Wire openid_request from AccessGrant mixin instead of on_load (#306)

Namespaced custom access grant models (e.g. `Auth::OAuthAccessGrant <
ApplicationRecord`) crashed on Rails boot since v1.10.0 with
`NameError: uninitialized constant Auth::ApplicationRecord`.

v1.10.0 (#241) wrapped the access-grant prepend in
`ActiveSupport.on_load(:active_record)`, following doorkeeper #1804.
doorkeeper reverted that approach in #1830 (v5.9.2): the load hook fires
while `ActiveRecord::Base` is first loaded — mid-evaluation of
`class ApplicationRecord < ActiveRecord::Base` — so constantizing a
namespaced grant model from the hook resolves `ApplicationRecord` before
`::ApplicationRecord` is registered, raising the NameError.

Follow doorkeeper #1830: drop the `run_hooks`/`initialize_models!`
overrides and the on_load block, and instead prepend an extension onto
the singleton class of `Doorkeeper::Orm::ActiveRecord::Mixins::AccessGrant`.
Its `included` callback adds the `openid_request` association when the
host model includes the mixin — at the model's own load time, with `base`
handed in by Ruby. Nothing constantizes the configured grant class, so
the re-entrant load window is gone. The string `class_name:` keeps the
association target resolved lazily by ActiveRecord. The prepend is
guarded with `base.is_a?(Class)`: when the mixin is included into an
intermediate ActiveSupport::Concern, the hook first fires with that
module as `base`, and the deferred include fires it again with the
actual model class.

The legacy `active_record_options[:establish_connection]` handling moves
into the OpenidRequest mixin's `included` block (guarded; a no-op on
doorkeeper 5.9.x, which no longer exposes `active_record_options`).

Adds regression coverage: a namespaced custom model that includes the
doorkeeper mixin is wired with the `openid_request` association.

Author: 55728

CHANGELOG.md

@@ -4,6 +4,7 @@
 - [#304] allow handle auth_time per grant
 - [#305] Document the `auth_time_from_access_token` config option in the README (per-grant `auth_time`), clarifying that it only affects the ID Token `auth_time` claim and not `max_age` enforcement
 - [#307] Fix `bundle exec rake server` for the test application
+- [#308] Fix `NameError: uninitialized constant Auth::ApplicationRecord` on boot when using a namespaced custom access grant model (e.g. `Auth::OAuthAccessGrant < ApplicationRecord`). Since v1.10.0 ([#241]) the `openid_request` association was wired inside an `ActiveSupport.on_load(:active_record)` block, which fires while `ActiveRecord::Base` is first loaded and constantizes the grant model too early. The association is now added from Doorkeeper's `AccessGrant` mixin `included` callback — at the model's own load time, without constantizing — mirroring the fix doorkeeper made in [#1830](https://github.com/doorkeeper-gem/doorkeeper/pull/1830) ([#306](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/306))
 
 ## v1.10.1 (2026-06-03)
 

lib/doorkeeper/openid_connect/orm/active_record.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require "active_support/lazy_load_hooks"
-
 module Doorkeeper
   module OpenidConnect
     autoload :AccessGrant, "doorkeeper/openid_connect/orm/active_record/access_grant"
@@ -14,51 +12,43 @@ module Mixins
                    "doorkeeper/openid_connect/orm/active_record/mixins/openid_request"
         end
 
-        def run_hooks
-          super
-
-          ActiveSupport.on_load(:active_record) do
-            require "doorkeeper/openid_connect/orm/active_record/access_grant"
-            require "doorkeeper/openid_connect/orm/active_record/request"
-
-            if Gem.loaded_specs["doorkeeper"].version >= Gem::Version.create("5.5.0")
-              Doorkeeper.config.access_grant_model.prepend Doorkeeper::OpenidConnect::AccessGrant
-            else
-              Doorkeeper::AccessGrant.prepend Doorkeeper::OpenidConnect::AccessGrant
-            end
-
-            if Doorkeeper.configuration.respond_to?(:active_record_options) && Doorkeeper.configuration.active_record_options[:establish_connection]
-              [Doorkeeper::OpenidConnect.configuration.open_id_request_model].each do |c|
-                c.send :establish_connection,
-                       Doorkeeper.configuration.active_record_options[:establish_connection]
-              end
-            end
-          end
-        end
-
-        def initialize_models!
-          super
-          ActiveSupport.on_load(:active_record) do
-            require "doorkeeper/openid_connect/orm/active_record/access_grant"
-            require "doorkeeper/openid_connect/orm/active_record/request"
-
-            if Gem.loaded_specs["doorkeeper"].version >= Gem::Version.create("5.5.0")
-              Doorkeeper.config.access_grant_model.prepend Doorkeeper::OpenidConnect::AccessGrant
-            else
-              Doorkeeper::AccessGrant.prepend Doorkeeper::OpenidConnect::AccessGrant
-            end
-
-            if Doorkeeper.configuration.active_record_options[:establish_connection]
-              [Doorkeeper::OpenidConnect.configuration.open_id_request_model].each do |c|
-                c.send :establish_connection,
-                       Doorkeeper.configuration.active_record_options[:establish_connection]
-              end
-            end
+        # Prepended onto the singleton class of Doorkeeper's AccessGrant
+        # mixin so that every model which includes
+        # `Doorkeeper::Orm::ActiveRecord::Mixins::AccessGrant` — the default
+        # `Doorkeeper::AccessGrant` as well as any (possibly namespaced)
+        # custom access grant model — also gains the OpenID Connect
+        # `openid_request` association.
+        #
+        # The association is wired from the mixin's `included` callback, at
+        # the moment the host model is loaded: `base` is the model class
+        # itself, handed to us by Ruby. Nothing reaches out to constantize
+        # the configured grant class, so the re-entrant
+        # `ActiveSupport.on_load(:active_record)` window that broke
+        # namespaced custom models is gone.
+        #
+        # Background: doorkeeper-openid_connect v1.10.0 (#241) wrapped the
+        # grant-model prepend in `ActiveSupport.on_load(:active_record)`,
+        # following doorkeeper #1804. doorkeeper later reverted that in
+        # #1830 (v5.9.2) because the hook fires while `ActiveRecord::Base`
+        # is first loaded — e.g. mid-evaluation of
+        # `class ApplicationRecord < ActiveRecord::Base` — at which point
+        # constantizing `Auth::OAuthAccessGrant < ApplicationRecord` raises
+        # `NameError: uninitialized constant Auth::ApplicationRecord` (#306).
+        # We follow the same fix: wire from the mixin instead of on_load.
+        module AccessGrantExtension
+          def included(base)
+            super
+            # `base` is a Module (not the model) when the mixin is included
+            # into an intermediate ActiveSupport::Concern; the concern defers
+            # the include, so this hook fires again with the model class.
+            base.prepend(OpenidConnect::AccessGrant) if base.is_a?(Class)
           end
         end
       end
     end
   end
 
-  Orm::ActiveRecord.singleton_class.send :prepend, OpenidConnect::Orm::ActiveRecord
+  Orm::ActiveRecord::Mixins::AccessGrant.singleton_class.prepend(
+    OpenidConnect::Orm::ActiveRecord::AccessGrantExtension,
+  )
 end

lib/doorkeeper/openid_connect/orm/active_record/mixins/openid_request.rb

@@ -11,6 +11,18 @@ module OpenidRequest
             included do
               self.table_name = "#{table_name_prefix}oauth_openid_requests#{table_name_suffix}".to_sym
 
+              # Legacy multi-database support: older Doorkeeper releases let
+              # users route the ORM models to a separate connection via
+              # `active_record_options[:establish_connection]`. Doorkeeper
+              # 5.9.x no longer exposes `active_record_options`, so the guard
+              # makes this a no-op there. It used to live in the ORM adapter's
+              # `run_hooks`; wiring it from the model's own `included` block
+              # keeps it off the re-entrant `on_load(:active_record)` path.
+              if Doorkeeper.configuration.respond_to?(:active_record_options) &&
+                 (connection_options = Doorkeeper.configuration.active_record_options[:establish_connection])
+                establish_connection(connection_options)
+              end
+
               validates :access_grant_id, :nonce, presence: true
 
               if Gem.loaded_specs["doorkeeper"].version >= Gem::Version.create("5.5.0")

spec/lib/orm/active_record_spec.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+# Regression coverage for #306.
+#
+# doorkeeper-openid_connect v1.10.0 (#241) wired the `openid_request`
+# association onto the access grant model from inside an
+# `ActiveSupport.on_load(:active_record)` block. That hook fires while
+# `ActiveRecord::Base` is first loaded — e.g. mid-evaluation of
+# `class ApplicationRecord < ActiveRecord::Base` — so constantizing a
+# namespaced custom grant model (`Auth::OAuthAccessGrant < ApplicationRecord`)
+# from the hook raised `NameError: uninitialized constant Auth::ApplicationRecord`.
+#
+# The fix wires the association from Doorkeeper's AccessGrant mixin
+# `included` callback instead, at the host model's own load time, without
+# constantizing anything. These specs pin that behavior.
+describe "Doorkeeper::OpenidConnect ActiveRecord ORM integration" do
+  describe "the openid_request association" do
+    it "is wired onto the default access grant model" do
+      association = Doorkeeper.config.access_grant_model.reflect_on_association(:openid_request)
+      expect(association).not_to be_nil
+    end
+
+    it "is wired onto a namespaced custom model that includes Doorkeeper's mixin" do
+      # Mirrors the #306 reporter's setup: a namespaced model subclassing
+      # the host app's ApplicationRecord and including the doorkeeper mixin.
+      # Because the association is added from the mixin's `included` callback
+      # (not a deferred load hook), the model is wired at its own load time
+      # without anything constantizing the configured grant class.
+      stub_const("Auth306", Module.new)
+      custom_model = Class.new(ApplicationRecord) do
+        self.table_name = "oauth_access_grants"
+        include Doorkeeper::Orm::ActiveRecord::Mixins::AccessGrant
+      end
+      Auth306.const_set(:OAuthAccessGrant, custom_model)
+
+      association = custom_model.reflect_on_association(:openid_request)
+      expect(association).not_to be_nil
+      expect(association.options[:class_name])
+        .to eq(Doorkeeper::OpenidConnect.configuration.open_id_request_class)
+    end
+  end
+end