doorkeeper 0.3.0 → 0.4.0

data/spec/requests/endpoints/authorization_spec.rb

@@ -0,0 +1,63 @@
+require 'spec_helper_integration'
+
+feature 'Authorization endpoint' do
+  background do
+    config_is_set(:authenticate_resource_owner) { User.first || redirect_to('/sign_in') }
+    client_exists(:name => "MyApp")
+  end
+
+  scenario 'requires resource owner to be authenticated' do
+    visit authorization_endpoint_url(:client => @client)
+    i_should_see "Sign in"
+    i_should_be_on "/"
+  end
+
+  context 'with authenticated resource owner' do
+    background do
+      create_resource_owner
+      sign_in
+    end
+
+    scenario 'displays the authorization form' do
+      visit authorization_endpoint_url(:client => @client)
+      i_should_see "Authorize MyApp to use your account?"
+    end
+
+    scenario 'accepts "code" response type' do
+      visit authorization_endpoint_url(:client => @client, :response_type => "code")
+      i_should_see "Authorize"
+    end
+
+    scenario 'accepts "token" response type' do
+      visit authorization_endpoint_url(:client => @client, :response_type => "token")
+      i_should_see "Authorize"
+    end
+  end
+
+  context 'with scopes' do
+    background do
+      create_resource_owner
+      sign_in
+      default_scopes_exist  :public
+      optional_scopes_exist :write
+    end
+
+    scenario "displays default scopes when no scope was requested" do
+      visit authorization_endpoint_url(:client => @client)
+      i_should_see "Access your public data"
+      i_should_not_see "Update your data"
+    end
+
+    scenario "displays all requested scopes" do
+      visit authorization_endpoint_url(:client => @client, :scope => "public write")
+      i_should_see "Access your public data"
+      i_should_see "Update your data"
+    end
+
+    scenario "does not display default scope if it was not requested" do
+      visit authorization_endpoint_url(:client => @client, :scope => "write")
+      i_should_not_see "Access your public data"
+      i_should_see "Update your data"
+    end
+  end
+end

data/spec/requests/endpoints/token_spec.rb

@@ -0,0 +1,29 @@
+require 'spec_helper_integration'
+
+feature 'Token endpoint' do
+  background do
+    client_exists
+    authorization_code_exists :application => @client, :scopes => "public"
+  end
+
+  scenario 'respond with correct headers' do
+    post token_endpoint_url(:code => @authorization.token, :client => @client)
+    should_have_header 'Pragma', 'no-cache'
+    should_have_header 'Cache-Control', 'no-store'
+  end
+
+  scenario 'accepts client credentials with basic auth header' do
+    post token_endpoint_url(:code => @authorization.token, :redirect_uri => @client.redirect_uri),
+                            {} ,
+                            { 'HTTP_AUTHORIZATION' => basic_auth_header_for_client(@client) }
+
+    should_have_json 'access_token', Doorkeeper::AccessToken.first.token
+  end
+
+  scenario 'returns null for expires_in when a permanent token is set' do
+    config_is_set(:access_token_expires_in, nil)
+    post token_endpoint_url(:code => @authorization.token, :client => @client)
+    should_have_json 'access_token', Doorkeeper::AccessToken.first.token
+    should_have_json 'expires_in', nil
+  end
+end

data/spec/requests/flows/authorization_code_errors_spec.rb

@@ -0,0 +1,111 @@
+require 'spec_helper_integration'
+
+feature 'Authorization Code Flow Errors' do
+  background do
+    config_is_set(:authenticate_resource_owner) { User.first || redirect_to('/sign_in') }
+    client_exists
+    create_resource_owner
+    sign_in
+  end
+
+  after do
+    access_grant_should_not_exist
+  end
+
+  scenario "redirects with :invalid_request error when :response_type is missing" do
+    visit authorization_endpoint_url(:client => @client, :response_type => "")
+    i_should_be_on_client_callback @client
+    url_should_have_param "error", "invalid_request"
+    url_should_have_param "error_description", translated_error_message(:invalid_request)
+  end
+
+  scenario "redirects with :unsupported_response_type error for invalid :response_type" do
+    visit authorization_endpoint_url(:client => @client, :response_type => "invalid")
+    i_should_be_on_client_callback @client
+    url_should_have_param "error", "unsupported_response_type"
+    url_should_have_param "error_description", translated_error_message(:unsupported_response_type)
+  end
+
+  [
+    [:client_id,     :invalid_client],
+    [:redirect_uri,  :invalid_redirect_uri],
+  ].each do |error|
+    scenario "displays #{error.last.inspect} error for invalid #{error.first.inspect}" do
+      visit authorization_endpoint_url(:client => @client, error.first => "invalid")
+      i_should_not_see "Authorize"
+      i_should_see_translated_error_message error.last
+    end
+
+    scenario "displays #{error.last.inspect} error when #{error.first.inspect} is missing" do
+      visit authorization_endpoint_url(:client => @client, error.first => "")
+      i_should_not_see "Authorize"
+      i_should_see_translated_error_message error.last
+    end
+  end
+
+  context 'when access was denied' do
+    scenario 'redirects with error' do
+      visit authorization_endpoint_url(:client => @client)
+      click_on "Deny"
+
+      i_should_be_on_client_callback @client
+      url_should_not_have_param "code"
+      url_should_have_param "error", "access_denied"
+      url_should_have_param "error_description", translated_error_message(:access_denied)
+    end
+
+    scenario 'redirects with state parameter' do
+      visit authorization_endpoint_url(:client => @client, :state => "return-this")
+      click_on "Deny"
+
+      i_should_be_on_client_callback @client
+      url_should_not_have_param "code"
+      url_should_have_param "state", "return-this"
+    end
+  end
+
+  context 'with scopes' do
+    background do
+      optional_scopes_exist :write
+    end
+
+    scenario "redirects with :invalid_scope error when scope does not exists" do
+      visit authorization_endpoint_url(:client => @client, :scope => "invalid")
+
+      i_should_be_on_client_callback @client
+      url_should_have_param "error", "invalid_scope"
+      url_should_have_param "error_description", translated_error_message(:invalid_scope)
+    end
+  end
+end
+
+feature 'Authorization Code Flow Errors', 'after authorization' do
+  background do
+    client_exists
+    authorization_code_exists :application => @client
+  end
+
+  scenario "returns :invalid_grant error when posting an already revoked grant code" do
+    # First successful request
+    post token_endpoint_url(:code => @authorization.token, :client => @client)
+
+    # Second attempt with same token
+    expect {
+      post token_endpoint_url(:code => @authorization.token, :client => @client)
+    }.to_not change { Doorkeeper::AccessToken.count }
+
+    should_not_have_json 'access_token'
+    should_have_json 'error', 'invalid_grant'
+    should_have_json 'error_description', translated_error_message('invalid_grant')
+  end
+
+  scenario "returns :invalid_grant error for invalid grant code" do
+    post token_endpoint_url(:code => "invalid", :client => @client)
+
+    access_token_should_not_exist
+
+    should_not_have_json 'access_token'
+    should_have_json 'error', 'invalid_grant'
+    should_have_json 'error_description', translated_error_message('invalid_grant')
+  end
+end

data/spec/requests/flows/authorization_code_spec.rb

@@ -0,0 +1,125 @@
+require 'spec_helper_integration'
+
+feature 'Authorization Code Flow' do
+  background do
+    config_is_set(:authenticate_resource_owner) { User.first || redirect_to('/sign_in') }
+    client_exists
+    create_resource_owner
+    sign_in
+  end
+
+  scenario 'resource owner authorizes the client' do
+    visit authorization_endpoint_url(:client => @client)
+    click_on "Authorize"
+
+    access_grant_should_exist_for(@client, @resource_owner)
+
+    i_should_be_on_client_callback(@client)
+
+    url_should_have_param("code", Doorkeeper::AccessGrant.first.token)
+    url_should_not_have_param("state")
+    url_should_not_have_param("error")
+  end
+
+  scenario 'resource owner authorizes the client with state parameter set' do
+    visit authorization_endpoint_url(:client => @client, :state => "return-me")
+    click_on "Authorize"
+    url_should_have_param("code", Doorkeeper::AccessGrant.first.token)
+    url_should_have_param("state", "return-me")
+  end
+
+  scenario 'returns the same token if it is still accessible' do
+    client_is_authorized(@client, @resource_owner)
+    visit authorization_endpoint_url(:client => @client)
+
+    authorization_code = Doorkeeper::AccessGrant.first.token
+    post token_endpoint_url(:code => authorization_code, :client => @client)
+
+    Doorkeeper::AccessToken.count.should be(1)
+
+    should_have_json 'access_token', Doorkeeper::AccessToken.first.token
+  end
+
+  scenario 'revokes and return new token if it is has expired' do
+    client_is_authorized(@client, @resource_owner)
+    token = Doorkeeper::AccessToken.first
+    token.update_attribute :expires_in, -100
+    visit authorization_endpoint_url(:client => @client)
+
+    authorization_code = Doorkeeper::AccessGrant.first.token
+    post token_endpoint_url(:code => authorization_code, :client => @client)
+
+    token.reload.should be_revoked
+    Doorkeeper::AccessToken.count.should be(2)
+
+    should_have_json 'access_token', Doorkeeper::AccessToken.last.token
+  end
+
+  scenario 'resource owner requests an access token with authorization code' do
+    visit authorization_endpoint_url(:client => @client)
+    click_on "Authorize"
+
+    authorization_code = Doorkeeper::AccessGrant.first.token
+    post token_endpoint_url(:code => authorization_code, :client => @client)
+
+    access_token_should_exist_for(@client, @resource_owner)
+
+    should_not_have_json 'error'
+
+    should_have_json 'access_token', Doorkeeper::AccessToken.first.token
+    should_have_json 'token_type',   "bearer"
+    should_have_json 'expires_in',   Doorkeeper::AccessToken.first.expires_in
+
+    should_not_have_json 'refresh_token'
+  end
+
+  context 'with scopes' do
+    background do
+      default_scopes_exist  :public
+      optional_scopes_exist :write
+    end
+
+    scenario 'resource owner authorizes the client with default scopes' do
+      visit authorization_endpoint_url(:client => @client)
+      click_on "Authorize"
+      access_grant_should_exist_for(@client, @resource_owner)
+      access_grant_should_have_scopes :public
+    end
+
+    scenario 'resource owner authorizes the client with required scopes' do
+      visit authorization_endpoint_url(:client => @client, :scope => "public write")
+      click_on "Authorize"
+      access_grant_should_have_scopes :public, :write
+    end
+
+    scenario 'resource owner authorizes the client with required scopes (without defaults)' do
+      visit authorization_endpoint_url(:client => @client, :scope => "write")
+      click_on "Authorize"
+      access_grant_should_have_scopes :write
+    end
+
+    scenario 'new access token matches required scopes' do
+      visit authorization_endpoint_url(:client => @client, :scope => "public write")
+      click_on "Authorize"
+
+      authorization_code = Doorkeeper::AccessGrant.first.token
+      post token_endpoint_url(:code => authorization_code, :client => @client)
+
+      access_token_should_exist_for(@client, @resource_owner)
+      access_token_should_have_scopes :public, :write
+    end
+
+    scenario 'returns new token if scopes have changed' do
+      client_is_authorized(@client, @resource_owner, :scopes => "public write")
+      visit authorization_endpoint_url(:client => @client, :scope => "public")
+      click_on "Authorize"
+
+      authorization_code = Doorkeeper::AccessGrant.first.token
+      post token_endpoint_url(:code => authorization_code, :client => @client)
+
+      Doorkeeper::AccessToken.count.should be(2)
+
+      should_have_json 'access_token', Doorkeeper::AccessToken.last.token
+    end
+  end
+end

data/spec/requests/flows/client_credentials_spec.rb

@@ -0,0 +1,56 @@
+require 'spec_helper_integration'
+
+describe 'Client Credentials Request' do
+  let(:client) { FactoryGirl.create :application }
+
+  context 'a valid request' do
+    it 'authorizes the client and returns the token response' do
+      headers = authorization client.uid, client.secret
+      params  = { :grant_type => 'client_credentials' }
+
+      post '/oauth/token', params, headers
+
+      should_have_json 'access_token', Doorkeeper::AccessToken.first.token
+      should_have_json 'expires_in', Doorkeeper.configuration.access_token_expires_in
+      should_have_json 'scope', ''
+
+      should_not_have_json 'error'
+      should_not_have_json 'error_description'
+      should_not_have_json 'refresh_token'
+    end
+
+    context 'with scopes' do
+      before do
+        optional_scopes_exist :write
+      end
+
+      it 'adds the scope to the token an returns in the response' do
+        headers = authorization client.uid, client.secret
+        params  = { :grant_type => 'client_credentials', :scope => 'write' }
+
+        post '/oauth/token', params, headers
+
+        should_have_json 'access_token', Doorkeeper::AccessToken.first.token
+        should_have_json 'scope', 'write'
+      end
+    end
+  end
+
+  context 'an invalid request' do
+    it 'does not authorize the client and returns the error' do
+      headers = {}
+      params  = { :grant_type => 'client_credentials' }
+
+      post '/oauth/token', params, headers
+
+      should_have_json 'error', 'invalid_client'
+      should_have_json 'error_description', translated_error_message(:invalid_client)
+      should_not_have_json 'access_token'
+    end
+  end
+
+  def authorization(username, password)
+    credentials = ActionController::HttpAuthentication::Basic.encode_credentials username, password
+    { 'HTTP_AUTHORIZATION' => credentials }
+  end
+end

data/spec/requests/flows/implicit_grant_errors_spec.rb

@@ -0,0 +1,31 @@
+require 'spec_helper_integration'
+
+feature 'Implicit Grant Flow Errors' do
+  background do
+    config_is_set(:authenticate_resource_owner) { User.first || redirect_to('/sign_in') }
+    client_exists
+    create_resource_owner
+    sign_in
+  end
+
+  after do
+    access_token_should_not_exist
+  end
+
+  [
+    [:client_id,     :invalid_client],
+    [:redirect_uri,  :invalid_redirect_uri],
+  ].each do |error|
+    scenario "displays #{error.last.inspect} error for invalid #{error.first.inspect}" do
+      visit authorization_endpoint_url(:client => @client, error.first => "invalid", :response_type => "token")
+      i_should_not_see "Authorize"
+      i_should_see_translated_error_message error.last
+    end
+
+    scenario "displays #{error.last.inspect} error when #{error.first.inspect} is missing" do
+      visit authorization_endpoint_url(:client => @client, error.first => "", :response_type => "token")
+      i_should_not_see "Authorize"
+      i_should_see_translated_error_message error.last
+    end
+  end
+end

data/spec/requests/flows/implicit_grant_spec.rb

@@ -0,0 +1,19 @@
+require 'spec_helper_integration'
+
+feature 'Implicit Grant Flow' do
+  background do
+    config_is_set(:authenticate_resource_owner) { User.first || redirect_to('/sign_in') }
+    client_exists
+    create_resource_owner
+    sign_in
+  end
+
+  scenario 'resource owner authorizes the client' do
+    visit authorization_endpoint_url(:client => @client, :response_type => 'token')
+    click_on "Authorize"
+
+    access_token_should_exist_for @client, @resource_owner
+
+    i_should_be_on_client_callback @client
+  end
+end

data/spec/requests/flows/password_spec.rb

@@ -0,0 +1,52 @@
+# coding: utf-8
+
+# TODO: this flow should be configurable (letting Doorkeeper users decide if
+# they want to make it available)
+
+require 'spec_helper_integration'
+
+feature 'Resource Owner Password Credentials Flow' do
+  background do
+    config_is_set(:resource_owner_from_credentials) { User.authenticate! params[:username], params[:password] }
+    client_exists
+    create_resource_owner
+  end
+
+  context 'with valid user credentials' do
+    scenario "should issue new token" do
+      expect {
+        post password_token_endpoint_url(:client => @client, :resource_owner => @resource_owner)
+      }.to change { Doorkeeper::AccessToken.count }.by(1)
+
+      token = Doorkeeper::AccessToken.first
+
+      should_have_json 'access_token',  token.token
+    end
+
+    scenario "should issue a refresh token if enabled" do
+      config_is_set(:refresh_token_enabled, true)
+
+      post password_token_endpoint_url(:client => @client, :resource_owner => @resource_owner)
+
+      token = Doorkeeper::AccessToken.first
+
+      should_have_json 'refresh_token',  token.refresh_token
+    end
+  end
+
+  context "with invalid user credentials" do
+    scenario "should not issue new token with bad password" do
+      expect {
+        post password_token_endpoint_url( :client => @client,
+                                          :resource_owner_username => @resource_owner.name,
+                                          :resource_owner_password => 'wrongpassword')
+      }.to_not change { Doorkeeper::AccessToken.count }
+    end
+
+    scenario "should not issue new token without credentials" do
+      expect {
+        post password_token_endpoint_url( :client => @client)
+      }.to_not change { Doorkeeper::AccessToken.count }
+    end
+  end
+end

data/spec/requests/flows/refresh_token_spec.rb

@@ -0,0 +1,66 @@
+require 'spec_helper_integration'
+
+feature "Refresh Token Flow" do
+  before do
+    Doorkeeper.configure { use_refresh_token }
+    client_exists
+  end
+
+  context "issuing a refresh token" do
+    before do
+      authorization_code_exists :application => @client
+    end
+
+    scenario "client gets the refresh token and refreshses it" do
+      post token_endpoint_url(:code => @authorization.token, :client => @client)
+
+      token = Doorkeeper::AccessToken.first
+
+      should_have_json 'access_token',  token.token
+      should_have_json 'refresh_token', token.refresh_token
+
+      @authorization.reload.should be_revoked
+
+      post refresh_token_endpoint_url(:client => @client, :refresh_token => token.refresh_token)
+
+      new_token = Doorkeeper::AccessToken.last
+      should_have_json 'access_token',  new_token.token
+      should_have_json 'refresh_token', new_token.refresh_token
+
+      token.token.should_not         == new_token.token
+      token.refresh_token.should_not == new_token.refresh_token
+    end
+  end
+
+  context "refreshing the token" do
+    before do
+      @token = FactoryGirl.create(:access_token, :application => @client, :resource_owner_id => 1, :use_refresh_token => true)
+    end
+
+    scenario "client request a token with refresh token" do
+      post refresh_token_endpoint_url(:client => @client, :refresh_token => @token.refresh_token)
+      should_have_json 'refresh_token', Doorkeeper::AccessToken.last.refresh_token
+      @token.reload.should be_revoked
+    end
+
+    scenario "client request a token with expired access token" do
+      @token.update_attribute :expires_in, -100
+      post refresh_token_endpoint_url(:client => @client, :refresh_token => @token.refresh_token)
+      should_have_json 'refresh_token', Doorkeeper::AccessToken.last.refresh_token
+      @token.reload.should be_revoked
+    end
+
+    scenario "client gets an error for invalid refresh token" do
+      post refresh_token_endpoint_url(:client => @client, :refresh_token => "invalid")
+      should_not_have_json 'refresh_token'
+      should_have_json 'error', 'invalid_grant'
+    end
+
+    scenario "client gets an error for revoked acccess token" do
+      @token.revoke
+      post refresh_token_endpoint_url(:client => @client, :refresh_token => @token.refresh_token)
+      should_not_have_json 'refresh_token'
+      should_have_json 'error', 'invalid_grant'
+    end
+  end
+end

data/spec/requests/flows/skip_authorization_spec.rb

@@ -0,0 +1,40 @@
+require 'spec_helper_integration'
+
+feature 'Skip authorization form' do
+  background do
+    config_is_set(:authenticate_resource_owner) { User.first || redirect_to('/sign_in') }
+    client_exists
+    default_scopes_exist  :public
+    optional_scopes_exist :write
+  end
+
+  context 'for previously authorized clients' do
+    background do
+      create_resource_owner
+      sign_in
+    end
+
+    scenario 'skips the authorization and return a new grant code' do
+      client_is_authorized(@client, @resource_owner, :scopes => "public")
+      visit authorization_endpoint_url(:client => @client)
+
+      i_should_not_see "Authorize"
+      client_should_be_authorized @client
+      i_should_be_on_client_callback @client
+      url_should_have_param "code", Doorkeeper::AccessGrant.first.token
+    end
+
+    scenario 'does not skip authorization when scopes differ' do
+      client_is_authorized(@client, @resource_owner, :scopes => "public write")
+      visit authorization_endpoint_url(:client => @client, :scope => "public")
+      i_should_see "Authorize"
+    end
+
+    scenario 'creates grant with new scope when scopes differ' do
+      client_is_authorized(@client, @resource_owner, :scopes => "public write")
+      visit authorization_endpoint_url(:client => @client, :scope => "public")
+      click_on "Authorize"
+      access_grant_should_have_scopes :public
+    end
+  end
+end

data/spec/requests/protected_resources/private_api_spec.rb

@@ -0,0 +1,43 @@
+require 'spec_helper_integration'
+
+feature 'Private API' do
+  background do
+    @client   = FactoryGirl.create(:application)
+    @resource = User.create!(:name => "Joe", :password => "sekret")
+    @token    = client_is_authorized(@client, @resource)
+  end
+
+  scenario 'client requests protected resource with valid token' do
+    with_access_token_header @token.token
+    visit '/full_protected_resources'
+    page.body.should have_content("index")
+  end
+
+  scenario 'client attempts to request protected resource with invalid token' do
+    with_access_token_header "invalid"
+    visit '/full_protected_resources'
+    response_status_should_be 401
+  end
+
+  scenario 'client attempts to request protected resource with expired token' do
+    @token.update_attribute :expires_in, -100 # expires token
+    with_access_token_header @token.token
+    visit '/full_protected_resources'
+    response_status_should_be 401
+  end
+
+  scenario 'client requests protected resource with permanent token' do
+    @token.update_attribute :expires_in, nil # never expires
+    with_access_token_header @token.token
+    visit '/full_protected_resources'
+    page.body.should have_content("index")
+  end
+
+  scenario 'access token with no scopes' do
+    optional_scopes_exist :admin
+    @token.update_attribute :scopes, nil
+    with_access_token_header @token.token
+    visit '/full_protected_resources/1.json'
+    response_status_should_be 401
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1 @@
+$LOAD_PATH.unshift File.expand_path(File.join(File.dirname(__FILE__), "../lib"))

data/spec/spec_helper_integration.rb

@@ -0,0 +1,28 @@
+ENV["RAILS_ENV"] ||= 'test'
+require File.expand_path("../dummy/config/environment", __FILE__)
+
+require 'rspec/rails'
+require 'rspec/autorun'
+require 'generator_spec/test_case'
+require 'timecop'
+
+ENGINE_RAILS_ROOT = File.join(File.dirname(__FILE__), '../')
+
+puts "====> Rails version: #{Rails.version}"
+puts "====> Ruby version: #{RUBY_VERSION}"
+
+# load schema to in memory sqlite
+ActiveRecord::Migration.verbose = false
+load Rails.root + "db/schema.rb"
+
+Dir[File.join(ENGINE_RAILS_ROOT, "spec/support/**/*.rb")].each { |f| require f }
+
+RSpec.configure do |config|
+  config.mock_with :rspec
+
+  config.infer_base_class_for_anonymous_controllers = false
+
+  config.before do
+    Doorkeeper.configure {}
+  end
+end