doorkeeper-mongodb 5.2.1 → 5.2.2

data/spec/requests/flows/client_credentials_spec.rb

@@ -2,23 +2,22 @@
 
 require "spec_helper"
 
-describe "Client Credentials Request" do
+RSpec.describe "Client Credentials Request" do
   let(:client) { FactoryBot.create :application }
 
-  context "a valid request" do
+  context "with a valid request" do
     it "authorizes the client and returns the token response" do
       headers = authorization client.uid, client.secret
       params  = { grant_type: "client_credentials" }
 
       post "/oauth/token", params: params, headers: headers
 
-      should_have_json "access_token", Doorkeeper::AccessToken.first.token
-      should_have_json_within "expires_in", Doorkeeper.configuration.access_token_expires_in, 1
-      should_not_have_json "scope"
-      should_not_have_json "refresh_token"
-
-      should_not_have_json "error"
-      should_not_have_json "error_description"
+      expect(json_response).to match(
+        "access_token" => Doorkeeper::AccessToken.first.token,
+        "token_type" => "Bearer",
+        "expires_in" => Doorkeeper.configuration.access_token_expires_in,
+        "created_at" => an_instance_of(Integer),
+      )
     end
 
     context "with scopes" do
@@ -33,34 +32,38 @@ describe "Client Credentials Request" do
 
         post "/oauth/token", params: params, headers: headers
 
-        should_have_json "access_token", Doorkeeper::AccessToken.first.token
-        should_have_json "scope", "write"
+        expect(json_response).to include(
+          "access_token" => Doorkeeper::AccessToken.first.token,
+          "scope" => "write",
+        )
       end
 
-      context "that are default" do
+      context "when scopes are default" do
         it "adds the scope to the token an returns in the response" do
           headers = authorization client.uid, client.secret
           params  = { grant_type: "client_credentials", scope: "public" }
 
           post "/oauth/token", params: params, headers: headers
 
-          should_have_json "access_token", Doorkeeper::AccessToken.first.token
-          should_have_json "scope", "public"
+          expect(json_response).to include(
+            "access_token" => Doorkeeper::AccessToken.first.token,
+            "scope" => "public",
+          )
         end
       end
 
-      context "that are invalid" do
+      context "when scopes are invalid" do
         it "does not authorize the client and returns the error" do
           headers = authorization client.uid, client.secret
           params  = { grant_type: "client_credentials", scope: "random" }
 
           post "/oauth/token", params: params, headers: headers
 
-          should_have_json "error", "invalid_scope"
-          should_have_json "error_description", translated_error_message(:invalid_scope)
-          should_not_have_json "access_token"
-
           expect(response.status).to eq(400)
+          expect(json_response).to match(
+            "error" => "invalid_scope",
+            "error_description" => translated_error_message(:invalid_scope),
+          )
         end
       end
     end
@@ -82,8 +85,10 @@ describe "Client Credentials Request" do
 
       post "/oauth/token", params: params, headers: headers
 
-      should_have_json "error", "unauthorized_client"
-      should_have_json "error_description", translated_error_message(:unauthorized_client)
+      expect(json_response).to match(
+        "error" => "unauthorized_client",
+        "error_description" => translated_error_message(:unauthorized_client),
+      )
     end
 
     scenario "allows the request when satisfies condition" do
@@ -94,13 +99,12 @@ describe "Client Credentials Request" do
 
       post "/oauth/token", params: params, headers: headers
 
-      should_have_json "access_token", Doorkeeper::AccessToken.first.token
-      should_have_json_within "expires_in", Doorkeeper.configuration.access_token_expires_in, 1
-      should_not_have_json "scope"
-      should_not_have_json "refresh_token"
-
-      should_not_have_json "error"
-      should_not_have_json "error_description"
+      expect(json_response).to match(
+        "access_token" => Doorkeeper::AccessToken.first.token,
+        "token_type" => "Bearer",
+        "expires_in" => 7200,
+        "created_at" => an_instance_of(Integer),
+      )
     end
   end
 
@@ -122,8 +126,10 @@ describe "Client Credentials Request" do
       token = Doorkeeper::AccessToken.first
 
       expect(token.application_id).to eq client.id
-      should_have_json "access_token", token.token
-      should_have_json "scope", "public"
+      expect(json_response).to include(
+        "access_token" => token.token,
+        "scope" => "public",
+      )
     end
 
     it "issues new token with multiple default scopes that are present in application scopes" do
@@ -139,30 +145,33 @@ describe "Client Credentials Request" do
       token = Doorkeeper::AccessToken.first
 
       expect(token.application_id).to eq client.id
-      should_have_json "access_token", token.token
-      should_have_json "scope", "public read"
+      expect(json_response).to include(
+        "access_token" => token.token,
+        "scope" => "public read",
+      )
     end
   end
 
-  context "an invalid request" do
+  context "when request is invalid" do
     it "does not authorize the client and returns the error" do
       headers = {}
       params  = { grant_type: "client_credentials" }
 
       post "/oauth/token", params: params, headers: headers
 
-      should_have_json "error", "invalid_client"
-      should_have_json "error_description", translated_error_message(:invalid_client)
-      should_not_have_json "access_token"
-
       expect(response.status).to eq(401)
+
+      expect(json_response).to match(
+        "error" => "invalid_client",
+        "error_description" => translated_error_message(:invalid_client),
+      )
     end
   end
 
   context "when revoke_previous_client_credentials_token is true" do
     before do
-      allow(Doorkeeper.config).to receive(:reuse_access_token) { false }
-      allow(Doorkeeper.config).to receive(:revoke_previous_client_credentials_token) { true }
+      allow(Doorkeeper.config).to receive(:reuse_access_token).and_return(false)
+      allow(Doorkeeper.config).to receive(:revoke_previous_client_credentials_token?).and_return(true)
     end
 
     it "revokes the previous token" do
@@ -170,15 +179,15 @@ describe "Client Credentials Request" do
       params  = { grant_type: "client_credentials" }
 
       post "/oauth/token", params: params, headers: headers
-      should_have_json "access_token", Doorkeeper::AccessToken.first.token
+      expect(json_response).to include("access_token" => Doorkeeper::AccessToken.first.token)
 
       token = Doorkeeper::AccessToken.first
 
       post "/oauth/token", params: params, headers: headers
-      should_have_json "access_token", Doorkeeper::AccessToken.last.token
+      expect(json_response).to include("access_token" => Doorkeeper::AccessToken.last.token)
 
-      expect(token.reload.revoked?).to be_truthy
-      expect(Doorkeeper::AccessToken.last.revoked?).to be_falsey
+      expect(token.reload).to be_revoked
+      expect(Doorkeeper::AccessToken.last).not_to be_revoked
     end
 
     context "with a simultaneous request" do
@@ -194,8 +203,11 @@ describe "Client Credentials Request" do
         params  = { grant_type: "client_credentials" }
 
         post "/oauth/token", params: params, headers: headers
-        should_not_have_json "access_token"
-        should_have_json "error", "invalid_token_reuse"
+
+        expect(json_response).to match(
+          "error" => "invalid_token_reuse",
+          "error_description" => translated_error_message(:server_error),
+        )
       end
     end
   end

data/spec/requests/flows/implicit_grant_spec.rb

@@ -44,7 +44,7 @@ feature "Implicit Grant Flow (feature spec)" do
   end
 end
 
-describe "Implicit Grant Flow (request spec)" do
+RSpec.describe "Implicit Grant Flow (request spec)" do
   before do
     default_scopes_exist :default
     config_is_set(:authenticate_resource_owner) { User.first || redirect_to("/sign_in") }
@@ -53,8 +53,8 @@ describe "Implicit Grant Flow (request spec)" do
     create_resource_owner
   end
 
-  context "token reuse" do
-    it "should return a new token each request" do
+  context "when reuse_access_token enabled" do
+    it "returns a new token each request" do
       allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(false)
 
       token = client_is_authorized(@client, @resource_owner, scopes: "default")
@@ -71,7 +71,7 @@ describe "Implicit Grant Flow (request spec)" do
       expect(response.location).not_to include(token.token)
     end
 
-    it "should return the same token if it is still accessible" do
+    it "returns the same token if it is still accessible" do
       allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
 
       token = client_is_authorized(@client, @resource_owner, scopes: "default")

data/spec/requests/flows/password_spec.rb

@@ -2,315 +2,355 @@
 
 require "spec_helper"
 
-describe "Resource Owner Password Credentials Flow not set up" do
-  before do
-    client_exists
-    create_resource_owner
-  end
+RSpec.describe "Resource Owner Password Credentials Flow" do
+  context "when not setup properly" do
+    before do
+      client_exists
+      create_resource_owner
+    end
 
-  context "with valid user credentials" do
-    it "does not issue new token" do
-      expect do
-        post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
-      end.to_not(change { Doorkeeper::AccessToken.count })
+    context "with valid user credentials" do
+      it "does not issue new token" do
+        expect do
+          post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
+        end.not_to(change { Doorkeeper::AccessToken.count })
+      end
     end
   end
-end
 
-describe "Resource Owner Password Credentials Flow" do
-  let(:client_attributes) { { redirect_uri: nil } }
+  context "when grant type configured" do
+    let(:client_attributes) { { redirect_uri: nil } }
 
-  before do
-    config_is_set(:grant_flows, ["password"])
-    config_is_set(:resource_owner_from_credentials) { User.authenticate! params[:username], params[:password] }
-    client_exists(client_attributes)
-    create_resource_owner
-  end
+    before do
+      config_is_set(:grant_flows, ["password"])
+      config_is_set(:resource_owner_from_credentials) { User.authenticate! params[:username], params[:password] }
+      client_exists(client_attributes)
+      create_resource_owner
+    end
 
-  context "with valid user credentials" do
-    context "with non-confidential/public client" do
-      let(:client_attributes) { { confidential: false } }
+    context "with valid user credentials" do
+      context "with confidential client authorized using Basic auth" do
+        it "issues a new token" do
+          expect do
+            post password_token_endpoint_url(
+              resource_owner: @resource_owner,
+            ), headers: { "HTTP_AUTHORIZATION" => basic_auth_header_for_client(@client) }
+          end.to(change { Doorkeeper::AccessToken.count })
 
-      context "when configured to check application supported grant flow" do
-        before do
-          Doorkeeper.configuration.instance_variable_set(
-            :@allow_grant_flow_for_client,
-            ->(_grant_flow, client) { client.name == "admin" },
+          token = Doorkeeper::AccessToken.first
+          expect(token.application_id).to eq(@client.id)
+
+          expect(json_response).to match(
+            "access_token" => token.token,
+            "expires_in" => an_instance_of(Integer),
+            "token_type" => "Bearer",
+            "created_at" => an_instance_of(Integer),
           )
         end
+      end
 
-        scenario "forbids the request when doesn't satisfy condition" do
-          @client.update(name: "sample app")
+      context "with non-confidential/public client" do
+        let(:client_attributes) { { confidential: false } }
 
-          expect do
-            post password_token_endpoint_url(
-              client_id: @client.uid,
-              client_secret: "foobar",
-              resource_owner: @resource_owner,
+        context "when configured to check application supported grant flow" do
+          before do
+            Doorkeeper.configuration.instance_variable_set(
+              :@allow_grant_flow_for_client,
+              ->(_grant_flow, client) { client.name == "admin" },
             )
-          end.not_to(change { Doorkeeper::AccessToken.count })
+          end
 
-          expect(response.status).to eq(401)
-          should_have_json "error", "invalid_client"
-        end
+          scenario "forbids the request when doesn't satisfy condition" do
+            @client.update(name: "sample app")
+
+            expect do
+              post password_token_endpoint_url(
+                client_id: @client.uid,
+                client_secret: "foobar",
+                resource_owner: @resource_owner,
+              )
+            end.not_to(change { Doorkeeper::AccessToken.count })
 
-        scenario "allows the request when satisfies condition" do
-          @client.update(name: "admin")
+            expect(response.status).to eq(401)
+            expect(json_response).to match(
+              "error" => "invalid_client",
+              "error_description" => an_instance_of(String),
+            )
+          end
 
-          expect do
-            post password_token_endpoint_url(client_id: @client.uid, resource_owner: @resource_owner)
-          end.to change { Doorkeeper::AccessToken.count }.by(1)
+          scenario "allows the request when satisfies condition" do
+            @client.update(name: "admin")
 
-          token = Doorkeeper::AccessToken.first
+            expect do
+              post password_token_endpoint_url(client_id: @client.uid, resource_owner: @resource_owner)
+            end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+            token = Doorkeeper::AccessToken.first
+            expect(token.application_id).to eq(@client.id)
 
-          expect(token.application_id).to eq @client.id
-          should_have_json "access_token", token.token
+            expect(json_response).to include("access_token" => token.token)
+          end
         end
-      end
 
-      context "when client_secret absent" do
-        it "should issue new token" do
-          expect do
-            post password_token_endpoint_url(client_id: @client.uid, resource_owner: @resource_owner)
-          end.to change { Doorkeeper::AccessToken.count }.by(1)
+        context "when client_secret absent" do
+          it "issues a new token" do
+            expect do
+              post password_token_endpoint_url(client_id: @client.uid, resource_owner: @resource_owner)
+            end.to change { Doorkeeper::AccessToken.count }.by(1)
 
-          token = Doorkeeper::AccessToken.first
+            token = Doorkeeper::AccessToken.first
 
-          expect(token.application_id).to eq @client.id
-          should_have_json "access_token", token.token
+            expect(token.application_id).to eq(@client.id)
+            expect(json_response).to include("access_token" => token.token)
+          end
+        end
+
+        context "when client_secret present" do
+          it "issues a new token" do
+            expect do
+              post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
+            end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+            token = Doorkeeper::AccessToken.first
+
+            expect(token.application_id).to eq(@client.id)
+            expect(json_response).to include("access_token" => token.token)
+          end
+
+          context "when client_secret incorrect" do
+            it "doesn't issue new token" do
+              expect do
+                post password_token_endpoint_url(
+                  client_id: @client.uid,
+                  client_secret: "foobar",
+                  resource_owner: @resource_owner,
+                )
+              end.not_to(change { Doorkeeper::AccessToken.count })
+
+              expect(response.status).to eq(401)
+              expect(json_response).to include(
+                "error" => "invalid_client",
+                "error_description" => an_instance_of(String),
+              )
+            end
+          end
         end
       end
 
-      context "when client_secret present" do
-        it "should issue new token" do
+      context "with confidential/private client" do
+        it "issues a new token" do
           expect do
             post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
           end.to change { Doorkeeper::AccessToken.count }.by(1)
 
           token = Doorkeeper::AccessToken.first
 
-          expect(token.application_id).to eq @client.id
-          should_have_json "access_token", token.token
+          expect(token.application_id).to eq(@client.id)
+          expect(json_response).to include("access_token" => token.token)
         end
 
-        context "when client_secret incorrect" do
-          it "should not issue new token" do
+        context "when client_secret absent" do
+          it "doesn't issue new token" do
             expect do
-              post password_token_endpoint_url(
-                client_id: @client.uid,
-                client_secret: "foobar",
-                resource_owner: @resource_owner,
-              )
+              post password_token_endpoint_url(client_id: @client.uid, resource_owner: @resource_owner)
             end.not_to(change { Doorkeeper::AccessToken.count })
 
             expect(response.status).to eq(401)
-            should_have_json "error", "invalid_client"
+            expect(json_response).to match(
+              "error" => "invalid_client",
+              "error_description" => an_instance_of(String),
+            )
           end
         end
       end
-    end
 
-    context "with confidential/private client" do
-      it "should issue new token" do
+      it "issues new token without client credentials" do
         expect do
-          post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
-        end.to change { Doorkeeper::AccessToken.count }.by(1)
+          post password_token_endpoint_url(resource_owner: @resource_owner)
+        end.to(change { Doorkeeper::AccessToken.count }.by(1))
 
         token = Doorkeeper::AccessToken.first
 
-        expect(token.application_id).to eq @client.id
-        should_have_json "access_token", token.token
-      end
-
-      context "when client_secret absent" do
-        it "should not issue new token" do
-          expect do
-            post password_token_endpoint_url(client_id: @client.uid, resource_owner: @resource_owner)
-          end.not_to(change { Doorkeeper::AccessToken.count })
-
-          expect(response.status).to eq(401)
-          should_have_json "error", "invalid_client"
-        end
+        expect(token.application_id).to be_nil
+        expect(json_response).to include("access_token" => token.token)
       end
-    end
 
-    it "should issue new token without client credentials" do
-      expect do
-        post password_token_endpoint_url(resource_owner: @resource_owner)
-      end.to(change { Doorkeeper::AccessToken.count }.by(1))
+      it "issues a refresh token if enabled" do
+        config_is_set(:refresh_token_enabled, true)
 
-      token = Doorkeeper::AccessToken.first
+        post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
 
-      expect(token.application_id).to be_nil
-      should_have_json "access_token", token.token
-    end
+        token = Doorkeeper::AccessToken.first
+        expect(json_response).to include("refresh_token" => token.refresh_token)
+      end
 
-    it "should issue a refresh token if enabled" do
-      config_is_set(:refresh_token_enabled, true)
+      it "returns the same token if it is still accessible" do
+        allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
 
-      post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
+        client_is_authorized(@client, @resource_owner)
 
-      token = Doorkeeper::AccessToken.first
+        post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
 
-      should_have_json "refresh_token", token.refresh_token
-    end
+        expect(Doorkeeper::AccessToken.count).to be(1)
+        expect(json_response).to include("access_token" => Doorkeeper::AccessToken.first.token)
+      end
 
-    it "should return the same token if it is still accessible" do
-      allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
+      context "with valid, default scope" do
+        before do
+          default_scopes_exist :public
+        end
 
-      client_is_authorized(@client, @resource_owner)
+        it "issues new token" do
+          expect do
+            post password_token_endpoint_url(client: @client, resource_owner: @resource_owner, scope: "public")
+          end.to change { Doorkeeper::AccessToken.count }.by(1)
 
-      post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
+          token = Doorkeeper::AccessToken.first
 
-      expect(Doorkeeper::AccessToken.count).to be(1)
-      should_have_json "access_token", Doorkeeper::AccessToken.first.token
+          expect(token.application_id).to eq(@client.id)
+          expect(json_response).to include(
+            "access_token" => token.token,
+            "scope" => "public",
+          )
+        end
+      end
     end
 
-    context "with valid, default scope" do
+    context "when application scopes are present and differs from configured default scopes and no scope is passed" do
       before do
         default_scopes_exist :public
+        @client.update(scopes: "abc")
       end
 
-      it "should issue new token" do
+      it "issues new token without any scope" do
         expect do
-          post password_token_endpoint_url(client: @client, resource_owner: @resource_owner, scope: "public")
+          post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
         end.to change { Doorkeeper::AccessToken.count }.by(1)
 
         token = Doorkeeper::AccessToken.first
 
-        expect(token.application_id).to eq @client.id
-        should_have_json "access_token", token.token
-        should_have_json "scope", "public"
+        expect(token.application_id).to eq(@client.id)
+        expect(token.scopes).to be_empty
+        expect(json_response).to include("access_token" => token.token)
+        expect(json_response).not_to include("scope")
       end
     end
-  end
 
-  context "when application scopes are present and differs from configured default scopes and no scope is passed" do
-    before do
-      default_scopes_exist :public
-      @client.update(scopes: "abc")
-    end
+    context "when application scopes contain some of the default scopes and no scope is passed" do
+      before do
+        @client.update(scopes: "read write public")
+      end
 
-    it "issues new token without any scope" do
-      expect do
-        post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
-      end.to change { Doorkeeper::AccessToken.count }.by(1)
+      it "issues new token with one default scope that are present in application scopes" do
+        default_scopes_exist :public, :admin
 
-      token = Doorkeeper::AccessToken.first
+        expect do
+          post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
+        end.to change { Doorkeeper::AccessToken.count }.by(1)
 
-      expect(token.application_id).to eq @client.id
-      expect(token.scopes).to be_empty
-      should_have_json "access_token", token.token
-      should_not_have_json "scope"
-    end
-  end
+        token = Doorkeeper::AccessToken.first
 
-  context "when application scopes contain some of the default scopes and no scope is passed" do
-    before do
-      @client.update(scopes: "read write public")
-    end
+        expect(token.application_id).to eq(@client.id)
+        expect(json_response).to include(
+          "access_token" => token.token,
+          "scope" => "public",
+        )
+      end
 
-    it "issues new token with one default scope that are present in application scopes" do
-      default_scopes_exist :public, :admin
+      it "issues new token with multiple default scopes that are present in application scopes" do
+        default_scopes_exist :public, :read, :update
 
-      expect do
-        post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
-      end.to change { Doorkeeper::AccessToken.count }.by(1)
+        expect do
+          post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
+        end.to change { Doorkeeper::AccessToken.count }.by(1)
 
-      token = Doorkeeper::AccessToken.first
+        token = Doorkeeper::AccessToken.first
 
-      expect(token.application_id).to eq @client.id
-      should_have_json "access_token", token.token
-      should_have_json "scope", "public"
+        expect(token.application_id).to eq(@client.id)
+        expect(json_response).to include(
+          "access_token" => token.token,
+          "scope" => "public read",
+        )
+      end
     end
 
-    it "issues new token with multiple default scopes that are present in application scopes" do
-      default_scopes_exist :public, :read, :update
-
-      expect do
-        post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
-      end.to change { Doorkeeper::AccessToken.count }.by(1)
-
-      token = Doorkeeper::AccessToken.first
+    context "with invalid scopes" do
+      subject do
+        post password_token_endpoint_url(
+          client: @client,
+          resource_owner: @resource_owner,
+          scope: "random",
+        )
+      end
 
-      expect(token.application_id).to eq @client.id
-      should_have_json "access_token", token.token
-      should_have_json "scope", "public read"
-    end
-  end
+      it "doesn't issue new token" do
+        expect { subject }.not_to(change { Doorkeeper::AccessToken.count })
+      end
 
-  context "with invalid scopes" do
-    subject do
-      post password_token_endpoint_url(
-        client: @client,
-        resource_owner: @resource_owner,
-        scope: "random",
-      )
-    end
+      it "returns invalid_scope error" do
+        subject
 
-    it "should not issue new token" do
-      expect { subject }.to_not(change { Doorkeeper::AccessToken.count })
-    end
+        expect(json_response).to include(
+          "error" => "invalid_scope",
+          "error_description" => translated_error_message(:invalid_scope),
+        )
 
-    it "should return invalid_scope error" do
-      subject
-      should_have_json "error", "invalid_scope"
-      should_have_json "error_description", translated_error_message(:invalid_scope)
-      should_not_have_json "access_token"
+        expect(json_response).not_to include("access_token")
 
-      expect(response.status).to eq(400)
+        expect(response.status).to eq(400)
+      end
     end
-  end
 
-  context "with invalid user credentials" do
-    it "should not issue new token with bad password" do
-      expect do
-        post password_token_endpoint_url(
-          client: @client,
-          resource_owner_username: @resource_owner.name,
-          resource_owner_password: "wrongpassword",
-        )
-      end.to_not(change { Doorkeeper::AccessToken.count })
-    end
+    context "with invalid user credentials" do
+      it "doesn't issue new token with bad password" do
+        expect do
+          post password_token_endpoint_url(
+            client: @client,
+            resource_owner_username: @resource_owner.name,
+            resource_owner_password: "wrongpassword",
+          )
+        end.not_to(change { Doorkeeper::AccessToken.count })
+      end
 
-    it "should not issue new token without credentials" do
-      expect do
-        post password_token_endpoint_url(client: @client)
-      end.to_not(change { Doorkeeper::AccessToken.count })
-    end
+      it "doesn't issue new token without credentials" do
+        expect do
+          post password_token_endpoint_url(client: @client)
+        end.not_to(change { Doorkeeper::AccessToken.count })
+      end
 
-    it "should not issue new token if resource_owner_from_credentials returned false or nil" do
-      config_is_set(:resource_owner_from_credentials) { false }
+      it "doesn't issue new token if resource_owner_from_credentials returned false or nil" do
+        config_is_set(:resource_owner_from_credentials) { false }
 
-      expect do
-        post password_token_endpoint_url(client: @client)
-      end.to_not(change { Doorkeeper::AccessToken.count })
+        expect do
+          post password_token_endpoint_url(client: @client)
+        end.not_to(change { Doorkeeper::AccessToken.count })
 
-      config_is_set(:resource_owner_from_credentials) { nil }
+        config_is_set(:resource_owner_from_credentials) { nil }
 
-      expect do
-        post password_token_endpoint_url(client: @client)
-      end.to_not(change { Doorkeeper::AccessToken.count })
+        expect do
+          post password_token_endpoint_url(client: @client)
+        end.not_to(change { Doorkeeper::AccessToken.count })
+      end
     end
-  end
 
-  context "with invalid confidential client credentials" do
-    it "should not issue new token with bad client credentials" do
-      expect do
-        post password_token_endpoint_url(
-          client_id: @client.uid,
-          client_secret: "bad_secret",
-          resource_owner: @resource_owner,
-        )
-      end.to_not(change { Doorkeeper::AccessToken.count })
+    context "with invalid confidential client credentials" do
+      it "doesn't issue new token with bad client credentials" do
+        expect do
+          post password_token_endpoint_url(
+            client_id: @client.uid,
+            client_secret: "bad_secret",
+            resource_owner: @resource_owner,
+          )
+        end.not_to(change { Doorkeeper::AccessToken.count })
+      end
     end
-  end
 
-  context "with invalid public client id" do
-    it "should not issue new token with bad client id" do
-      expect do
-        post password_token_endpoint_url(client_id: "bad_id", resource_owner: @resource_owner)
-      end.to_not(change { Doorkeeper::AccessToken.count })
+    context "with invalid public client id" do
+      it "doesn't issue new token with bad client id" do
+        expect do
+          post password_token_endpoint_url(client_id: "bad_id", resource_owner: @resource_owner)
+        end.not_to(change { Doorkeeper::AccessToken.count })
+      end
     end
   end
 end