doorkeeper-sequel 1.2.1

data/spec/lib/oauth/helpers/uri_checker_spec.rb

@@ -0,0 +1,104 @@
+require 'spec_helper'
+require 'uri'
+require 'doorkeeper/oauth/helpers/uri_checker'
+
+module Doorkeeper::OAuth::Helpers
+  describe URIChecker do
+    describe '.valid?' do
+      it 'is valid for valid uris' do
+        uri = 'http://app.co'
+        expect(URIChecker.valid?(uri)).to be_truthy
+      end
+
+      it 'is valid if include path param' do
+        uri = 'http://app.co/path'
+        expect(URIChecker.valid?(uri)).to be_truthy
+      end
+
+      it 'is valid if include query param' do
+        uri = 'http://app.co/?query=1'
+        expect(URIChecker.valid?(uri)).to be_truthy
+      end
+
+      it 'is invalid if uri includes fragment' do
+        uri = 'http://app.co/test#fragment'
+        expect(URIChecker.valid?(uri)).to be_falsey
+      end
+
+      it 'is invalid if scheme is missing' do
+        uri = 'app.co'
+        expect(URIChecker.valid?(uri)).to be_falsey
+      end
+
+      it 'is invalid if is a relative uri' do
+        uri = '/abc/123'
+        expect(URIChecker.valid?(uri)).to be_falsey
+      end
+
+      it 'is invalid if is not a url' do
+        uri = 'http://'
+        expect(URIChecker.valid?(uri)).to be_falsey
+      end
+    end
+
+    describe '.matches?' do
+      it 'is true if both url matches' do
+        uri = client_uri = 'http://app.co/aaa'
+        expect(URIChecker.matches?(uri, client_uri)).to be_truthy
+      end
+
+      it 'ignores query parameter on comparsion' do
+        uri = 'http://app.co/?query=hello'
+        client_uri = 'http://app.co'
+        expect(URIChecker.matches?(uri, client_uri)).to be_truthy
+      end
+
+      it 'doesn\'t allow non-matching domains through' do
+        uri = 'http://app.abc/?query=hello'
+        client_uri = 'http://app.co'
+        expect(URIChecker.matches?(uri, client_uri)).to be_falsey
+      end
+
+      it 'doesn\'t allow non-matching domains that don\'t start at the beginning' do
+        uri = 'http://app.co/?query=hello'
+        client_uri = 'http://example.com?app.co=test'
+        expect(URIChecker.matches?(uri, client_uri)).to be_falsey
+      end
+    end
+
+    describe '.valid_for_authorization?' do
+      it 'is true if valid and matches' do
+        uri = client_uri = 'http://app.co/aaa'
+        expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_truthy
+      end
+
+      it 'is false if valid and mismatches' do
+        uri = 'http://app.co/aaa'
+        client_uri = 'http://app.co/bbb'
+        expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_falsey
+      end
+
+      it 'is true if valid and included in array' do
+        uri = 'http://app.co/aaa'
+        client_uri = "http://example.com/bbb\nhttp://app.co/aaa"
+        expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_truthy
+      end
+
+      it 'is false if valid and not included in array' do
+        uri = 'http://app.co/aaa'
+        client_uri = "http://example.com/bbb\nhttp://app.co/cc"
+        expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_falsey
+      end
+
+      it 'is true if valid and matches' do
+        uri = client_uri = 'http://app.co/aaa'
+        expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be true
+      end
+
+      it 'is false if invalid' do
+        uri = client_uri = 'http://app.co/aaa?waffles=abc'
+        expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be false
+      end
+    end
+  end
+end

data/spec/lib/oauth/invalid_token_response_spec.rb

@@ -0,0 +1,28 @@
+require 'spec_helper'
+require 'active_model'
+require 'doorkeeper'
+require 'doorkeeper/oauth/invalid_token_response'
+
+module Doorkeeper::OAuth
+  describe InvalidTokenResponse do
+    describe '#name' do
+      it  { expect(subject.name).to eq(:invalid_token) }
+    end
+
+    describe '#status' do
+      it { expect(subject.status).to eq(:unauthorized) }
+    end
+
+    describe :from_access_token do
+      it 'revoked' do
+        response = InvalidTokenResponse.from_access_token double(revoked?: true, expired?: true)
+        expect(response.description).to include('revoked')
+      end
+
+      it 'expired' do
+        response = InvalidTokenResponse.from_access_token double(revoked?: false, expired?: true)
+        expect(response.description).to include('expired')
+      end
+    end
+  end
+end

data/spec/lib/oauth/password_access_token_request_spec.rb

@@ -0,0 +1,90 @@
+require 'spec_helper_integration'
+
+module Doorkeeper::OAuth
+  describe PasswordAccessTokenRequest do
+    let(:server) do
+      double(
+        :server,
+        default_scopes: Doorkeeper::OAuth::Scopes.new,
+        access_token_expires_in: 2.hours,
+        refresh_token_enabled?: false,
+        custom_access_token_expires_in: ->(_app) { nil }
+      )
+    end
+    let(:client) { FactoryGirl.create(:application) }
+    let(:owner)  { double :owner, id: 99 }
+
+    subject do
+      PasswordAccessTokenRequest.new(server, client, owner)
+    end
+
+    it 'issues a new token for the client' do
+      expect do
+        subject.authorize
+      end.to change { client.reload.access_tokens.count }.by(1)
+    end
+
+    it 'issues a new token without a client' do
+      expect do
+        subject.client = nil
+        subject.authorize
+      end.to change { Doorkeeper::AccessToken.count }.by(1)
+    end
+
+    it 'does not issue a new token with an invalid client' do
+      expect do
+        subject.client = nil
+        subject.parameters = { client_id: 'bad_id' }
+        subject.authorize
+      end.to_not change { Doorkeeper::AccessToken.count }
+
+      expect(subject.error).to eq(:invalid_client)
+    end
+
+    it 'requires the owner' do
+      subject.resource_owner = nil
+      subject.validate
+      expect(subject.error).to eq(:invalid_grant)
+    end
+
+    it 'optionally accepts the client' do
+      subject.client = nil
+      expect(subject).to be_valid
+    end
+
+    it 'creates token even when there is already one (default)' do
+      FactoryGirl.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
+      expect do
+        subject.authorize
+      end.to change { Doorkeeper::AccessToken.count }.by(1)
+    end
+
+    it 'skips token creation if there is already one' do
+      allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
+      FactoryGirl.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
+      expect do
+        subject.authorize
+      end.to_not change { Doorkeeper::AccessToken.count }
+    end
+
+    describe 'with scopes' do
+      subject do
+        PasswordAccessTokenRequest.new(server, client, owner, scope: 'public')
+      end
+
+      it 'validates the current scope' do
+        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('another'))
+        subject.validate
+        expect(subject.error).to eq(:invalid_scope)
+      end
+
+      it 'creates the token with scopes' do
+        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('public'))
+        expect do
+          subject.authorize
+        end.to change { Doorkeeper::AccessToken.count }.by(1)
+        expect(Doorkeeper::AccessToken.last.scopes).to include('public')
+      end
+    end
+  end
+end

data/spec/lib/oauth/pre_authorization_spec.rb

@@ -0,0 +1,155 @@
+require 'spec_helper_integration'
+
+module Doorkeeper::OAuth
+  describe PreAuthorization do
+    let(:server) {
+      server = Doorkeeper.configuration
+      allow(server).to receive(:default_scopes).and_return(Scopes.new)
+      allow(server).to receive(:scopes).and_return(Scopes.from_string('public profile'))
+      server
+    }
+
+    let(:application) do
+      application = double :application
+      allow(application).to receive(:scopes).and_return(Scopes.from_string(''))
+      application
+    end
+
+    let(:client) do
+      double :client, redirect_uri: 'http://tst.com/auth', application: application
+    end
+
+    let :attributes do
+      {
+        response_type: 'code',
+        redirect_uri: 'http://tst.com/auth',
+        state: 'save-this'
+      }
+    end
+
+    subject do
+      PreAuthorization.new(server, client, attributes)
+    end
+
+    it 'is authorizable when request is valid' do
+      expect(subject).to be_authorizable
+    end
+
+    it 'accepts code as response type' do
+      subject.response_type = 'code'
+      expect(subject).to be_authorizable
+    end
+
+    it 'accepts token as response type' do
+      allow(server).to receive(:grant_flows).and_return(['implicit'])
+      subject.response_type = 'token'
+      expect(subject).to be_authorizable
+    end
+
+    context 'when using default grant flows' do
+      it 'accepts "code" as response type' do
+        subject.response_type = 'code'
+        expect(subject).to be_authorizable
+      end
+
+      it 'accepts "token" as response type' do
+        allow(server).to receive(:grant_flows).and_return(['implicit'])
+        subject.response_type = 'token'
+        expect(subject).to be_authorizable
+      end
+    end
+
+    context 'when authorization code grant flow is disabled' do
+      before do
+        allow(server).to receive(:grant_flows).and_return(['implicit'])
+      end
+
+      it 'does not accept "code" as response type' do
+        subject.response_type = 'code'
+        expect(subject).not_to be_authorizable
+      end
+    end
+
+    context 'when implicit grant flow is disabled' do
+      before do
+        allow(server).to receive(:grant_flows).and_return(['authorization_code'])
+      end
+
+      it 'does not accept "token" as response type' do
+        subject.response_type = 'token'
+        expect(subject).not_to be_authorizable
+      end
+    end
+
+    context 'client application does not restrict valid scopes' do
+      it 'accepts valid scopes' do
+        subject.scope = 'public'
+        expect(subject).to be_authorizable
+      end
+
+      it 'rejects (globally) non-valid scopes' do
+        subject.scope = 'invalid'
+        expect(subject).not_to be_authorizable
+      end
+    end
+
+    context 'client application restricts valid scopes' do
+      let(:application) do
+        application = double :application
+        allow(application).to receive(:scopes).and_return(Scopes.from_string('public nonsense'))
+        application
+      end
+
+      it 'accepts valid scopes' do
+        subject.scope = 'public'
+        expect(subject).to be_authorizable
+      end
+
+      it 'rejects (globally) non-valid scopes' do
+        subject.scope = 'invalid'
+        expect(subject).not_to be_authorizable
+      end
+
+      it 'rejects (application level) non-valid scopes' do
+        subject.scope = 'profile'
+        expect(subject).to_not be_authorizable
+      end
+    end
+
+    it 'uses default scopes when none is required' do
+      allow(server).to receive(:default_scopes).and_return(Scopes.from_string('default'))
+      subject.scope = nil
+      expect(subject.scope).to eq('default')
+      expect(subject.scopes).to eq(Scopes.from_string('default'))
+    end
+
+    it 'accepts test uri' do
+      subject.redirect_uri = 'urn:ietf:wg:oauth:2.0:oob'
+      expect(subject).to be_authorizable
+    end
+
+    it 'matches the redirect uri against client\'s one' do
+      subject.redirect_uri = 'http://nothesame.com'
+      expect(subject).not_to be_authorizable
+    end
+
+    it 'stores the state' do
+      expect(subject.state).to eq('save-this')
+    end
+
+    it 'rejects if response type is not allowed' do
+      subject.response_type = 'whops'
+      expect(subject).not_to be_authorizable
+    end
+
+    it 'requires an existing client' do
+      subject.client = nil
+      expect(subject).not_to be_authorizable
+    end
+
+    it 'requires a redirect uri' do
+      subject.redirect_uri = nil
+      expect(subject).not_to be_authorizable
+    end
+  end
+end

data/spec/lib/oauth/refresh_token_request_spec.rb

@@ -0,0 +1,154 @@
+require 'spec_helper_integration'
+
+module Doorkeeper::OAuth
+  describe RefreshTokenRequest do
+    before do
+      allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(false)
+    end
+    let(:server) do
+      double :server,
+             access_token_expires_in: 2.minutes,
+             custom_access_token_expires_in: -> (_oauth_client) { nil }
+    end
+    let(:refresh_token) do
+      FactoryGirl.create(:access_token, use_refresh_token: true)
+    end
+    let(:client) { refresh_token.application }
+    let(:credentials) { Client::Credentials.new(client.uid, client.secret) }
+
+    subject { RefreshTokenRequest.new server, refresh_token, credentials }
+
+    it 'issues a new token for the client' do
+      expect { subject.authorize }.to change { client.reload.access_tokens.count }.by(1)
+      expect(client.reload.access_tokens.last.expires_in).to eq(120)
+    end
+
+    it 'issues a new token for the client with custom expires_in' do
+      server = double :server,
+                      access_token_expires_in: 2.minutes,
+                      custom_access_token_expires_in: ->(_oauth_client) { 1234 }
+
+      allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(false)
+
+      RefreshTokenRequest.new(server, refresh_token, credentials).authorize
+
+      expect(client.reload.access_tokens.last.expires_in).to eq(1234)
+    end
+
+    it 'revokes the previous token' do
+      expect { subject.authorize }.to change { refresh_token.revoked? }.from(false).to(true)
+    end
+
+    it 'requires the refresh token' do
+      subject.refresh_token = nil
+      subject.validate
+      expect(subject.error).to eq(:invalid_request)
+    end
+
+    it 'requires credentials to be valid if provided' do
+      subject.client = nil
+      subject.validate
+      expect(subject.error).to eq(:invalid_client)
+    end
+
+    it "requires the token's client and current client to match" do
+      subject.client = FactoryGirl.create(:application)
+      subject.validate
+      expect(subject.error).to eq(:invalid_grant)
+    end
+
+    it 'rejects revoked tokens' do
+      refresh_token.revoke
+      subject.validate
+      expect(subject.error).to eq(:invalid_grant)
+    end
+
+    it 'accepts expired tokens' do
+      refresh_token.expires_in = -1
+      refresh_token.save
+      subject.validate
+      expect(subject).to be_valid
+    end
+
+    context 'refresh tokens expire on access token use' do
+      let(:server) do
+        double :server,
+               access_token_expires_in: 2.minutes,
+               custom_access_token_expires_in: ->(_oauth_client) { 1234 }
+      end
+
+      before do
+        allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(true)
+      end
+
+      it 'issues a new token for the client' do
+        expect { subject.authorize }.to change { client.reload.access_tokens.count }.by(1)
+      end
+
+      it 'does not revoke the previous token' do
+        subject.authorize
+        expect(refresh_token).not_to be_revoked
+      end
+
+      it 'sets the previous refresh token in the new access token' do
+        subject.authorize
+        expect(
+          client.access_tokens.last.previous_refresh_token
+        ).to eq(refresh_token.refresh_token)
+      end
+    end
+
+    context 'clientless access tokens' do
+      let!(:refresh_token) { FactoryGirl.create(:clientless_access_token, use_refresh_token: true) }
+
+      subject { RefreshTokenRequest.new server, refresh_token, nil }
+
+      it 'issues a new token without a client' do
+        expect { subject.authorize }.to change { Doorkeeper::AccessToken.count }.by(1)
+      end
+    end
+
+    context 'with scopes' do
+      let(:refresh_token) do
+        FactoryGirl.create :access_token,
+                           use_refresh_token: true,
+                           scopes: 'public write'
+      end
+      let(:parameters) { {} }
+      subject { RefreshTokenRequest.new server, refresh_token, credentials, parameters }
+
+      it 'transfers scopes from the old token to the new token' do
+        subject.authorize
+        expect(Doorkeeper::AccessToken.last.scopes).to eq([:public, :write])
+      end
+
+      it 'reduces scopes to the provided scopes' do
+        parameters[:scopes] = 'public'
+        subject.authorize
+        expect(Doorkeeper::AccessToken.last.scopes).to eq([:public])
+      end
+
+      it 'validates that scopes are included in the original access token' do
+        parameters[:scopes] = 'public update'
+
+        subject.validate
+        expect(subject.error).to eq(:invalid_scope)
+      end
+
+      it 'uses params[:scope] in favor of scopes if present (valid)' do
+        parameters[:scopes] = 'public update'
+        parameters[:scope] = 'public'
+        subject.authorize
+        expect(Doorkeeper::AccessToken.last.scopes).to eq([:public])
+      end
+
+      it 'uses params[:scope] in favor of scopes if present (invalid)' do
+        parameters[:scopes] = 'public'
+        parameters[:scope] = 'public update'
+
+        subject.validate
+        expect(subject.error).to eq(:invalid_scope)
+      end
+    end
+  end
+end

data/spec/lib/oauth/scopes_spec.rb

@@ -0,0 +1,122 @@
+require 'spec_helper'
+require 'active_support/core_ext/module/delegation'
+require 'active_support/core_ext/string'
+require 'doorkeeper/oauth/scopes'
+
+module Doorkeeper::OAuth
+  describe Scopes do
+    describe '#add' do
+      it 'allows you to add scopes with symbols' do
+        subject.add :public
+        expect(subject.all).to eq(['public'])
+      end
+
+      it 'allows you to add scopes with strings' do
+        subject.add 'public'
+        expect(subject.all).to eq(['public'])
+      end
+
+      it 'do not add already included scopes' do
+        subject.add :public
+        subject.add :public
+        expect(subject.all).to eq(['public'])
+      end
+    end
+
+    describe '#exists' do
+      before do
+        subject.add :public
+      end
+
+      it 'returns true if scope with given name is present' do
+        expect(subject.exists?('public')).to be_truthy
+      end
+
+      it 'returns false if scope with given name does not exist' do
+        expect(subject.exists?('other')).to be_falsey
+      end
+
+      it 'handles symbols' do
+        expect(subject.exists?(:public)).to be_truthy
+        expect(subject.exists?(:other)).to be_falsey
+      end
+    end
+
+    describe '.from_string' do
+      let(:string) { 'public write' }
+
+      subject { Scopes.from_string(string) }
+
+      it { expect(subject).to be_a(Scopes) }
+
+      describe '#all' do
+        it 'should be an array of the expected scopes' do
+          scopes_array = subject.all
+          expect(scopes_array.size).to eq(2)
+          expect(scopes_array).to include('public')
+          expect(scopes_array).to include('write')
+        end
+      end
+    end
+
+    describe '#+' do
+      it 'can add to another scope object' do
+        scopes = Scopes.from_string('public') + Scopes.from_string('admin')
+        expect(scopes.all).to eq(%w(public admin))
+      end
+
+      it 'does not change the existing object' do
+        origin = Scopes.from_string('public')
+        expect(origin.to_s).to eq('public')
+      end
+
+      it 'raises an error if cannot handle addition' do
+        expect do
+          Scopes.from_string('public') + 'admin'
+        end.to raise_error(NoMethodError)
+      end
+    end
+
+    describe '#==' do
+      it 'is equal to another set of scopes' do
+        expect(Scopes.from_string('public')).to eq(Scopes.from_string('public'))
+      end
+
+      it 'is equal to another set of scopes with no particular order' do
+        expect(Scopes.from_string('public write')).to eq(Scopes.from_string('write public'))
+      end
+
+      it 'differs from another set of scopes when scopes are not the same' do
+        expect(Scopes.from_string('public write')).not_to eq(Scopes.from_string('write'))
+      end
+    end
+
+    describe '#has_scopes?' do
+      subject { Scopes.from_string('public admin') }
+
+      it 'returns true when at least one scope is included' do
+        expect(subject.has_scopes?(Scopes.from_string('public'))).to be_truthy
+      end
+
+      it 'returns true when all scopes are included' do
+        expect(subject.has_scopes?(Scopes.from_string('public admin'))).to be_truthy
+      end
+
+      it 'is true if all scopes are included in any order' do
+        expect(subject.has_scopes?(Scopes.from_string('admin public'))).to be_truthy
+      end
+
+      it 'is false if no scopes are included' do
+        expect(subject.has_scopes?(Scopes.from_string('notexistent'))).to be_falsey
+      end
+
+      it 'returns false when any scope is not included' do
+        expect(subject.has_scopes?(Scopes.from_string('public nope'))).to be_falsey
+      end
+
+      it 'is false if no scopes are included even for existing ones' do
+        expect(subject.has_scopes?(Scopes.from_string('public admin notexistent'))).to be_falsey
+      end
+    end
+  end
+end