feat(oauth): add rotate_secret action for oauth applications#933
Merged
skyfallwastaken merged 8 commits intohackclub:mainfrom 2 days agoFeb 15, 2026
Merged
feat(oauth): add rotate_secret action for oauth applications#933skyfallwastaken merged 8 commits intohackclub:mainfrom
skyfallwastaken merged 8 commits intohackclub:mainfrom
Conversation
System-End
force-pushed
the
oauth-creds-rotate
branch
from
95decca to
8e6fe24
Compare
Add POST routes and controller actions for both owner-facing and admin OAuth application secret rotation using Doorkeeper's renew_secret..
Add Rotate Secret button with confirmation dialog to both owner and admin show pages. Display rotated secret via flash with copy button..
System-End
force-pushed
the
oauth-creds-rotate
branch
from
8e6fe24 to
f18b05e
Compare
![sentry[bot]](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADwAAAA8CAIAAAC1nk4lAAAJRUlEQVR4nOxaeXBT19W/0pOsxZIla/EmL/KGbMsLeDcOZscJiz8cQgJ8QAeSlDZNKO0kpB0y05mUkpB0IDNJptMQ0lKmIRRqoC0QiA0YY+N4AWMMllfZkrzJtmxZSLK1dqT7fJ9ihBHxw0xnfP4699yre37v3HPPcm1aUdIX4H+NqM8awI+hOdCzRXOgZ4vmQM8W0Z7GphiNGhHLB06g7hix252k708+6LVb5Zt+ns7lMwEAYyPjJz6vv3DiPrkqMJl4HYnbrd0qf/23CxlM3BYMFi2zIFKvM7c3DZGohUyfFgSxt+7Oeli+bU82X8QiURGZoF/7TR7Lnw75y6cVFRc7IO/P9Xt1by6JikgDnZIdml8YA/mBHsMXf6j6/HcVI4MmKClYE5eUEUyWLnJAU6iUnR62/PJAldViNxutRz6sQsKde/MoFFK0kQR61QZZTKII8rXlqpprKshXfqu8dUMN+fhk8fLieaSoIwE0i0Pf8lYm5O02x18+rvacPXqw2m5zQH7r7iwmm4QgSwLo/38zgy/Eg8PFk/d7lHrPWU3n6MWTeJwOFLM3vZExc40zBS2VCVZvkUNerzOf+Kz+4TVff1av15khX7QtOTIucIZKZwp6595cDMM3Of5J7YMxy8NrjGOWY4dqII/RqDv35sxQ6YxAZy2JTMuVoGFMopDJ8u6yV862tjZqIb8gPyJ9UfhM9M4INF/EMhkI067eLD90ulgqEzy80ukERz6oAviFBK++m0ej/3jVM6o9Ou8Pl55pDRSxpDIhlATwmUvXxWuUo5rO0SmLhwdMYdE86TzXJwUEMs1Gq+L2wDMADQCYMNuqS7va7mpTcyQwh9PoWH5hrOmBBfkDovamwcKNidDGsrSgK+fazEbrMwANqU81dvVfbVKZMDQywJUgKSD9uQirxd586we2ND2wOhzOtDzXNaD7YXwhq7q0a5ZAyzNDfvXBku52nU5rQsIJs638fEdAICM+JQhK0vIkRsNEa+Og52/bGgcL1sRyeUx3uBTWV6g9N3laoCkU8O7hFQnzg1duSBQGs+/V9Vktk/fLCeqvq+l+WFJGCBSkL4xQd46oOwj/djicQwMPFr0QC4cRMfzSM61PHXThywmFLydC9HFyccHq2LamwaF+I1rQWN1LoVKSs0LdnwgyCyJry1Wjw2a0QNOpT8oICQl3OZI4lKPtMShbdE8RtH+A375PV6HGxC1hLCuKH9YaO5uHkbCppi9QzI6Ti933kpqSFVZ6psVuI5pFZctw4cYkWPQlLAi+fKqZOC7SQW/fk5Wag2cTm9VOdedCKpWSs0w6brIqGohwcbtSk5oTJg7lwAAXwGfUlavR7OiwOVDMik92fRWTRccwSsPNHt9hPEGEl0TzVm9OgvxAj2HX8yfrKwgcO97J3fBaGhrabY6P3y4bGxmHw+dfSUrLC/Pc7fjhWlSQrN2WHBYV4DuSJ7D07v2LI2LxWudP799QNGivX+jgi1jQDWC46FePdbXiDmo2Wvu69ejOxSaJLv1D4Zz0EavFPjFuyyyIdIHAqOIQTsXFTpJBz18oQU1ryx3t0YPuotkJ6spVbA49YT7eSqXnR9RcU+knr51GqZfOE8BP5QlY2l6DUkG4fmfz0MJV0TyBq6wNj+ErGgb61QZfwPjkHjQ/6q59+Wj43T8VnrNfffT9hW/wipnBor39x2V0BuYxW22ZsEP+lZ8twGhEy2W3O48evImGu97Lp/thvuDxydIrXpQtX090Sgvyw/tUelX7CJLcrtSk5eLXjidgYTTKnZu9cMposASKWPPcGYcTwOjt1iP/AQD0qw1xcpFEygcAcPlMk9HiS0HiE2ilYrhPpY9PCWJz/KAL5i6X6rQmFOacTtD4fe+KYhk01bwUceWlTsPoBJxVdYys3iKnUl02DgrjXjr1g4Nqvast3JiA0VxnHp8SVFrSMmG2kQDa6QRdrbqykpbQKB50UAqVkr00qqdLr2rD7W00WEaHzTnLpC6fw6h8IavykhJOmQwWiau+c1WCAjG7rlylGyRS94MxC4NBk2e6kpEfA/MPYNRO9sWPoicIeUaD5eCe0nPHGpHkzfcXhUl5aFh2prW9Ca808lbGwOIJ0rffNCP+ucl4guj0lw2jw/hnrHgxISZROD2Sx1g6WibwzMBu9+3hCfG8QKNjsUnCMo/iYWTIVLAmDiZ5m9XRUIWnjKF+49KieA6P4XZ65vm/3/Pc02Z1mAzW7KVR8IdSmaCspGUaVNNZevHa2E9KNhw4tnZKM3LkQNX9W/2QT1wQsmKDDE3Vlqs0Srw8WlIUT8WIWFFdhlehYVG8kEjuFF3flbS038NPKSEteNn66V5IHgmazsC278l2F6KhH339f1w+A0057M5P3yu3WvFAtvmNDHiNgDtyXzmLG54vZKXAsslNDVUaxCdnhk5R53Q4/7y/EvVjW3+ZxXhEuzkd6PU/SRG5QxgAoOJiBwoFkHq7x9ARC4P9F66UoqnKS0Riy1wSiXhFw4DDjoNCNbcntTYOXv1PG+QFYrZnUeATaFGI/0uvz4e80WA5frj24TUlR+9YJvDYtKQoHsn71QbUIKbmEPWG2WjTTL7jRMu8X7W/Ha5BDVjxjtTg8KleNB3o7b/OZrLxR9vTR25PuYuQ9LrxuuvqSXASzyzYVNcHmcg4gR+TkKva8bQiieZ51avTmkq+ugN5PwZtxzveX0i8gGYwsfxV0ZDv7db/+3iT118CAOqvqyYVYHFyEZJ33sff/alUSlgUgQ+VFpwABptD97rn2b82DmjGIJ+zNIrN9bLMC2huIJNGx81TXaqcpjxv9ki58G0AUk8X8ZwXLOEgXqclGhyBmO11T8u4/co53LOpGNXrMi83dHTIPDFug+1J8Y75K19KeBRoCiAimjiM6xXcW79f/NN9uOszWYTZYMyGVLwz9YVNSWgoDMKBWq32wT6jT6BtVsflU4p125Ld6RrAzvmx5O9x3OMexQOXz/R6m9BhAgDYHHqwxMuqq+favNYh3i/isUM1tde6fcFKbIQRWzme8G+HnieG6G5N79EPb3pd7z2AWy32/b+4nLtcmr4o3PMcpyHP9ySHw1l5+TFtCOq1AABq5SjKl/AJ5dYN9fXzHQ6H94+nzP1nzSzRHOjZojnQs0VzoGeL5kDPFv03AAD//8lJY92lmophAAAAAElFTkSuQmCC){kind=small}
Contributor
Pull request overview
Adds secret-rotation capability for OAuth applications so owners (on their own apps) and superadmins (on any app) can invalidate the current client secret and obtain a new one once via flash.
Changes:
- Added owner and admin POST routes for rotating an OAuth application’s client secret.
- Implemented
rotate_secretactions in the owner and admin controllers using Doorkeeper’srenew_secret. - Updated owner/admin show pages to include a “Rotate Secret” button; admin show additionally displays the rotated secret (from flash) with copy-to-clipboard UI.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| config/routes.rb | Adds rotate-secret endpoints for owner and admin contexts. |
| app/controllers/doorkeeper/applications_controller.rb | Adds owner rotate_secret action and includes it in set_application callback. |
| app/controllers/admin/oauth_applications_controller.rb | Adds admin rotate_secret action and includes it in set_application callback. |
| app/views/doorkeeper/applications/show.html.erb | Adds “Rotate Secret” button on owner app show page. |
| app/views/admin/oauth_applications/show.html.erb | Adds rotated-secret flash display, copy button, and “Rotate Secret” action button on admin show page. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Add explicit superadmin authorization check in rotate_secret action. The route constraint already limits access, but this adds defense in depth at the controller level to prevent privilege escalation.n.
- Remove duplicate stale lines in admin controller - Fix indentation in admin controller, both show views - Add superadmin guard to admin rotate_secret action - Use I18n for flash messages in doorkeeper controller - Add respond_to HTML/JSON branches matching existing patterns - Fix double space in before_action arrayarray
System-End
force-pushed
the
oauth-creds-rotate
branch
2 times, most recently
from
1f4a6a5 to
de86a50
Compare
skyfallwastaken
force-pushed
the
oauth-creds-rotate
branch
from
b007205 to
8956906
Compare
Comment on lines
+29
to
+37
| def rotate_secret | ||
| @application.renew_secret | ||
| if @application.save | ||
| flash[:notice] = I18n.t(:notice, scope: %i[doorkeeper flash applications rotate_secret]) | ||
| else | ||
| flash[:alert] = I18n.t(:alert, scope: %i[doorkeeper flash applications rotate_secret]) | ||
| end | ||
| redirect_to admin_oauth_application_path(@application) | ||
| end |
Bug: The rotate_secret action in Admin::OauthApplicationsController doesn't set flash[:application_secret], so the new secret is never displayed to the admin after rotation.
Severity: CRITICAL
Suggested Fix
In Admin::OauthApplicationsController#rotate_secret, after @application.save succeeds, add the line flash[:application_secret] = @application.plaintext_secret. This will store the newly generated secret in the flash session, making it available for display on the subsequent page load.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: app/controllers/admin/oauth_applications_controller.rb#L29-L37
Potential issue: The `Admin::OauthApplicationsController#rotate_secret` action calls
`@application.renew_secret` to generate a new secret but fails to store it in the flash
scope before redirecting. The corresponding view,
`admin/oauth_applications/show.html.erb`, relies on `flash[:application_secret]` to
display the new secret to the admin. Because the plaintext secret is only available
during the request in which it's generated, it becomes irretrievable after the redirect.
This means when an admin rotates a secret, the rotation succeeds but the new secret is
lost, preventing the admin from providing it to the application owner and breaking any
integrations using the old secret.
he old secret.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Adds the ability to rotate client secrets for existing OAuth applications. Available to app owners on their own apps and to superadmins on any app.
POST /oauth/applications/:id/rotate_secret(owner) andPOST /admin/oauth_applications/:id/rotate_secret(superadmin)rotate_secretaction to bothDoorkeeper::ApplicationsControllerandAdmin::OauthApplicationsControllerusing Doorkeeper's built-inrenew_secret