doorkeeper 0.3.0 → 0.4.0

data/spec/controllers/protected_resources_controller_spec.rb

@@ -0,0 +1,308 @@
+require 'spec_helper_integration'
+
+module ControllerActions
+  def index
+    render :text => "index"
+  end
+
+  def show
+    render :text => "show"
+  end
+end
+
+shared_examples "specified for particular actions" do
+  context "with valid token", :token => :valid do
+    it "allows into index action" do
+      get :index, :access_token => token_string
+      response.should be_success
+    end
+
+    it "allows into show action" do
+      get :show, :id => "3", :access_token => token_string
+      response.should be_success
+    end
+  end
+
+  context "with invalid token", :token => :invalid do
+    include_context "invalid token"
+
+    it "does not allow into index action" do
+      get :index, :access_token => token_string
+      response.status.should == 401
+    end
+
+    it "allows into show action" do
+      get :show, :id => "5", :access_token => token_string
+      response.should be_success
+    end
+  end
+end
+
+shared_examples "specified with except" do
+  context "with valid token", :token => :valid do
+    it "allows into index action" do
+      get :index, :access_token => token_string
+      response.should be_success
+    end
+
+    it "allows into show action" do
+      get :show, :id => "4", :access_token => token_string
+      response.should be_success
+    end
+  end
+
+  context "with invalid token", :token => :invalid do
+    it "allows into index action" do
+      get :index, :access_token => token_string
+      response.should be_success
+    end
+
+    it "does not allow into show action" do
+      get :show, :id => "14", :access_token => token_string
+      response.status.should == 401
+    end
+  end
+end
+
+describe "Doorkeeper_for helper" do
+  context "accepts token code specified as" do
+    controller do
+      doorkeeper_for :all
+
+      def index
+        render :text => "index"
+      end
+    end
+
+    let :token_string do
+      "1A2BC3"
+    end
+
+    it "access_token param" do
+      Doorkeeper::AccessToken.should_receive(:find_by_token).with(token_string)
+      get :index, :access_token => token_string
+    end
+
+    it "bearer_token param" do
+      Doorkeeper::AccessToken.should_receive(:find_by_token).with(token_string)
+      get :index, :bearer_token => token_string
+    end
+
+    it "Authorization header" do
+      Doorkeeper::AccessToken.should_receive(:find_by_token).with(token_string)
+      request.env["HTTP_AUTHORIZATION"] = "Bearer #{token_string}"
+      get :index
+    end
+
+    it "different kind of Authorization header" do
+      Doorkeeper::AccessToken.should_not_receive(:find_by_token)
+      request.env["HTTP_AUTHORIZATION"] = "Basic #{Base64.encode64("foo:bar")}"
+      get :index
+    end
+
+    it "doesn't change Authorization header value" do
+      Doorkeeper::AccessToken.should_receive(:find_by_token).exactly(2).times
+      request.env["HTTP_AUTHORIZATION"] = "Bearer #{token_string}"
+      get :index
+      get :index
+    end
+  end
+
+  context "defined for all actions" do
+    controller do
+      doorkeeper_for :all
+
+      include ControllerActions
+    end
+
+    context "with valid token", :token => :valid do
+      it "allows into index action" do
+        get :index, :access_token => token_string
+        response.should be_success
+      end
+
+      it "allows into show action" do
+        get :show, :id => "4", :access_token => token_string
+        response.should be_success
+      end
+    end
+
+    context "with invalid token", :token => :invalid do
+      it "does not allow into index action" do
+        get :index, :access_token => token_string
+        response.status.should == 401
+      end
+
+      it "does not allow into show action" do
+        get :show, :id => "4", :access_token => token_string
+        response.status.should == 401
+      end
+    end
+  end
+
+  context "defined only for index action" do
+    controller do
+      doorkeeper_for :index
+
+      include ControllerActions
+    end
+    include_examples "specified for particular actions"
+  end
+
+  context "defined for actions except index" do
+    controller do
+      doorkeeper_for :all, :except => :index
+
+      include ControllerActions
+    end
+
+    include_examples "specified with except"
+  end
+
+  context "defined with scopes" do
+    controller do
+      doorkeeper_for :all, :scopes => [:write]
+
+      include ControllerActions
+    end
+
+    let :token_string do
+      "1A2DUWE"
+    end
+
+    it "allows if the token has particular scopes" do
+      token = double(Doorkeeper::AccessToken, :accessible? => true, :scopes => [:write, :public])
+      Doorkeeper::AccessToken.should_receive(:find_by_token).with(token_string).and_return(token)
+      get :index, :access_token => token_string
+      response.should be_success
+    end
+
+    it "does not allow if the token does not include given scope" do
+      token = double(Doorkeeper::AccessToken, :accessible? => true, :scopes => [:public])
+      Doorkeeper::AccessToken.should_receive(:find_by_token).with(token_string).and_return(token)
+      get :index, :access_token => token_string
+      response.status.should == 401
+    end
+  end
+
+  context "when custom unauthorized render options are configured" do
+    controller do
+      doorkeeper_for :all
+
+      include ControllerActions
+    end
+
+    context "with a JSON custom render", :token => :invalid do
+      before do
+        controller.should_receive(:doorkeeper_unauthorized_render_options).and_return({ :json => ActiveSupport::JSON.encode({ :error => "Unauthorized" })  } )
+      end
+
+      it "it renders a custom JSON response", :token => :invalid do
+        get :index, :access_token => token_string
+        response.status.should == 401
+        response.content_type.should == 'application/json'
+        parsed_body = JSON.parse(response.body)
+        parsed_body.should_not be_nil
+        parsed_body['error'].should == 'Unauthorized'
+      end
+
+    end
+
+    context "with a text custom render", :token => :invalid do
+      before do
+        controller.should_receive(:doorkeeper_unauthorized_render_options).and_return({ :text => "Unauthorized"  } )
+      end
+
+      it "it renders a custom JSON response", :token => :invalid do
+        get :index, :access_token => token_string
+        response.status.should == 401
+        response.content_type.should == 'text/html'
+        response.body.should == 'Unauthorized'
+      end
+    end
+  end
+
+  context "when defined with conditional if block" do
+    controller do
+      doorkeeper_for :index, :if => lambda { the_false }
+      doorkeeper_for :show, :if => lambda { the_true }
+
+      include ControllerActions
+
+      private
+      def the_true
+        true
+      end
+
+      def the_false
+        false
+      end
+    end
+
+    context "with valid token", :token => :valid do
+      it "enables access if passed block evaluates to false" do
+        get :index, :access_token => token_string
+        response.should be_success
+      end
+
+      it "enables access if passed block evaluates to true" do
+        get :show, :id => 1, :access_token => token_string
+        response.should be_success
+      end
+    end
+
+    context "with invalid token", :token => :invalid do
+      it "enables access if passed block evaluates to false" do
+        get :index, :access_token => token_string
+        response.should be_success
+      end
+
+      it "does not enable access if passed block evaluates to true" do
+        get :show, :id => 3, :access_token => token_string
+        response.status.should == 401
+      end
+    end
+  end
+
+  context "when defined with conditional unless block" do
+    controller do
+      doorkeeper_for :index, :unless => lambda { the_false }
+      doorkeeper_for :show, :unless => lambda { the_true }
+
+      include ControllerActions
+
+      def the_true
+        true
+      end
+
+      private
+
+      def the_false
+        false
+      end
+    end
+
+    context "with valid token", :token => :valid do
+      it "allows access if passed block evaluates to false" do
+        get :index, :access_token => token_string
+        response.should be_success
+      end
+
+      it "allows access if passed block evaluates to true" do
+        get :show, :id => 1, :access_token => token_string
+        response.should be_success
+      end
+    end
+
+    context "with invalid token", :token => :invalid do
+      it "does not allow access if passed block evaluates to false" do
+        get :index, :access_token => token_string
+      end
+
+      it "allows access if passed block evaluates to true" do
+        get :show, :id => 3, :access_token => token_string
+        response.should be_success
+      end
+    end
+  end
+end

data/spec/controllers/tokens_controller_spec.rb

@@ -0,0 +1,34 @@
+require 'spec_helper_integration'
+
+describe Doorkeeper::TokensController do
+  describe "when authorization has succeeded" do
+    let :token do
+      double(:token, :authorize => true)
+    end
+
+    before do
+      controller.stub(:token) { token }
+    end
+
+    it "returns the authorization" do
+      token.should_receive(:authorization)
+      post :create, :use_route => :doorkeeper
+    end
+  end
+
+  describe "when authorization has failed" do
+    let :token do
+      double(:token, :authorize => false)
+    end
+
+    before do
+      controller.stub(:token) { token }
+    end
+
+    it "returns the error response" do
+      token.stub(:error_response => stub(:to_json => [], :status => :unauthorized))
+      post :create, :use_route => :doorkeeper
+      response.status.should == 401
+    end
+  end
+end

data/spec/dummy/Rakefile

@@ -0,0 +1,7 @@
+#!/usr/bin/env rake
+# Add your own tasks in files placed in lib/tasks ending in .rake,
+# for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.
+
+require File.expand_path('../config/application', __FILE__)
+
+Dummy::Application.load_tasks

data/spec/dummy/app/assets/javascripts/application.js

@@ -0,0 +1,9 @@
+// This is a manifest file that'll be compiled into including all the files listed below.
+// Add new JavaScript/Coffee code in separate files in this directory and they'll automatically
+// be included in the compiled file accessible from http://example.com/assets/application.js
+// It's not advisable to add code directly here, but if you do, it'll appear at the bottom of the
+// the compiled file.
+//
+//= require jquery
+//= require jquery_ujs
+//= require_tree .

data/spec/dummy/app/assets/stylesheets/application.css

@@ -0,0 +1,7 @@
+/*
+ * This is a manifest file that'll automatically include all the stylesheets available in this directory
+ * and any sub-directories. You're free to add application-wide styles to this file and they'll appear at
+ * the top of the compiled file, but it's generally better to create a new file per style scope.
+ *= require_self
+ *= require_tree . 
+*/

data/spec/dummy/app/controllers/application_controller.rb

@@ -0,0 +1,3 @@
+class ApplicationController < ActionController::Base
+  protect_from_forgery
+end

data/spec/dummy/app/controllers/full_protected_resources_controller.rb

@@ -0,0 +1,12 @@
+class FullProtectedResourcesController < ApplicationController
+  doorkeeper_for :index
+  doorkeeper_for :show, :scopes => [:admin]
+
+  def index
+    render :text => "index"
+  end
+
+  def show
+    render :text => "show"
+  end
+end

data/spec/dummy/app/controllers/home_controller.rb

@@ -0,0 +1,17 @@
+class HomeController < ApplicationController
+  def index
+  end
+
+  def sign_in
+    session[:user_id] = if Rails.env.development?
+      User.first || User.create!(:name => "Joe", :password => "sekret")
+    else
+      User.first
+    end
+    redirect_to '/'
+  end
+
+  def callback
+    render :text => "ok"
+  end
+end

data/spec/dummy/app/controllers/semi_protected_resources_controller.rb

@@ -0,0 +1,11 @@
+class SemiProtectedResourcesController < ApplicationController
+  doorkeeper_for :index
+
+  def index
+    render :text => "protected index"
+  end
+
+  def show
+    render :text => "protected show"
+  end
+end

data/spec/dummy/app/helpers/application_helper.rb

@@ -0,0 +1,5 @@
+module ApplicationHelper
+  def current_user
+    @current_user ||= User.find_by_id(session[:user_id])
+  end
+end

data/spec/dummy/app/models/user.rb

@@ -0,0 +1,11 @@
+class User < ActiveRecord::Base
+  has_secure_password
+  validates_presence_of :password, :on => :create
+
+  attr_accessible :name, :password
+
+  def self.authenticate!(name, password)
+    owner = User.find_by_name(name)
+    owner.authenticate(password) if owner
+  end
+end

data/spec/dummy/app/views/layouts/application.html.erb

@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Dummy</title>
+  <%= stylesheet_link_tag    "application" %>
+  <%= javascript_include_tag "application" %>
+  <%= csrf_meta_tags %>
+</head>
+<body>
+
+<%= link_to "Sign in", '/sign_in' %>
+
+<%= yield %>
+
+</body>
+</html>

data/spec/dummy/config/application.rb

@@ -0,0 +1,53 @@
+require File.expand_path('../boot', __FILE__)
+
+# Pick the frameworks you want:
+require "active_record/railtie"
+require "action_controller/railtie"
+# require "action_mailer/railtie"
+require "active_resource/railtie"
+require "sprockets/railtie"
+# require "rails/test_unit/railtie"
+
+Bundler.require
+require "doorkeeper"
+
+module Dummy
+  class Application < Rails::Application
+    # Settings in config/environments/* take precedence over those specified here.
+    # Application configuration should go into files in config/initializers
+    # -- all .rb files in that directory are automatically loaded.
+
+    # Custom directories with classes and modules you want to be autoloadable.
+    # config.autoload_paths += %W(#{config.root}/extras)
+
+    # Only load the plugins named here, in the order given (default is alphabetical).
+    # :all can be used as a placeholder for all plugins not explicitly named.
+    # config.plugins = [ :exception_notification, :ssl_requirement, :all ]
+
+    # Activate observers that should always be running.
+    # config.active_record.observers = :cacher, :garbage_collector, :forum_observer
+
+    config.active_record.whitelist_attributes = true
+
+    # Set Time.zone default to the specified zone and make Active Record auto-convert to this zone.
+    # Run "rake -D time" for a list of tasks for finding time zone names. Default is UTC.
+    # config.time_zone = 'Central Time (US & Canada)'
+
+    # The default locale is :en and all translations from config/locales/*.rb,yml are auto loaded.
+    config.i18n.load_path += Dir[Rails.root.join('../../', 'config/locales', '*.{rb,yml}').to_s]
+    # config.i18n.default_locale = :en
+
+    # Configure the default encoding used in templates for Ruby 1.9.
+    config.encoding = "utf-8"
+
+    # Configure sensitive parameters which will be filtered from the log file.
+    config.filter_parameters += [:password]
+
+    # Enable the asset pipeline
+    config.assets.enabled = true
+
+    # Version of your assets, change this if you want to expire all your assets
+    config.assets.version = '1.0'
+  end
+end
+

data/spec/dummy/config/boot.rb

@@ -0,0 +1,10 @@
+require 'rubygems'
+gemfile = File.expand_path('../../../../Gemfile', __FILE__)
+
+if File.exist?(gemfile)
+  ENV['BUNDLE_GEMFILE'] = gemfile
+  require 'bundler'
+  Bundler.setup
+end
+
+$:.unshift File.expand_path('../../../../lib', __FILE__)

data/spec/dummy/config/database.yml

@@ -0,0 +1,15 @@
+development:
+  adapter: sqlite3
+  database: db/development.sqlite3
+  pool: 5
+  timeout: 5000
+
+test:
+  adapter: sqlite3
+  database: ":memory:"
+  timeout: 500
+
+production:
+  adapter: sqlite3
+  database: ":memory:"
+  timeout: 500

data/spec/dummy/config/environment.rb

@@ -0,0 +1,5 @@
+# Load the rails application
+require File.expand_path('../application', __FILE__)
+
+# Initialize the rails application
+Dummy::Application.initialize!

data/spec/dummy/config/environments/development.rb

@@ -0,0 +1,30 @@
+Dummy::Application.configure do
+  # Settings specified here will take precedence over those in config/application.rb
+
+  # In the development environment your application's code is reloaded on
+  # every request.  This slows down response time but is perfect for development
+  # since you don't have to restart the web server when you make code changes.
+  config.cache_classes = false
+
+  # Log error messages when you accidentally call methods on nil.
+  config.whiny_nils = true
+
+  # Show full error reports and disable caching
+  config.consider_all_requests_local       = true
+  config.action_controller.perform_caching = false
+
+  # Don't care if the mailer can't send
+  # config.action_mailer.raise_delivery_errors = false
+
+  # Print deprecation notices to the Rails logger
+  config.active_support.deprecation = :log
+
+  # Only use best-standards-support built into browsers
+  config.action_dispatch.best_standards_support = :builtin
+
+  # Do not compress assets
+  config.assets.compress = false
+
+  # Expands the lines which load the assets
+  config.assets.debug = true
+end

data/spec/dummy/config/environments/production.rb

@@ -0,0 +1,60 @@
+Dummy::Application.configure do
+  # Settings specified here will take precedence over those in config/application.rb
+
+  # Code is not reloaded between requests
+  config.cache_classes = true
+
+  # Full error reports are disabled and caching is turned on
+  config.consider_all_requests_local       = false
+  config.action_controller.perform_caching = true
+
+  # Disable Rails's static asset server (Apache or nginx will already do this)
+  config.serve_static_assets = false
+
+  # Compress JavaScripts and CSS
+  config.assets.compress = true
+
+  # Don't fallback to assets pipeline if a precompiled asset is missed
+  config.assets.compile = false
+
+  # Generate digests for assets URLs
+  config.assets.digest = true
+
+  # Defaults to Rails.root.join("public/assets")
+  # config.assets.manifest = YOUR_PATH
+
+  # Specifies the header that your server uses for sending files
+  # config.action_dispatch.x_sendfile_header = "X-Sendfile" # for apache
+  # config.action_dispatch.x_sendfile_header = 'X-Accel-Redirect' # for nginx
+
+  # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
+  # config.force_ssl = true
+
+  # See everything in the log (default is :info)
+  # config.log_level = :debug
+
+  # Use a different logger for distributed setups
+  # config.logger = SyslogLogger.new
+
+  # Use a different cache store in production
+  # config.cache_store = :mem_cache_store
+
+  # Enable serving of images, stylesheets, and JavaScripts from an asset server
+  # config.action_controller.asset_host = "http://assets.example.com"
+
+  # Precompile additional assets (application.js, application.css, and all non-JS/CSS are already added)
+  # config.assets.precompile += %w( search.js )
+
+  # Disable delivery errors, bad email addresses will be ignored
+  # config.action_mailer.raise_delivery_errors = false
+
+  # Enable threaded mode
+  # config.threadsafe!
+
+  # Enable locale fallbacks for I18n (makes lookups for any locale fall back to
+  # the I18n.default_locale when a translation can not be found)
+  config.i18n.fallbacks = true
+
+  # Send deprecation notices to registered listeners
+  config.active_support.deprecation = :notify
+end

data/spec/dummy/config/environments/test.rb

@@ -0,0 +1,39 @@
+Dummy::Application.configure do
+  # Settings specified here will take precedence over those in config/application.rb
+
+  # The test environment is used exclusively to run your application's
+  # test suite.  You never need to work with it otherwise.  Remember that
+  # your test database is "scratch space" for the test suite and is wiped
+  # and recreated between test runs.  Don't rely on the data there!
+  config.cache_classes = true
+
+  # Configure static asset server for tests with Cache-Control for performance
+  config.serve_static_assets = true
+  config.static_cache_control = "public, max-age=3600"
+
+  # Log error messages when you accidentally call methods on nil
+  config.whiny_nils = true
+
+  # Show full error reports and disable caching
+  config.consider_all_requests_local       = true
+  config.action_controller.perform_caching = false
+
+  # Raise exceptions instead of rendering exception templates
+  config.action_dispatch.show_exceptions = false
+
+  # Disable request forgery protection in test environment
+  config.action_controller.allow_forgery_protection    = false
+
+  # Tell Action Mailer not to deliver emails to the real world.
+  # The :test delivery method accumulates sent emails in the
+  # ActionMailer::Base.deliveries array.
+  # config.action_mailer.delivery_method = :test
+
+  # Use SQL instead of Active Record's schema dumper when creating the test database.
+  # This is necessary if your schema can't be completely dumped by the schema dumper,
+  # like if you have constraints or database-specific column types
+  # config.active_record.schema_format = :sql
+
+  # Print deprecation notices to the stderr
+  config.active_support.deprecation = :stderr
+end

data/spec/dummy/config/initializers/backtrace_silencers.rb

@@ -0,0 +1,7 @@
+# Be sure to restart your server when you modify this file.
+
+# You can add backtrace silencers for libraries that you're using but don't wish to see in your backtraces.
+# Rails.backtrace_cleaner.add_silencer { |line| line =~ /my_noisy_library/ }
+
+# You can also remove all the silencers if you're trying to debug a problem that might stem from framework code.
+# Rails.backtrace_cleaner.remove_silencers!