doorkeeper 0.3.0 → 0.4.0

data/spec/lib/oauth/password_access_token_request_spec.rb

@@ -0,0 +1,152 @@
+require 'spec_helper_integration'
+
+module Doorkeeper::OAuth
+  describe PasswordAccessTokenRequest do
+    let(:client) { Factory(:application) }
+    let(:owner)  { User.create!(:name => "Joe", :password => "sekret") }
+    let(:params) {
+      {
+        :grant_type    => "password"
+      }
+    }
+
+    describe "with a valid owner and client" do
+      subject { PasswordAccessTokenRequest.new(client, owner, params) }
+
+      before { subject.authorize }
+
+      it { should be_valid }
+
+      its(:token_type)    { should == "bearer" }
+      its(:error)         { should be_nil }
+      its(:refresh_token) { should be_nil }
+
+      it "has an access token" do
+        subject.access_token.token.should =~ /\w+/
+      end
+    end
+
+    describe "with a valid client but an invalid owner" do
+      subject { PasswordAccessTokenRequest.new(client, nil, params) }
+
+      before { subject.authorize }
+
+      it { should_not be_valid }
+      its(:error)         { should == :invalid_resource_owner }
+      its(:access_token)  { should be_nil }
+      its(:refresh_token) { should be_nil }
+    end
+
+    describe "with a valid owner but an invalid client" do
+      subject { PasswordAccessTokenRequest.new(nil, owner, params) }
+
+      before { subject.authorize }
+
+      it { should_not be_valid }
+      its(:error)         { should == :invalid_client }
+      its(:access_token)  { should be_nil }
+      its(:refresh_token) { should be_nil }
+    end
+
+    describe "creating the access token" do
+      subject { PasswordAccessTokenRequest.new(client, owner, params) }
+
+      it "creates with correct params" do
+        Doorkeeper::AccessToken.should_receive(:create!).with({
+          :application_id    => client.id,
+          :resource_owner_id => owner.id,
+          :expires_in        => 2.hours,
+          :scopes            =>"",
+          :use_refresh_token => false,
+        })
+        subject.authorize
+      end
+
+      it "creates a refresh token if Doorkeeper is configured to do so" do
+        Doorkeeper.configure { use_refresh_token }
+
+        Doorkeeper::AccessToken.should_receive(:create!).with({
+          :application_id    => client.id,
+          :resource_owner_id => owner.id,
+          :expires_in        => 2.hours,
+          :scopes            =>"",
+          :use_refresh_token => true,
+        })
+        subject.authorize
+      end
+    end
+
+    describe "with an existing valid access token" do
+      subject { PasswordAccessTokenRequest.new(client, owner, params) }
+
+      before { subject.authorize }
+      it { should be_valid }
+      its(:error)         { should be_nil }
+
+      it "will not create a new token" do
+        subject.should_not_receive(:create_access_token)
+        subject.authorize
+      end
+    end
+
+    describe "with an existing expired access token" do
+      subject { PasswordAccessTokenRequest.new(client, owner, params) }
+
+      it "will create a new token" do
+        subject.authorize
+        expired_access_token = subject.access_token.dup
+        subject.access_token.created_at = Time.now - subject.access_token.expires_in - 1.second
+        subject.should_receive(:create_access_token)
+        subject.access_token.should_receive(:revoke)
+        subject.authorize
+        subject.access_token.should_not eq(expired_access_token)
+      end
+    end
+
+    describe "finding the current access token" do
+      subject { PasswordAccessTokenRequest.new(client, owner, params) }
+      it { should be_valid }
+      its(:error)         { should be_nil }
+
+      before { subject.authorize }
+
+      it "should find the access token and not create a new one" do
+        subject.should_not_receive(:create_access_token)
+        access_token = subject.authorize
+        subject.access_token.should eq(access_token)
+      end
+    end
+
+    describe "creating the first access_token" do
+      subject { PasswordAccessTokenRequest.new(client, owner, params) }
+      it { should be_valid }
+      its(:error)         { should be_nil }
+
+      it "should create a new access token" do
+        subject.should_receive(:create_access_token)
+        subject.authorize
+      end
+    end
+
+    describe "with errors" do
+      def token(params)
+        PasswordAccessTokenRequest.new(client, owner, params)
+      end
+
+      it "includes the error in the response" do
+        access_token = token(params.except(:grant_type))
+        access_token.error_response.name.should == :invalid_request
+      end
+
+      describe "when client is not present" do
+        subject     { PasswordAccessTokenRequest.new(nil, owner, params) }
+        its(:error) { should == :invalid_client }
+      end
+
+      describe "when :grant_type is not 'password'" do
+        subject     { token(params.merge(:grant_type => "invalid")) }
+        its(:error) { should == :unsupported_grant_type }
+      end
+    end
+  end
+end

data/spec/lib/oauth/scopes_spec.rb

@@ -0,0 +1,115 @@
+require 'spec_helper'
+require 'active_support/core_ext/module/delegation'
+require 'active_support/core_ext/string'
+require 'doorkeeper/oauth/scopes'
+
+module Doorkeeper::OAuth
+  describe Scopes do
+    describe :add do
+      it 'allows you to add scopes with symbols' do
+        subject.add :public
+        subject.all.should == [:public]
+      end
+
+      it 'allows you to add scopes with strings' do
+        subject.add "public"
+        subject.all.should == [:public]
+      end
+
+      it 'do not add already included scopes' do
+        subject.add :public
+        subject.add :public
+        subject.all.should == [:public]
+      end
+    end
+
+    describe :exists do
+      before do
+        subject.add :public
+      end
+
+      it 'returns true if scope with given name is present' do
+        subject.exists?("public").should be_true
+      end
+
+      it 'returns false if scope with given name does not exist' do
+        subject.exists?("other").should be_false
+      end
+
+      it 'handles symbols' do
+        subject.exists?(:public).should be_true
+        subject.exists?(:other).should be_false
+      end
+    end
+
+    describe ".from_string" do
+      let(:string) { "public write" }
+
+      subject { Scopes.from_string(string) }
+
+      it { should be_a(Scopes) }
+      its(:all) { should == [:public, :write] }
+    end
+
+    describe :+ do
+      it "can add to another scope object" do
+        scopes = Scopes.from_string("public") + Scopes.from_string("admin")
+        scopes.all.should == [:public, :admin]
+      end
+
+      it "does not change the existing object" do
+        origin = Scopes.from_string("public")
+        new_scope = origin + Scopes.from_string("admin")
+        origin.to_s.should == "public"
+      end
+
+      it "raises an error if cannot handle addition" do
+        expect {
+          Scopes.from_string("public") + "admin"
+        }.to raise_error(NoMethodError)
+      end
+    end
+
+    describe :== do
+      it 'is equal to another set of scopes' do
+        Scopes.from_string("public").should == Scopes.from_string("public")
+      end
+
+      it 'is equal to another set of scopes with no particular order' do
+        Scopes.from_string("public write").should == Scopes.from_string("write public")
+      end
+
+      it 'differs from another set of scopes when scopes are not the same' do
+        Scopes.from_string("public write").should_not == Scopes.from_string("write")
+      end
+    end
+
+    describe :has_scopes? do
+      subject { Scopes.from_string("public admin") }
+
+      it "returns true when at least one scope is included" do
+        subject.has_scopes?(Scopes.from_string("public")).should be_true
+      end
+
+      it "returns true when all scopes are included" do
+        subject.has_scopes?(Scopes.from_string("public admin")).should be_true
+      end
+
+      it "is true if all scopes are included in any order" do
+        subject.has_scopes?(Scopes.from_string("admin public")).should be_true
+      end
+
+      it "is false if no scopes are included" do
+        subject.has_scopes?(Scopes.from_string("notexistent")).should be_false
+      end
+
+      it "returns false when any scope is not included" do
+        subject.has_scopes?(Scopes.from_string("public nope")).should be_false
+      end
+
+      it "is false if no scopes are included even for existing ones" do
+        subject.has_scopes?(Scopes.from_string("public admin notexistent")).should be_false
+      end
+    end
+  end
+end

data/spec/models/doorkeeper/access_grant_spec.rb

@@ -0,0 +1,36 @@
+require 'spec_helper_integration'
+
+describe Doorkeeper::AccessGrant do
+  subject { FactoryGirl.build(:access_grant) }
+
+  it { should be_valid }
+
+  it_behaves_like "an accessible token"
+  it_behaves_like "a revocable token"
+  it_behaves_like "an unique token" do
+    let(:factory_name) { :access_grant }
+  end
+
+  describe "validations" do
+    it "is invalid without resource_owner_id" do
+      subject.resource_owner_id = nil
+      should_not be_valid
+    end
+
+    it "is invalid without application_id" do
+      subject.application_id = nil
+      should_not be_valid
+    end
+
+    it "is invalid without token" do
+      subject.save
+      subject.token = nil
+      should_not be_valid
+    end
+
+    it "is invalid without expires_in" do
+      subject.expires_in = nil
+      should_not be_valid
+    end
+  end
+end

data/spec/models/doorkeeper/access_token_spec.rb

@@ -0,0 +1,113 @@
+require 'spec_helper_integration'
+
+module Doorkeeper
+  describe AccessToken do
+    subject { FactoryGirl.build(:access_token) }
+
+    it { should be_valid }
+
+    it_behaves_like "an accessible token"
+    it_behaves_like "a revocable token"
+    it_behaves_like "an unique token" do
+      let(:factory_name) { :access_token }
+    end
+
+    describe "validations" do
+      it "is valid without resource_owner_id" do
+        # For client credentials flow
+        subject.resource_owner_id = nil
+        should be_valid
+      end
+
+      it "is invalid without application_id" do
+        subject.application_id = nil
+        should_not be_valid
+      end
+    end
+
+    describe '.revoke_all_for' do
+      let(:resource_owner) { stub(:id => 100) }
+      let(:application)    { FactoryGirl.create :application }
+      let(:default_attributes) do
+        { :application => application, :resource_owner_id => resource_owner.id }
+      end
+
+      it 'revokes all tokens for given application and resource owner' do
+        FactoryGirl.create :access_token, default_attributes
+        AccessToken.revoke_all_for application.id, resource_owner
+        AccessToken.all.should be_empty
+      end
+
+      it 'matches application' do
+        FactoryGirl.create :access_token, default_attributes.merge(:application => FactoryGirl.create(:application))
+        AccessToken.revoke_all_for application.id, resource_owner
+        AccessToken.all.should_not be_empty
+      end
+
+      it 'matches resource owner' do
+        FactoryGirl.create :access_token, default_attributes.merge(:resource_owner_id => 90)
+        AccessToken.revoke_all_for application.id, resource_owner
+        AccessToken.all.should_not be_empty
+      end
+    end
+
+    describe '.matching_token_for' do
+      let(:resource_owner_id) { 100 }
+      let(:application)       { FactoryGirl.create :application }
+      let(:scopes)            { Doorkeeper::OAuth::Scopes.from_string("public write") }
+      let(:default_attributes) do
+        { :application => application, :resource_owner_id => resource_owner_id, :scopes => scopes.to_s }
+      end
+
+      it 'returns only one token' do
+        token = FactoryGirl.create :access_token, default_attributes
+        last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
+        last_token.should == token
+      end
+
+      it 'accepts resource owner as object' do
+        resource_owner = stub(:kind_of? => true, :id => 100)
+        token = FactoryGirl.create :access_token, default_attributes
+        last_token = AccessToken.matching_token_for(application, resource_owner, scopes)
+        last_token.should == token
+      end
+
+      it 'accepts nil as resource owner' do
+        token = FactoryGirl.create :access_token, default_attributes.merge(:resource_owner_id => nil)
+        last_token = AccessToken.matching_token_for(application, nil, scopes)
+        last_token.should == token
+      end
+
+      it 'excludes revoked tokens' do
+        FactoryGirl.create :access_token, default_attributes.merge(:revoked_at => 1.day.ago)
+        last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
+        last_token.should be_nil
+      end
+
+      it 'matches the application' do
+        token = FactoryGirl.create :access_token, default_attributes.merge(:application => FactoryGirl.create(:application))
+        last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
+        last_token.should be_nil
+      end
+
+      it 'matches the resource owner' do
+        FactoryGirl.create :access_token, default_attributes.merge(:resource_owner_id => 2)
+        last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
+        last_token.should be_nil
+      end
+
+      it 'matches the scopes' do
+        FactoryGirl.create :access_token, default_attributes.merge(:scopes => 'public email')
+        last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
+        last_token.should be_nil
+      end
+
+      it 'returns the last created token' do
+        FactoryGirl.create :access_token, default_attributes.merge(:created_at => 1.day.ago)
+        token = FactoryGirl.create :access_token, default_attributes
+        last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
+        last_token.should == token
+      end
+    end
+  end
+end

data/spec/models/doorkeeper/application_spec.rb

@@ -0,0 +1,129 @@
+require 'spec_helper_integration'
+
+module Doorkeeper
+  describe Application do
+    let(:new_application) { FactoryGirl.build(:application) }
+
+    it 'is valid given valid attributes' do
+      new_application.should be_valid
+    end
+
+    it 'is invalid without a name' do
+      new_application.name = nil
+      new_application.should_not be_valid
+    end
+
+    it 'generates uid on create' do
+      new_application.uid.should be_nil
+      new_application.save
+      new_application.uid.should_not be_nil
+    end
+
+    it 'is invalid without uid' do
+      new_application.save
+      new_application.uid = nil
+      new_application.should_not be_valid
+    end
+
+    it 'is invalid without redirect_uri' do
+      new_application.save
+      new_application.redirect_uri = nil
+      new_application.should_not be_valid
+    end
+
+    it 'is invalid with a redirect_uri that is relative' do
+      new_application.save
+      new_application.redirect_uri = "/abcd"
+      new_application.should_not be_valid
+    end
+
+    it 'is invalid with a redirect_uri that has a fragment' do
+      new_application.save
+      new_application.redirect_uri = "http://example.com/abcd#xyz"
+      new_application.should_not be_valid
+    end
+
+    it 'is invalid with a redirect_uri that has a query parameter' do
+      new_application.save
+      new_application.redirect_uri = "http://example.com/abcd?xyz=123"
+      new_application.should_not be_valid
+    end
+
+    it 'checks uniqueness of uid' do
+      app1 = FactoryGirl.create(:application)
+      app2 = FactoryGirl.create(:application)
+      app2.uid = app1.uid
+      app2.should_not be_valid
+    end
+
+    it 'generate secret on create' do
+      new_application.secret.should be_nil
+      new_application.save
+      new_application.secret.should_not be_nil
+    end
+
+    it 'is invalid without secret' do
+      new_application.save
+      new_application.secret = nil
+      new_application.should_not be_valid
+    end
+
+    describe 'destroy related models on cascade' do
+      before(:each) do
+        new_application.save
+      end
+
+      it 'should destroy its access grants' do
+        FactoryGirl.create(:access_grant, :application => new_application)
+        expect { new_application.destroy }.to change { Doorkeeper::AccessGrant.count }.by(-1)
+      end
+
+      it 'should destroy its access tokens' do
+        FactoryGirl.create(:access_token, :application => new_application)
+        FactoryGirl.create(:access_token, :application => new_application, :revoked_at => Time.now)
+        expect { new_application.destroy }.to change { Doorkeeper::AccessToken.count }.by(-2)
+      end
+    end
+
+    describe :authorized_for do
+      let(:resource_owner) { double(:resource_owner, :id => 10) }
+
+      it "is empty if the application is not authorized for anyone" do
+        Application.authorized_for(resource_owner).should be_empty
+      end
+
+      it "returns only application for a specific resource owner" do
+        FactoryGirl.create(:access_token, :resource_owner_id => resource_owner.id + 1)
+        token = FactoryGirl.create(:access_token, :resource_owner_id => resource_owner.id)
+        Application.authorized_for(resource_owner).should == [token.application]
+      end
+
+      it "excludes revoked tokens" do
+        FactoryGirl.create(:access_token, :resource_owner_id => resource_owner.id, :revoked_at => 2.days.ago)
+        Application.authorized_for(resource_owner).should be_empty
+      end
+
+      it "returns all applications that have been authorized" do
+        token1 = FactoryGirl.create(:access_token, :resource_owner_id => resource_owner.id)
+        token2 = FactoryGirl.create(:access_token, :resource_owner_id => resource_owner.id)
+        Application.authorized_for(resource_owner).should == [token1.application, token2.application]
+      end
+
+      it "returns only one application even if it has been authorized twice" do
+        application = FactoryGirl.create(:application)
+        FactoryGirl.create(:access_token, :resource_owner_id => resource_owner.id, :application => application)
+        FactoryGirl.create(:access_token, :resource_owner_id => resource_owner.id, :application => application)
+        Application.authorized_for(resource_owner).should == [application]
+      end
+
+      it "should fail to mass assign a new application" do
+        mass_assign = { :name => 'Something',
+                        :redirect_uri => 'http://somewhere.com/something',
+                        :uid => 123,
+                        :secret => 'something' }
+        Application.create(mass_assign).uid.should_not == 123
+      end
+
+    end
+  end
+end

data/spec/requests/applications/applications_request_spec.rb

@@ -0,0 +1,92 @@
+require 'spec_helper_integration'
+
+feature 'Adding applications' do
+  context 'in application form' do
+    background do
+      visit '/oauth/applications/new'
+    end
+
+    scenario 'adding a valid app' do
+      fill_in 'Name', :with => 'My Application'
+      fill_in 'Redirect uri', :with => 'http://example.com'
+      click_button 'Submit'
+      i_should_see 'Application created'
+      i_should_see 'My Application'
+    end
+
+    scenario 'adding invalid app' do
+      click_button 'Submit'
+      i_should_see 'Whoops! Check your form for possible errors'
+    end
+  end
+end
+
+feature 'Listing applications' do
+  background do
+    FactoryGirl.create :application, :name => 'Oauth Dude'
+    FactoryGirl.create :application, :name => 'Awesome App'
+  end
+
+  scenario 'application list' do
+    visit '/oauth/applications'
+    i_should_see 'Awesome App'
+    i_should_see 'Oauth Dude'
+  end
+end
+
+feature 'Show application' do
+  let :app do
+    FactoryGirl.create :application, :name => 'Just another oauth app'
+  end
+
+  scenario 'visiting application page' do
+    visit "/oauth/applications/#{app.id}"
+    i_should_see 'Just another oauth app'
+  end
+end
+
+feature 'Edit application' do
+  let :app do
+    FactoryGirl.create :application, :name => 'OMG my app'
+  end
+
+  background do
+    visit "/oauth/applications/#{app.id}/edit"
+  end
+
+  scenario 'updating a valid app' do
+    fill_in :name, :with => "Serious app"
+    click_button 'Submit'
+    i_should_see "Application updated"
+    i_should_see "Serious app"
+    i_should_not_see "OMG my app"
+  end
+
+  scenario 'updating an invalid app' do
+    fill_in :name, :with => ""
+    click_button 'Submit'
+    i_should_see 'Whoops! Check your form for possible errors'
+  end
+end
+
+feature 'Destroy application' do
+  background do
+    @app = FactoryGirl.create :application
+  end
+
+  scenario 'deleting an application from list' do
+    visit "/oauth/applications"
+    i_should_see @app.name
+    within(:css, "tr#application_#{@app.id}") do
+      click_link "Destroy"
+    end
+    i_should_see "Application deleted"
+    i_should_not_see @app.name
+  end
+
+  scenario 'deleting an application from show' do
+    visit "/oauth/applications/#{@app.id}"
+    click_link 'Remove'
+    i_should_see "Application deleted"
+  end
+end

data/spec/requests/applications/authorized_applications_spec.rb

@@ -0,0 +1,30 @@
+require 'spec_helper_integration'
+
+feature 'Authorized applications' do
+  background do
+    @user   = User.create!(:name => "Joe", :password => "sekret")
+    @client = client_exists(:name => "Amazing Client App")
+    resource_owner_is_authenticated @user
+    client_is_authorized @client, @user
+  end
+
+  scenario "display user's authorized applications" do
+    visit '/oauth/authorized_applications'
+    i_should_see 'Amazing Client App'
+  end
+
+  scenario "do not display other user's authorized applications" do
+    client = client_exists(:name => "Another Client App")
+    client_is_authorized client, User.create!(:name => "Joe", :password => "sekret")
+    visit '/oauth/authorized_applications'
+    i_should_not_see 'Another Client App'
+  end
+
+  scenario "user revoke access to application" do
+    visit '/oauth/authorized_applications'
+    i_should_see 'Amazing Client App'
+    click_on 'Revoke'
+    i_should_see 'Application revoked'
+    i_should_not_see 'Amazing Client App'
+  end
+end