-require 'doorkeeper/openid_connect/models/claims/normal_claim'
-
 require 'doorkeeper/openid_connect/oauth/authorization/code'
 require 'doorkeeper/openid_connect/oauth/authorization_code_request'
 require 'doorkeeper/openid_connect/oauth/password_access_token_request'

lib/doorkeeper/openid_connect/claims/aggregated_claim.rb

@@ -0,0 +1,9 @@
+module Doorkeeper
+  module OpenidConnect
+    module Claims
+      class AggregatedClaim < Claim
+        attr_accessor :jwt
+      end
+    end
+  end
+end

lib/doorkeeper/openid_connect/claims/claim.rb

@@ -0,0 +1,34 @@
+module Doorkeeper
+  module OpenidConnect
+    module Claims
+      class Claim
+        attr_accessor :name, :scope
+
+        # http://openid.net/specs/openid-connect-core-1_0.html#StandardClaims
+        # http://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims
+        STANDARD_CLAIMS = {
+          profile: %w[
+            name family_name given_name middle_name nickname preferred_username
+            profile picture website gender birthdate zoneinfo locale updated_at
+          ],
+          email: %w[ email email_verified ],
+          address: %w[ address ],
+          phone: %w[ phone_number phone_number_verified ],
+        }
+
+        def initialize(options = {})
+          @name = options[:name]
+          @scope = options[:scope]
+
+          # use default scope for Standard Claims
+          @scope ||= STANDARD_CLAIMS.find do |_scope, claims|
+            claims.include? @name
+          end.try(:first)
+
+          # use profile scope as default fallback
+          @scope ||= :profile
+        end
+      end
+    end
+  end
+end

lib/doorkeeper/openid_connect/claims/distributed_claim.rb

@@ -0,0 +1,9 @@
+module Doorkeeper
+  module OpenidConnect
+    module Claims
+      class DistributedClaim < Claim
+        attr_accessor :endpoint, :access_token
+      end
+    end
+  end
+end

lib/doorkeeper/openid_connect/claims/normal_claim.rb

@@ -0,0 +1,18 @@
+module Doorkeeper
+  module OpenidConnect
+    module Claims
+      class NormalClaim < Claim
+        attr_reader :generator
+
+        def initialize(options = {})
+          super(options)
+          @generator = options[:generator]
+        end
+
+        def type
+          :normal
+        end
+      end
+    end
+  end
+end

lib/doorkeeper/openid_connect/claims_builder.rb

@@ -12,13 +12,15 @@ def build
         @claims
       end
 
-      def normal_claim(name, &block)
+      def normal_claim(name, scope: nil, &block)
         @claims[name] =
-          Doorkeeper::OpenidConnect::Models::Claims::NormalClaim.new(
+          Claims::NormalClaim.new(
             name: name,
-            value: block
+            scope: scope,
+            generator: block
           )
       end
+      alias_method :claim, :normal_claim
     end
   end
 end

lib/doorkeeper/openid_connect/id_token.rb

@@ -0,0 +1,62 @@
+module Doorkeeper
+  module OpenidConnect
+    class IdToken
+      include ActiveModel::Validations
+
+      attr_reader :nonce
+
+      def initialize(access_token, nonce = nil)
+        @access_token = access_token
+        @nonce = nonce
+        @resource_owner = access_token.instance_eval(&Doorkeeper::OpenidConnect.configuration.resource_owner_from_access_token)
+        @issued_at = Time.now
+      end
+
+      def claims
+        {
+          iss: issuer,
+          sub: subject,
+          aud: audience,
+          exp: expiration,
+          iat: issued_at,
+          nonce: nonce,
+          auth_time: auth_time,
+        }
+      end
+
+      def as_json(*_)
+        claims.reject { |_, value| value.blank? }
+      end
+
+      def as_jws_token
+        JSON::JWT.new(as_json).sign(Doorkeeper::OpenidConnect.signing_key).to_s
+      end
+
+      private
+
+      def issuer
+        Doorkeeper::OpenidConnect.configuration.issuer
+      end
+
+      def subject
+        @resource_owner.instance_eval(&Doorkeeper::OpenidConnect.configuration.subject).to_s
+      end
+
+      def audience
+        @access_token.application.uid
+      end
+
+      def expiration
+        (@issued_at.utc + Doorkeeper::OpenidConnect.configuration.expiration).to_i
+      end
+
+      def issued_at
+        @issued_at.utc.to_i
+      end
+
+      def auth_time
+        @resource_owner.instance_eval(&Doorkeeper::OpenidConnect.configuration.auth_time_from_resource_owner).try(:to_i)
+      end
+    end
+  end
+end

lib/doorkeeper/openid_connect/oauth/authorization_code_request.rb

@@ -13,7 +13,7 @@ def after_successful_response
               openid_request.nonce
             end
 
-          id_token = Doorkeeper::OpenidConnect::Models::IdToken.new(access_token, nonce)
+          id_token = Doorkeeper::OpenidConnect::IdToken.new(access_token, nonce)
           @response.id_token = id_token
         end
       end

lib/doorkeeper/openid_connect/oauth/password_access_token_request.rb

@@ -13,7 +13,7 @@ def initialize(server, client, resource_owner, parameters = {})
 
         def after_successful_response
           super
-          id_token = Doorkeeper::OpenidConnect::Models::IdToken.new(access_token, nonce)
+          id_token = Doorkeeper::OpenidConnect::IdToken.new(access_token, nonce)
           @response.id_token = id_token
         end
       end