doorkeeper-mongodb 5.2.1 → 5.2.3

data/spec/requests/flows/refresh_token_spec.rb

@@ -2,7 +2,7 @@
 
 require "spec_helper"
 
-describe "Refresh Token Flow" do
+RSpec.describe "Refresh Token Flow" do
   before do
     Doorkeeper.configure do
       orm DOORKEEPER_ORM
@@ -14,7 +14,7 @@ describe "Refresh Token Flow" do
 
   let(:resource_owner) { FactoryBot.create(:resource_owner) }
 
-  context "issuing a refresh token" do
+  describe "issuing a refresh token" do
     before do
       authorization_code_exists application: @client,
                                 resource_owner_id: resource_owner.id,
@@ -26,23 +26,27 @@ describe "Refresh Token Flow" do
 
       token = Doorkeeper::AccessToken.first
 
-      should_have_json "access_token",  token.token
-      should_have_json "refresh_token", token.refresh_token
+      expect(json_response).to include(
+        "access_token" => token.token,
+        "refresh_token" => token.refresh_token,
+      )
 
       expect(@authorization.reload).to be_revoked
 
       post refresh_token_endpoint_url(client: @client, refresh_token: token.refresh_token)
 
       new_token = Doorkeeper::AccessToken.last
-      should_have_json "access_token",  new_token.token
-      should_have_json "refresh_token", new_token.refresh_token
+      expect(json_response).to include(
+        "access_token" => new_token.token,
+        "refresh_token" => new_token.refresh_token,
+      )
 
-      expect(token.token).not_to         eq(new_token.token)
+      expect(token.token).not_to eq(new_token.token)
       expect(token.refresh_token).not_to eq(new_token.refresh_token)
     end
   end
 
-  context "refreshing the token" do
+  describe "refreshing the token" do
     before do
       @token = FactoryBot.create(
         :access_token,
@@ -53,30 +57,30 @@ describe "Refresh Token Flow" do
       )
     end
 
-    context "refresh_token revoked on use" do
-      it "client request a token with refresh token" do
+    context "when refresh_token revoked on use" do
+      it "client requests a token with refresh token" do
         post refresh_token_endpoint_url(
           client: @client, refresh_token: @token.refresh_token,
         )
-        should_have_json(
-          "refresh_token", Doorkeeper::AccessToken.last.refresh_token,
+        expect(json_response).to include(
+          "refresh_token" => Doorkeeper::AccessToken.last.refresh_token,
         )
         expect(@token.reload).not_to be_revoked
       end
 
-      it "client request a token with expired access token" do
+      it "client requests a token with expired access token" do
         @token.update_attribute :expires_in, -100
         post refresh_token_endpoint_url(
           client: @client, refresh_token: @token.refresh_token,
         )
-        should_have_json(
-          "refresh_token", Doorkeeper::AccessToken.last.refresh_token,
+        expect(json_response).to include(
+          "refresh_token" => Doorkeeper::AccessToken.last.refresh_token,
         )
         expect(@token.reload).not_to be_revoked
       end
     end
 
-    context "refresh_token revoked on refresh_token request" do
+    context "when refresh_token revoked on refresh_token request" do
       before do
         allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(false)
       end
@@ -85,8 +89,8 @@ describe "Refresh Token Flow" do
         post refresh_token_endpoint_url(
           client: @client, refresh_token: @token.refresh_token,
         )
-        should_have_json(
-          "refresh_token", Doorkeeper::AccessToken.last.refresh_token,
+        expect(json_response).to include(
+          "refresh_token" => Doorkeeper::AccessToken.last.refresh_token,
         )
         expect(@token.reload).to be_revoked
       end
@@ -96,14 +100,14 @@ describe "Refresh Token Flow" do
         post refresh_token_endpoint_url(
           client: @client, refresh_token: @token.refresh_token,
         )
-        should_have_json(
-          "refresh_token", Doorkeeper::AccessToken.last.refresh_token,
+        expect(json_response).to include(
+          "refresh_token" => Doorkeeper::AccessToken.last.refresh_token,
         )
         expect(@token.reload).to be_revoked
       end
     end
 
-    context "public & private clients" do
+    context "with public & private clients" do
       let(:public_client) do
         FactoryBot.create(
           :application,
@@ -138,15 +142,16 @@ describe "Refresh Token Flow" do
         )
 
         new_token = Doorkeeper::AccessToken.last
-        should_have_json "access_token",  new_token.token
-        should_have_json "refresh_token", new_token.refresh_token
+        expect(json_response).to include(
+          "access_token" => new_token.token,
+          "refresh_token" => new_token.refresh_token,
+        )
       end
 
       it "returns an error without credentials" do
         post refresh_token_endpoint_url(refresh_token: token_for_private_client.refresh_token)
 
-        should_not_have_json "refresh_token"
-        should_have_json "error", "invalid_grant"
+        expect(json_response).to include("error" => "invalid_grant")
       end
 
       it "returns an error with wrong credentials" do
@@ -155,35 +160,44 @@ describe "Refresh Token Flow" do
           client_secret: "1",
           refresh_token: token_for_private_client.refresh_token,
         )
-
-        should_not_have_json "refresh_token"
-        should_have_json "error", "invalid_client"
+        expect(json_response).to match(
+          "error" => "invalid_client",
+          "error_description" => an_instance_of(String),
+        )
       end
     end
 
     it "client gets an error for invalid refresh token" do
       post refresh_token_endpoint_url(client: @client, refresh_token: "invalid")
-      should_not_have_json "refresh_token"
-      should_have_json "error", "invalid_grant"
+
+      expect(json_response).to match(
+        "error" => "invalid_grant",
+        "error_description" => an_instance_of(String),
+      )
     end
 
     it "client gets an error for revoked access token" do
       @token.revoke
       post refresh_token_endpoint_url(client: @client, refresh_token: @token.refresh_token)
-      should_not_have_json "refresh_token"
-      should_have_json "error", "invalid_grant"
+
+      expect(json_response).to match(
+        "error" => "invalid_grant",
+        "error_description" => an_instance_of(String),
+      )
     end
 
     it "second of simultaneous client requests get an error for revoked access token" do
       allow_any_instance_of(Doorkeeper::AccessToken).to receive(:revoked?).and_return(false, true)
       post refresh_token_endpoint_url(client: @client, refresh_token: @token.refresh_token)
 
-      should_not_have_json "refresh_token"
-      should_have_json "error", "invalid_grant"
+      expect(json_response).to match(
+        "error" => "invalid_grant",
+        "error_description" => an_instance_of(String),
+      )
     end
   end
 
-  context "refreshing the token with multiple sessions (devices)" do
+  context "when refreshing the token with multiple sessions (devices)" do
     before do
       # enable password auth to simulate other devices
       config_is_set(:grant_flows, ["password"])
@@ -206,18 +220,18 @@ describe "Refresh Token Flow" do
       @token.update_attribute :expires_in, -100
     end
 
-    context "refresh_token revoked on use" do
+    context "when refresh_token revoked on use" do
       it "client request a token after creating another token with the same user" do
         post refresh_token_endpoint_url(
           client: @client, refresh_token: @token.refresh_token,
         )
 
-        should_have_json "refresh_token", last_token.refresh_token
+        expect(json_response).to include("refresh_token" => last_token.refresh_token)
         expect(@token.reload).not_to be_revoked
       end
     end
 
-    context "refresh_token revoked on refresh_token request" do
+    context "when refresh_token revoked on refresh_token request" do
       before do
         allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(false)
       end
@@ -227,7 +241,7 @@ describe "Refresh Token Flow" do
           client: @client, refresh_token: @token.refresh_token,
         )
 
-        should_have_json "refresh_token", last_token.refresh_token
+        expect(json_response).to include("refresh_token" => last_token.refresh_token)
         expect(@token.reload).to be_revoked
       end
     end

data/spec/requests/flows/revoke_token_spec.rb

@@ -2,7 +2,7 @@
 
 require "spec_helper"
 
-describe "Revoke Token Flow" do
+RSpec.describe "Revoke Token Flow" do
   before do
     Doorkeeper.configure { orm DOORKEEPER_ORM }
   end
@@ -29,22 +29,22 @@ describe "Revoke Token Flow" do
       { "HTTP_AUTHORIZATION" => "Basic #{credentials}" }
     end
 
-    it "should revoke the access token provided" do
+    it "revokes the access token provided" do
       post revocation_token_endpoint_url, params: { token: access_token.token }, headers: headers
 
       expect(response).to be_successful
-      expect(access_token.reload.revoked?).to be_truthy
+      expect(access_token.reload).to be_revoked
     end
 
-    it "should revoke the refresh token provided" do
+    it "revokes the refresh token provided" do
       post revocation_token_endpoint_url, params: { token: access_token.refresh_token }, headers: headers
 
       expect(response).to be_successful
-      expect(access_token.reload.revoked?).to be_truthy
+      expect(access_token.reload).to be_revoked
     end
 
     context "with invalid token to revoke" do
-      it "should not revoke any tokens and must respond with success" do
+      it "does not revoke any tokens and must respond with success" do
         expect do
           post revocation_token_endpoint_url,
                params: { token: "I_AM_AN_INVALID_TOKEN" },
@@ -62,24 +62,24 @@ describe "Revoke Token Flow" do
         { "HTTP_AUTHORIZATION" => "Basic #{credentials}" }
       end
 
-      it "should not revoke any tokens and respond with forbidden" do
+      it "does not revoke any tokens and respond with forbidden" do
         post revocation_token_endpoint_url, params: { token: access_token.token }, headers: headers
 
         expect(response).to be_forbidden
         expect(response.body).to include("unauthorized_client")
         expect(response.body).to include(I18n.t("doorkeeper.errors.messages.revoke.unauthorized"))
-        expect(access_token.reload.revoked?).to be_falsey
+        expect(access_token.reload).not_to be_revoked
       end
     end
 
     context "with no credentials and a valid token" do
-      it "should not revoke any tokens and respond with forbidden" do
+      it "does not revoke any tokens and respond with forbidden" do
         post revocation_token_endpoint_url, params: { token: access_token.token }
 
         expect(response).to be_forbidden
         expect(response.body).to include("unauthorized_client")
         expect(response.body).to include(I18n.t("doorkeeper.errors.messages.revoke.unauthorized"))
-        expect(access_token.reload.revoked?).to be_falsey
+        expect(access_token.reload).not_to be_revoked
       end
     end
 
@@ -92,13 +92,13 @@ describe "Revoke Token Flow" do
         { "HTTP_AUTHORIZATION" => "Basic #{credentials}" }
       end
 
-      it "should not revoke the token as it's unauthorized" do
+      it "does not revoke the token as it's unauthorized" do
         post revocation_token_endpoint_url, params: { token: access_token.token }, headers: headers
 
         expect(response).to be_forbidden
         expect(response.body).to include("unauthorized_client")
         expect(response.body).to include(I18n.t("doorkeeper.errors.messages.revoke.unauthorized"))
-        expect(access_token.reload.revoked?).to be_falsey
+        expect(access_token.reload).not_to be_revoked
       end
     end
   end
@@ -114,25 +114,25 @@ describe "Revoke Token Flow" do
       )
     end
 
-    it "should revoke the access token provided" do
+    it "revokes the access token provided" do
       post revocation_token_endpoint_url,
            params: { client_id: public_client_application.uid, token: access_token.token },
            headers: headers
 
       expect(response).to be_successful
-      expect(access_token.reload.revoked?).to be_truthy
+      expect(access_token.reload).to be_revoked
     end
 
-    it "should revoke the refresh token provided" do
+    it "revokes the refresh token provided" do
       post revocation_token_endpoint_url,
            params: { client_id: public_client_application.uid, token: access_token.refresh_token },
            headers: headers
 
       expect(response).to be_successful
-      expect(access_token.reload.revoked?).to be_truthy
+      expect(access_token.reload).to be_revoked
     end
 
-    it "should response with success even for invalid token" do
+    it "responses with success even for invalid token" do
       post revocation_token_endpoint_url,
            params: { client_id: public_client_application.uid, token: "dont_exist" },
            headers: headers
@@ -151,24 +151,24 @@ describe "Revoke Token Flow" do
         )
       end
 
-      it "should not revoke the access token provided" do
+      it "does not revoke the access token provided" do
         post revocation_token_endpoint_url,
              params: { client_id: public_client_application.uid, token: access_token.token }
 
         expect(response).to be_forbidden
         expect(response.body).to include("unauthorized_client")
         expect(response.body).to include(I18n.t("doorkeeper.errors.messages.revoke.unauthorized"))
-        expect(access_token.reload.revoked?).to be_falsey
+        expect(access_token.reload).not_to be_revoked
       end
 
-      it "should not revoke the refresh token provided" do
+      it "does not revoke the refresh token provided" do
         post revocation_token_endpoint_url,
-             params: { client_id: public_client_application.uid, token: access_token.token }
+             params: { client_id: public_client_application.uid, token: access_token.refresh_token }
 
         expect(response).to be_forbidden
         expect(response.body).to include("unauthorized_client")
         expect(response.body).to include(I18n.t("doorkeeper.errors.messages.revoke.unauthorized"))
-        expect(access_token.reload.revoked?).to be_falsey
+        expect(access_token.reload).not_to be_revoked
       end
     end
   end
@@ -184,13 +184,13 @@ describe "Revoke Token Flow" do
       )
     end
 
-    it "shouldn't remove the token and must response with an error" do
+    it "does not remove the token and responses with an error" do
       post revocation_token_endpoint_url,
            params: { token: access_token.token },
            headers: headers
 
       expect(response).not_to be_successful
-      expect(access_token.reload.revoked?).to be_falsey
+      expect(access_token.reload).not_to be_revoked
     end
   end
 end

data/spec/requests/flows/skip_authorization_spec.rb

@@ -10,7 +10,7 @@ feature "Skip authorization form" do
     optional_scopes_exist :write
   end
 
-  context "for previously authorized clients" do
+  context "with previously authorized clients" do
     background do
       create_resource_owner
       sign_in

data/spec/requests/protected_resources/metal_spec.rb

@@ -2,7 +2,7 @@
 
 require "spec_helper"
 
-describe "ActionController::Metal API" do
+RSpec.describe "ActionController::Metal API" do
   before do
     @client   = FactoryBot.create(:application)
     @resource = User.create!(name: "Joe", password: "sekret")
@@ -11,6 +11,6 @@ describe "ActionController::Metal API" do
 
   it "client requests protected resource with valid token" do
     get "/metal.json?access_token=#{@token.token}"
-    should_have_json "ok", true
+    expect(json_response).to include("ok" => true)
   end
 end

data/spec/routing/custom_controller_routes_spec.rb

@@ -2,7 +2,7 @@
 
 require "spec_helper"
 
-describe "Custom controller for routes" do
+RSpec.describe "Custom controller for routes" do
   before :all do
     Doorkeeper.configure do
       orm DOORKEEPER_ORM

data/spec/routing/default_routes_spec.rb

@@ -2,7 +2,7 @@
 
 require "spec_helper"
 
-describe "Default routes" do
+RSpec.describe "Default routes" do
   it "GET /oauth/authorize routes to authorizations controller" do
     expect(get("/oauth/authorize")).to route_to("doorkeeper/authorizations#new")
   end

data/spec/routing/scoped_routes_spec.rb

@@ -2,7 +2,7 @@
 
 require "spec_helper"
 
-describe "Scoped routes" do
+RSpec.describe "Scoped routes" do
   before :all do
     Rails.application.routes.disable_clear_and_finalize = true
 

data/spec/support/helpers/request_spec_helper.rb

@@ -14,7 +14,7 @@ module RequestSpecHelper
   end
 
   def i_should_be_on(path)
-    expect(current_path).to eq(path)
+    expect(page).to have_current_path(path, ignore_query: true)
   end
 
   def url_should_have_param(param, value)
@@ -61,18 +61,6 @@ module RequestSpecHelper
     ActionController::HttpAuthentication::Basic.encode_credentials client.uid, client.secret
   end
 
-  def should_have_json(key, value)
-    expect(json_response.fetch(key)).to eq(value)
-  end
-
-  def should_have_json_within(key, value, range)
-    expect(json_response.fetch(key)).to be_within(range).of(value)
-  end
-
-  def should_not_have_json(key)
-    expect(json_response).not_to have_key(key)
-  end
-
   def sign_in
     visit "/"
     click_on "Sign in"

data/spec/support/helpers/url_helper.rb

@@ -23,7 +23,7 @@ module UrlHelper
       password: options[:resource_owner_password] || options[:resource_owner].try(:password),
       scope: options[:scope],
       grant_type: "password",
-    }
+    }.reject { |_, v| v.blank? }
     "/oauth/token?#{build_query(parameters)}"
   end
 
@@ -46,7 +46,7 @@ module UrlHelper
       client_id: options[:client_id] || options[:client].try(:uid),
       client_secret: options[:client_secret] || options[:client].try(:secret),
       grant_type: options[:grant_type] || "refresh_token",
-    }
+    }.reject { |_, v| v.blank? }
     "/oauth/token?#{build_query(parameters)}"
   end
 

data/spec/support/orm/mongoid4.rb

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-require_relative "mongoid.rb"
+require_relative "mongoid"

data/spec/support/orm/mongoid5.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "mongoid.rb"
+require_relative "mongoid"
 
 Mongoid.logger.level = Logger::ERROR
 Mongo::Logger.logger.level = Logger::ERROR

data/spec/support/orm/mongoid6.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "mongoid.rb"
+require_relative "mongoid"
 
 Mongoid.logger.level = Logger::ERROR
 Mongo::Logger.logger.level = Logger::ERROR

data/spec/support/orm/mongoid7.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "mongoid.rb"
+require_relative "mongoid"
 
 Mongoid.logger.level = Logger::ERROR
 Mongo::Logger.logger.level = Logger::ERROR

data/spec/support/shared/controllers_shared_context.rb

@@ -11,7 +11,7 @@ shared_context "valid token", token: :valid do
     )
   end
 
-  before :each do
+  before do
     allow(
       Doorkeeper::AccessToken,
     ).to receive(:by_token).with(token_string).and_return(token)
@@ -30,46 +30,13 @@ shared_context "invalid token", token: :invalid do
     )
   end
 
-  before :each do
+  before do
     allow(
       Doorkeeper::AccessToken,
     ).to receive(:by_token).with(token_string).and_return(token)
   end
 end
 
-shared_context "authenticated resource owner" do
-  before do
-    user = double(:resource, id: 1)
-    allow(Doorkeeper.config).to receive(:authenticate_resource_owner) { proc { user } }
-  end
-end
-
-shared_context "not authenticated resource owner" do
-  before do
-    allow(Doorkeeper.config).to receive(:authenticate_resource_owner) { proc { redirect_to "/" } }
-  end
-end
-
-shared_context "valid authorization request" do
-  let :authorization do
-    double(:authorization, valid?: true, authorize: true, success_redirect_uri: "http://something.com/cb?code=token")
-  end
-
-  before do
-    allow(controller).to receive(:authorization) { authorization }
-  end
-end
-
-shared_context "invalid authorization request" do
-  let :authorization do
-    double(:authorization, valid?: false, authorize: false, redirect_on_error?: false)
-  end
-
-  before do
-    allow(controller).to receive(:authorization) { authorization }
-  end
-end
-
 shared_context "expired token", token: :expired do
   let :token_string do
     "1A2B3C4DEXP"
@@ -84,7 +51,7 @@ shared_context "expired token", token: :expired do
     )
   end
 
-  before :each do
+  before do
     allow(
       Doorkeeper::AccessToken,
     ).to receive(:by_token).with(token_string).and_return(token)
@@ -105,7 +72,7 @@ shared_context "revoked token", token: :revoked do
     )
   end
 
-  before :each do
+  before do
     allow(
       Doorkeeper::AccessToken,
     ).to receive(:by_token).with(token_string).and_return(token)
@@ -125,7 +92,7 @@ shared_context "forbidden token", token: :forbidden do
     )
   end
 
-  before :each do
+  before do
     allow(
       Doorkeeper::AccessToken,
     ).to receive(:by_token).with(token_string).and_return(token)

data/spec/support/shared/hashing_shared_context.rb

@@ -7,6 +7,7 @@ shared_context "with token hashing enabled" do
 
   before do
     Doorkeeper.configure do
+      orm DOORKEEPER_ORM
       hash_token_secrets
     end
   end
@@ -19,6 +20,7 @@ shared_context "with token hashing and fallback lookup enabled" do
 
   before do
     Doorkeeper.configure do
+      orm DOORKEEPER_ORM
       hash_token_secrets fallback: :plain
     end
   end
@@ -28,8 +30,10 @@ shared_context "with application hashing enabled" do
   let(:hashed_or_plain_token_func) do
     Doorkeeper::SecretStoring::Sha256Hash.method(:transform_secret)
   end
+
   before do
     Doorkeeper.configure do
+      orm DOORKEEPER_ORM
       hash_application_secrets
     end
   end