anjlab-devise-oauth2-providable 1.1.0

data/spec/integration/oauth2_authorization_token_grant_type_strategy_spec.rb

@@ -0,0 +1,136 @@
+require 'spec_helper'
+
+describe Devise::Strategies::Oauth2AuthorizationCodeGrantTypeStrategy do
+  describe 'POST /oauth2/token' do
+    describe 'with grant_type=authorization_code' do
+      context 'with valid params' do
+        let(:user) { create(:user) }
+        let(:client) { create(:client) }
+        before do
+          @authorization_code = user.authorization_codes.create(:client => client, :redirect_uri => client.redirect_uri)
+          params = {
+            :grant_type => 'authorization_code',
+            :client_id => client.identifier,
+            :client_secret => client.secret,
+            :code => @authorization_code.token
+          }
+
+          post '/oauth2/token', params
+        end
+        it { response.code.to_i.should == 200 }
+        it { response.content_type.should == 'application/json' }
+        it 'returns json' do
+          token = Devise::Oauth2Providable::AccessToken.last
+          refresh_token = Devise::Oauth2Providable::RefreshToken.last
+          expected = {
+            :token_type => 'bearer',
+            :expires_in => 899,
+            :refresh_token => refresh_token.token,
+            :access_token => token.token
+          }
+          response.body.should match_json(expected)
+        end
+      end
+      context 'with expired authorization_code' do
+        let(:user) { create(:user) }
+        let(:client) { create(:client) }
+        before do
+          timenow = 2.days.from_now
+          Time.stub!(:now).and_return(timenow)
+          @authorization_code = user.authorization_codes.create(:client_id => client, :redirect_uri => client.redirect_uri)
+          params = {
+            :grant_type => 'authorization_code',
+            :client_id => client.identifier,
+            :client_secret => client.secret,
+            :code => @authorization_code.token
+          }
+          Time.stub!(:now).and_return(timenow + 10.minutes)
+
+          post '/oauth2/token', params
+        end
+        it { response.code.to_i.should == 400 }
+        it { response.content_type.should == 'application/json' }
+        it 'returns json' do
+          expected = {
+            :error => 'invalid_grant',
+            :error_description => 'invalid authorization code request'
+          }
+          response.body.should match_json(expected)
+        end
+      end
+      context 'with invalid authorization_code' do
+        let(:user) { create(:user) }
+        let(:client) { create(:client) }
+        before do
+          @authorization_code = user.authorization_codes.create(:client_id => client, :redirect_uri => client.redirect_uri)
+          params = {
+            :grant_type => 'authorization_code',
+            :client_id => client.identifier,
+            :client_secret => client.secret,
+            :code => 'invalid'
+          }
+
+          post '/oauth2/token', params
+        end
+        it { response.code.to_i.should == 400 }
+        it { response.content_type.should == 'application/json' }
+        it 'returns json' do
+          expected = {
+            :error => 'invalid_grant',
+            :error_description => 'invalid authorization code request'
+          }
+          response.body.should match_json(expected)
+        end
+      end
+      context 'with invalid client_secret' do
+        let(:user) { create(:user) }
+        let(:client) { create(:client) }
+        before do
+          @authorization_code = user.authorization_codes.create(:client_id => client, :redirect_uri => client.redirect_uri)
+          params = {
+            :grant_type => 'authorization_code',
+            :client_id => client.identifier,
+            :client_secret => 'invalid',
+            :code => @authorization_code.token
+          }
+
+          post '/oauth2/token', params
+        end
+        it { response.code.to_i.should == 400 }
+        it { response.content_type.should == 'application/json' }
+        it 'returns json' do
+          expected = {
+            :error => 'invalid_client',
+            :error_description => 'invalid client credentials'
+          }
+          response.body.should match_json(expected)
+        end
+      end
+      context 'with invalid client_id' do
+        let(:user) { create(:user) }
+        let(:client) { create(:client) }
+        before do
+          @authorization_code = user.authorization_codes.create(:client_id => client, :redirect_uri => client.redirect_uri)
+          params = {
+            :grant_type => 'authorization_code',
+            :client_id => 'invalid',
+            :client_secret => client.secret,
+            :code => @authorization_code.token
+          }
+
+          post '/oauth2/token', params
+        end
+        it { response.code.to_i.should == 400 }
+        it { response.content_type.should == 'application/json' }
+        it 'returns json' do
+          expected = {
+            :error => 'invalid_client',
+            :error_description => 'invalid client credentials'
+          }
+          response.body.should match_json(expected)
+        end
+      end
+    end
+  end
+end
+

data/spec/integration/oauth2_password_grant_type_strategy_spec.rb

@@ -0,0 +1,198 @@
+require 'spec_helper'
+
+describe Devise::Strategies::Oauth2PasswordGrantTypeStrategy do
+  describe 'POST /oauth2/token' do
+    describe 'with grant_type=password' do
+      context 'with valid params' do
+        let(:client) { create(:client) }
+        before do
+          @user = create(:user)
+
+          params = {
+            :grant_type => 'password',
+            :client_id => client.identifier,
+            :client_secret => client.secret,
+            :username => @user.email,
+            :password => 'test123456'
+          }
+
+          post '/oauth2/token', params
+        end
+        it { response.code.to_i.should == 200 }
+        it { response.content_type.should == 'application/json' }
+        it 'returns json' do
+          token = Devise::Oauth2Providable::AccessToken.last
+          expected = token.token_response
+          response.body.should match_json(expected)
+        end
+      end
+      context 'with valid params and client id/secret in basic auth header' do
+        let(:client) { create(:client) }
+        before do
+          @user = create :user
+
+          params = {
+            :grant_type => 'password',
+            :username => @user.email,
+            :password => 'test123456'
+          }
+
+          auth_header = ActionController::HttpAuthentication::Basic.encode_credentials client.identifier, client.secret
+          post '/oauth2/token', params, 'HTTP_AUTHORIZATION' => auth_header
+        end
+        it { response.code.to_i.should == 200 }
+        it { response.content_type.should == 'application/json' }
+        it 'returns json' do
+          token = Devise::Oauth2Providable::AccessToken.last
+          expected = token.token_response
+          response.body.should match_json(expected)
+        end
+      end
+      context 'with invalid client id in basic auth header' do
+        let(:client) { create(:client) }
+        before do
+          @user = create :user
+          params = {
+            :grant_type => 'password',
+            :username => @user.email,
+            :password => 'test123456'
+          }
+          auth_header = ActionController::HttpAuthentication::Basic.encode_credentials 'invalid client id', client.secret
+          post '/oauth2/token', params, 'HTTP_AUTHORIZATION' => auth_header
+        end
+        it { response.code.to_i.should == 400 }
+        it { response.content_type.should == 'application/json'  }
+        it 'returns json' do
+          expected = {
+            :error_description => "invalid client credentials",
+            :error => "invalid_client"
+          }
+          response.body.should match_json(expected)
+        end
+      end
+      context 'with invalid client secret in basic auth header' do
+        let(:client) { create(:client) }
+        before do
+          @user = create :user
+          params = {
+            :grant_type => 'password',
+            :username => @user.email,
+            :password => 'test123456'
+          }
+          auth_header = ActionController::HttpAuthentication::Basic.encode_credentials client.identifier, 'invalid secret'
+          post '/oauth2/token', params, 'HTTP_AUTHORIZATION' => auth_header
+        end
+        it { response.code.to_i.should == 400 }
+        it { response.content_type.should == 'application/json'  }
+        it 'returns json' do
+          expected = {
+            :error_description => "invalid client credentials",
+            :error => "invalid_client"
+          }
+          response.body.should match_json(expected)
+        end
+      end
+      context 'with invalid password' do
+        let(:client) { create(:client) }
+        before do
+          @user = create :user
+
+          params = {
+            :grant_type => 'password',
+            :client_id => client.identifier,
+            :client_secret => client.secret,
+            :username => @user.email,
+            :password => 'bar'
+          }
+
+          post '/oauth2/token', params
+        end
+        it { response.code.to_i.should == 400 }
+        it { response.content_type.should == 'application/json'  }
+        it 'returns json' do
+          expected = {
+            :error_description => "invalid password authentication request",
+            :error => "invalid_grant"
+          }
+          response.body.should match_json(expected)
+        end
+      end
+      context 'with invalid user' do
+        let(:client) { create(:client) }
+        before do
+          @user = create :user
+
+          params = {
+            :grant_type => 'password',
+            :client_id => client.identifier,
+            :client_secret => client.secret,
+            :username => 'bla@bla.com',
+            :password => 'bar'
+          }
+
+          post '/oauth2/token', params
+        end
+        it { response.code.to_i.should == 400 }
+        it { response.content_type.should == 'application/json'  }
+        it 'returns json' do
+          expected = {
+            :error_description => "invalid password authentication request",
+            :error => "invalid_grant"
+          }
+          response.body.should match_json(expected)
+        end
+      end
+      context 'with invalid client_id' do
+        let(:client) { create(:client) }
+        before do
+          @user = create :user
+
+          params = {
+            :grant_type => 'password',
+            :client_id => 'invalid',
+            :client_secret => client.secret,
+            :username => @user.email,
+            :password => 'test123456'
+          }
+
+          post '/oauth2/token', params
+        end
+        it { response.code.to_i.should == 400 }
+        it { response.content_type.should == 'application/json'  }
+        it 'returns json' do
+          expected = {
+            :error_description => "invalid client credentials",
+            :error => "invalid_client"
+          }
+          response.body.should match_json(expected)
+        end
+      end
+      context 'with invalid client_secret' do
+        let(:client) { create(:client) }
+        before do
+          @user = create :user
+
+          params = {
+            :grant_type => 'password',
+            :client_id => client.identifier,
+            :client_secret => 'invalid',
+            :username => @user.email,
+            :password => 'test123456'
+          }
+
+          post '/oauth2/token', params
+        end
+        it { response.code.to_i.should == 400 }
+        it { response.content_type.should == 'application/json'  }
+        it 'returns json' do
+          expected = {
+            :error_description => "invalid client credentials",
+            :error => "invalid_client"
+          }
+          response.body.should match_json(expected)
+        end
+      end
+    end
+  end
+end
+

data/spec/integration/oauth2_refresh_token_grant_type_strategy_spec.rb

@@ -0,0 +1,138 @@
+require 'spec_helper'
+
+describe Devise::Strategies::Oauth2RefreshTokenGrantTypeStrategy do
+  describe 'POST /oauth2/token' do
+    describe 'with grant_type=refresh_token' do
+      context 'with valid params' do
+        let(:user) { create(:user) }
+        let(:client) { create(:client) }
+        before do
+          @refresh_token = client.refresh_tokens.create! :user => user
+          params = {
+            :grant_type => 'refresh_token',
+            :client_id => client.identifier,
+            :client_secret => client.secret,
+            :refresh_token => @refresh_token.token
+          }
+
+          post '/oauth2/token', params
+        end
+        it { response.code.to_i.should == 200 }
+        it { response.content_type.should == 'application/json' }
+        it 'returns json' do
+          token = Devise::Oauth2Providable::AccessToken.last
+          refresh_token = @refresh_token
+          expected = {
+            :token_type => 'bearer',
+            :expires_in => 899,
+            :refresh_token => refresh_token.token,
+            :access_token => token.token
+          }
+          response.body.should match_json(expected)
+        end
+      end
+      context 'with expired refresh_token' do
+        let(:user) { create(:user) }
+        let(:client) { create(:client) }
+        before do
+          timenow = 2.days.from_now
+          Time.stub!(:now).and_return(timenow)
+          @refresh_token = client.refresh_tokens.create! :user => user
+          params = {
+            :grant_type => 'refresh_token',
+            :client_id => client.identifier,
+            :client_secret => client.secret,
+            :refresh_token => @refresh_token.token
+          }
+          Time.stub!(:now).and_return(timenow + 2.months)
+
+          post '/oauth2/token', params
+        end
+        it { response.code.to_i.should == 400 }
+        it { response.content_type.should == 'application/json' }
+        it 'returns json' do
+          expected = {
+            :error => 'invalid_grant',
+            :error_description => 'invalid refresh token'
+          }
+          response.body.should match_json(expected)
+        end
+      end
+      context 'with invalid refresh_token' do
+        let(:user) { create(:user) }
+        let(:client) { create(:client) }
+        before do
+          @refresh_token = client.refresh_tokens.create! :user => user
+          params = {
+            :grant_type => 'refresh_token',
+            :client_id => client.identifier,
+            :client_secret => client.secret,
+            :refresh_token => 'invalid'
+          }
+
+          post '/oauth2/token', params
+        end
+        it { response.code.to_i.should == 400 }
+        it { response.content_type.should == 'application/json' }
+        it 'returns json' do
+          token = Devise::Oauth2Providable::AccessToken.last
+          refresh_token = @refresh_token
+          expected = {
+            :error => 'invalid_grant',
+            :error_description => 'invalid refresh token'
+          }
+          response.body.should match_json(expected)
+        end
+      end
+      context 'with invalid client_id' do
+        let(:user) { create(:user) }
+        let(:client) { create(:client) }
+        before do
+          @refresh_token = client.refresh_tokens.create! :user => user
+          params = {
+            :grant_type => 'refresh_token',
+            :client_id => 'invalid',
+            :client_secret => client.secret,
+            :refresh_token => @refresh_token.token
+          }
+
+          post '/oauth2/token', params
+        end
+        it { response.code.to_i.should == 400 }
+        it { response.content_type.should == 'application/json' }
+        it 'returns json' do
+          expected = {
+            :error => 'invalid_client',
+            :error_description => 'invalid client credentials'
+          }
+          response.body.should match_json(expected)
+        end
+      end
+      context 'with invalid client_secret' do
+        let(:user) { create(:user) }
+        let(:client) { create(:client) }
+        before do
+          @refresh_token = client.refresh_tokens.create! :user => user
+          params = {
+            :grant_type => 'refresh_token',
+            :client_id => client.identifier,
+            :client_secret => 'invalid',
+            :refresh_token => @refresh_token.token
+          }
+
+          post '/oauth2/token', params
+        end
+        it { response.code.to_i.should == 400 }
+        it { response.content_type.should == 'application/json' }
+        it 'returns json' do
+          expected = {
+            :error => 'invalid_client',
+            :error_description => 'invalid client credentials'
+          }
+          response.body.should match_json(expected)
+        end
+      end
+    end
+  end
+end
+