doorkeeper 1.1.0 → 1.2.0

data/spec/lib/oauth/token_request_spec.rb

@@ -3,18 +3,19 @@ require 'spec_helper_integration'
 module Doorkeeper::OAuth
   describe TokenRequest do
     let :pre_auth do
-      double(:pre_auth, {
-        :client => double(:application, :id => 9990),
-        :redirect_uri => 'http://tst.com/cb',
-        :state => nil,
-        :scopes => nil,
-        :error => nil,
-        :authorizable? => true
-      })
+      double(
+        :pre_auth,
+        client: double(:application, id: 9990),
+        redirect_uri: 'http://tst.com/cb',
+        state: nil,
+        scopes: nil,
+        error: nil,
+        authorizable?: true
+      )
     end
 
     let :owner do
-      double :owner, :id => 7866
+      double :owner, id: 7866
     end
 
     subject do

data/spec/lib/oauth/token_response_spec.rb

@@ -17,14 +17,13 @@ module Doorkeeper::OAuth
 
     describe '.body' do
       let(:access_token) do
-        double :access_token, {
-          :token => 'some-token',
-          :expires_in => '3600',
-          :expires_in_seconds => '300',
-          :scopes_string => 'two scopes',
-          :refresh_token => 'some-refresh-token',
-          :token_type => 'bearer'
-        }
+        double :access_token,
+               token: 'some-token',
+               expires_in: '3600',
+               expires_in_seconds: '300',
+               scopes_string: 'two scopes',
+               refresh_token: 'some-refresh-token',
+               token_type: 'bearer'
       end
 
       subject { TokenResponse.new(access_token).body }
@@ -54,13 +53,12 @@ module Doorkeeper::OAuth
 
     describe '.body filters out empty values' do
       let(:access_token) do
-        double :access_token, {
-          :token => 'some-token',
-          :expires_in_seconds => '',
-          :scopes_string => '',
-          :refresh_token => '',
-          :token_type => 'bearer'
-        }
+        double :access_token,
+               token: 'some-token',
+               expires_in_seconds: '',
+               scopes_string: '',
+               refresh_token: '',
+               token_type: 'bearer'
       end
 
       subject { TokenResponse.new(access_token).body }

data/spec/lib/oauth/token_spec.rb

@@ -14,7 +14,7 @@ module Doorkeeper
         let(:request) { double.as_null_object }
 
         let(:method) do
-          lambda { |request| return 'token-value' }
+          ->(request) { return 'token-value' }
         end
 
         it 'accepts anything that responds to #call' do
@@ -30,7 +30,7 @@ module Doorkeeper
         it 'stops at the first credentials found' do
           not_called_method = double
           expect(not_called_method).not_to receive(:call)
-          credentials = Token.from_request request, lambda { |r| }, method, not_called_method
+          Token.from_request request, ->(r) {}, method, not_called_method
         end
 
         it 'returns the credential from extractor method' do
@@ -41,39 +41,53 @@ module Doorkeeper
 
       describe :from_access_token_param do
         it 'returns token from access_token parameter' do
-          request = double :parameters => { :access_token => 'some-token' }
+          request = double parameters: { access_token: 'some-token' }
           token   = Token.from_access_token_param(request)
-          expect(token).to eq("some-token")
+          expect(token).to eq('some-token')
         end
       end
 
       describe :from_bearer_param do
         it 'returns token from bearer_token parameter' do
-          request = double :parameters => { :bearer_token => 'some-token' }
+          request = double parameters: { bearer_token: 'some-token' }
           token   = Token.from_bearer_param(request)
-          expect(token).to eq("some-token")
+          expect(token).to eq('some-token')
         end
       end
 
       describe :from_bearer_authorization do
         it 'returns token from authorization bearer' do
-          request = double :authorization => "Bearer SomeToken"
+          request = double authorization: 'Bearer SomeToken'
           token   = Token.from_bearer_authorization(request)
-          expect(token).to eq("SomeToken")
+          expect(token).to eq('SomeToken')
         end
 
         it 'does not return token if authorization is not bearer' do
-          request = double :authorization => "MAC SomeToken"
+          request = double authorization: 'MAC SomeToken'
           token   = Token.from_bearer_authorization(request)
           expect(token).to be_blank
         end
       end
 
+      describe :from_basic_authorization do
+        it 'returns token from authorization basic' do
+          request = double authorization: "Basic #{Base64.encode64 'SomeToken:'}"
+          token   = Token.from_basic_authorization(request)
+          expect(token).to eq('SomeToken')
+        end
+
+        it 'does not return token if authorization is not basic' do
+          request = double authorization: "MAC #{Base64.encode64 'SomeToken:'}"
+          token   = Token.from_basic_authorization(request)
+          expect(token).to be_blank
+        end
+      end
+
       describe :authenticate do
         let(:finder) { double :finder }
 
         it 'calls the finder if token was found' do
-          token = lambda { |r| 'token' }
+          token = ->(r) { 'token' }
           expect(AccessToken).to receive(:authenticate).with('token')
           Token.authenticate double, token
         end

data/spec/lib/server_spec.rb

@@ -12,11 +12,33 @@ describe Doorkeeper::Server do
 
   describe '.authorization_request' do
     it 'raises error when strategy does not exist' do
-      expect { subject.authorization_request(:duh) }.to raise_error(Doorkeeper::Errors::InvalidAuthorizationStrategy)
+      expect do
+        subject.authorization_request(:duh)
+      end.to raise_error(Doorkeeper::Errors::InvalidAuthorizationStrategy)
     end
 
     it 'raises error when strategy does not match phase' do
-      expect { subject.token_request(:code) }.to raise_error(Doorkeeper::Errors::InvalidTokenStrategy)
+      expect do
+        subject.token_request(:code)
+      end.to raise_error(Doorkeeper::Errors::InvalidTokenStrategy)
+    end
+
+    context 'when only Authorization Code strategy is enabled' do
+      before do
+        Doorkeeper.configuration.stub(:grant_flows) { ['authorization_code'] }
+      end
+
+      it 'raises error when using the disabled Implicit strategy' do
+        expect do
+          subject.authorization_request(:token)
+        end.to raise_error(Doorkeeper::Errors::InvalidAuthorizationStrategy)
+      end
+
+      it 'raises error when using the disabled Client Credentials strategy' do
+        expect do
+          subject.token_request(:client_credentials)
+        end.to raise_error(Doorkeeper::Errors::InvalidTokenStrategy)
+      end
     end
 
     it 'builds the request with selected strategy' do

data/spec/models/doorkeeper/access_grant_spec.rb

@@ -5,30 +5,30 @@ describe Doorkeeper::AccessGrant do
 
   it { should be_valid }
 
-  it_behaves_like "an accessible token"
-  it_behaves_like "a revocable token"
-  it_behaves_like "an unique token" do
+  it_behaves_like 'an accessible token'
+  it_behaves_like 'a revocable token'
+  it_behaves_like 'an unique token' do
     let(:factory_name) { :access_grant }
   end
 
-  describe "validations" do
-    it "is invalid without resource_owner_id" do
+  describe 'validations' do
+    it 'is invalid without resource_owner_id' do
       subject.resource_owner_id = nil
       should_not be_valid
     end
 
-    it "is invalid without application_id" do
+    it 'is invalid without application_id' do
       subject.application_id = nil
       should_not be_valid
     end
 
-    it "is invalid without token" do
+    it 'is invalid without token' do
       subject.save
       subject.token = nil
       should_not be_valid
     end
 
-    it "is invalid without expires_in" do
+    it 'is invalid without expires_in' do
       subject.expires_in = nil
       should_not be_valid
     end

data/spec/models/doorkeeper/access_token_spec.rb

@@ -6,9 +6,9 @@ module Doorkeeper
 
     it { should be_valid }
 
-    it_behaves_like "an accessible token"
-    it_behaves_like "a revocable token"
-    it_behaves_like "an unique token" do
+    it_behaves_like 'an accessible token'
+    it_behaves_like 'a revocable token'
+    it_behaves_like 'an unique token' do
       let(:factory_name) { :access_token }
     end
 
@@ -19,40 +19,87 @@ module Doorkeeper
       end
 
       it 'generates a refresh token if it was requested' do
-        token = FactoryGirl.create :access_token, :use_refresh_token => true
+        token = FactoryGirl.create :access_token, use_refresh_token: true
         expect(token.refresh_token).not_to be_nil
       end
 
-      it "is not valid if token exists" do
-        token1 = FactoryGirl.create :access_token, :use_refresh_token => true
-        token2 = FactoryGirl.create :access_token, :use_refresh_token => true
+      it 'is not valid if token exists' do
+        token1 = FactoryGirl.create :access_token, use_refresh_token: true
+        token2 = FactoryGirl.create :access_token, use_refresh_token: true
         token2.send :write_attribute, :refresh_token, token1.refresh_token
         expect(token2).not_to be_valid
       end
 
       it 'expects database to raise an error if refresh tokens are the same' do
-        token1 = FactoryGirl.create :access_token, :use_refresh_token => true
-        token2 = FactoryGirl.create :access_token, :use_refresh_token => true
-        expect {
+        token1 = FactoryGirl.create :access_token, use_refresh_token: true
+        token2 = FactoryGirl.create :access_token, use_refresh_token: true
+        expect do
           token2.write_attribute :refresh_token, token1.refresh_token
-          token2.save(:validate => false)
-        }.to raise_error
+          token2.save(validate: false)
+        end.to raise_error
       end
     end
 
-    describe "validations" do
-      it "is valid without resource_owner_id" do
+    describe 'validations' do
+      it 'is valid without resource_owner_id' do
         # For client credentials flow
         subject.resource_owner_id = nil
         should be_valid
       end
     end
 
+    describe '#same_credential?' do
+
+      context 'with default parameters' do
+
+        let(:resource_owner_id) { 100 }
+        let(:application)    { FactoryGirl.create :application }
+        let(:default_attributes) do
+          { application: application, resource_owner_id: resource_owner_id }
+        end
+        let(:access_token1) { FactoryGirl.create :access_token, default_attributes }
+
+        context 'the second token has the same owner and same app' do
+          let(:access_token2) { FactoryGirl.create :access_token, default_attributes }
+          it 'success' do
+            expect(access_token1.same_credential?(access_token2)).to be_true
+          end
+        end
+
+        context 'the second token has same owner and different app' do
+          let(:other_application) { FactoryGirl.create :application }
+          let(:access_token2) { FactoryGirl.create :access_token, application: other_application, resource_owner_id: resource_owner_id }
+
+          it 'fail' do
+            expect(access_token1.same_credential?(access_token2)).to be_false
+          end
+        end
+
+        context 'the second token has different owner and different app' do
+
+          let(:other_application) { FactoryGirl.create :application }
+          let(:access_token2) { FactoryGirl.create :access_token, application: other_application, resource_owner_id: 42 }
+
+          it 'fail' do
+            expect(access_token1.same_credential?(access_token2)).to be_false
+          end
+        end
+
+        context 'the second token has different owner and same app' do
+          let(:access_token2) { FactoryGirl.create :access_token, application: application, resource_owner_id: 42 }
+
+          it 'fail' do
+            expect(access_token1.same_credential?(access_token2)).to be_false
+          end
+        end
+      end
+    end
+
     describe '.revoke_all_for' do
-      let(:resource_owner) { double(:id => 100) }
+      let(:resource_owner) { double(id: 100) }
       let(:application)    { FactoryGirl.create :application }
       let(:default_attributes) do
-        { :application => application, :resource_owner_id => resource_owner.id }
+        { application: application, resource_owner_id: resource_owner.id }
       end
 
       it 'revokes all tokens for given application and resource owner' do
@@ -64,13 +111,13 @@ module Doorkeeper
       end
 
       it 'matches application' do
-        FactoryGirl.create :access_token, default_attributes.merge(:application => FactoryGirl.create(:application))
+        FactoryGirl.create :access_token, default_attributes.merge(application: FactoryGirl.create(:application))
         AccessToken.revoke_all_for application.id, resource_owner
         expect(AccessToken.all).not_to be_empty
       end
 
       it 'matches resource owner' do
-        FactoryGirl.create :access_token, default_attributes.merge(:resource_owner_id => 90)
+        FactoryGirl.create :access_token, default_attributes.merge(resource_owner_id: 90)
         AccessToken.revoke_all_for application.id, resource_owner
         expect(AccessToken.all).not_to be_empty
       end
@@ -79,9 +126,9 @@ module Doorkeeper
     describe '.matching_token_for' do
       let(:resource_owner_id) { 100 }
       let(:application)       { FactoryGirl.create :application }
-      let(:scopes)            { Doorkeeper::OAuth::Scopes.from_string("public write") }
+      let(:scopes)            { Doorkeeper::OAuth::Scopes.from_string('public write') }
       let(:default_attributes) do
-        { :application => application, :resource_owner_id => resource_owner_id, :scopes => scopes.to_s }
+        { application: application, resource_owner_id: resource_owner_id, scopes: scopes.to_s }
       end
 
       it 'returns only one token' do
@@ -91,44 +138,44 @@ module Doorkeeper
       end
 
       it 'accepts resource owner as object' do
-        resource_owner = double(:to_key => true, :id => 100)
+        resource_owner = double(to_key: true, id: 100)
         token = FactoryGirl.create :access_token, default_attributes
         last_token = AccessToken.matching_token_for(application, resource_owner, scopes)
         expect(last_token).to eq(token)
       end
 
       it 'accepts nil as resource owner' do
-        token = FactoryGirl.create :access_token, default_attributes.merge(:resource_owner_id => nil)
+        token = FactoryGirl.create :access_token, default_attributes.merge(resource_owner_id: nil)
         last_token = AccessToken.matching_token_for(application, nil, scopes)
         expect(last_token).to eq(token)
       end
 
       it 'excludes revoked tokens' do
-        FactoryGirl.create :access_token, default_attributes.merge(:revoked_at => 1.day.ago)
+        FactoryGirl.create :access_token, default_attributes.merge(revoked_at: 1.day.ago)
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to be_nil
       end
 
       it 'matches the application' do
-        token = FactoryGirl.create :access_token, default_attributes.merge(:application => FactoryGirl.create(:application))
+        token = FactoryGirl.create :access_token, default_attributes.merge(application: FactoryGirl.create(:application))
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to be_nil
       end
 
       it 'matches the resource owner' do
-        FactoryGirl.create :access_token, default_attributes.merge(:resource_owner_id => 2)
+        FactoryGirl.create :access_token, default_attributes.merge(resource_owner_id: 2)
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to be_nil
       end
 
       it 'matches the scopes' do
-        FactoryGirl.create :access_token, default_attributes.merge(:scopes => 'public email')
+        FactoryGirl.create :access_token, default_attributes.merge(scopes: 'public email')
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to be_nil
       end
 
       it 'returns the last created token' do
-        FactoryGirl.create :access_token, default_attributes.merge(:created_at => 1.day.ago)
+        FactoryGirl.create :access_token, default_attributes.merge(created_at: 1.day.ago)
         token = FactoryGirl.create :access_token, default_attributes
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to eq(token)
@@ -136,12 +183,11 @@ module Doorkeeper
 
       it 'returns as_json hash'   do
         token = FactoryGirl.create :access_token, default_attributes
-        token_hash = {
-                      :resource_owner_id => token.resource_owner_id,
-                      :scopes => token.scopes,
-                      :expires_in_seconds => token.expires_in_seconds,
-                      :application => { :uid => token.application.uid }
-                     }
+        token_hash = { resource_owner_id: token.resource_owner_id,
+                       scopes: token.scopes,
+                       expires_in_seconds: token.expires_in_seconds,
+                       application: { uid: token.application.uid }
+        }
         expect(token.as_json).to eq token_hash
       end
     end

data/spec/models/doorkeeper/application_spec.rb

@@ -4,14 +4,14 @@ module Doorkeeper
   describe Application do
     include OrmHelper
 
-    let(:require_owner) { Doorkeeper.configuration.instance_variable_set("@confirm_application_owner", true) }
-    let(:unset_require_owner) { Doorkeeper.configuration.instance_variable_set("@confirm_application_owner", false) }
+    let(:require_owner) { Doorkeeper.configuration.instance_variable_set('@confirm_application_owner', true) }
+    let(:unset_require_owner) { Doorkeeper.configuration.instance_variable_set('@confirm_application_owner', false) }
     let(:new_application) { FactoryGirl.build(:application) }
 
     let(:uid) { SecureRandom.hex(8) }
     let(:secret) { SecureRandom.hex(8) }
 
-    context "application_owner is enabled" do
+    context 'application_owner is enabled' do
       before do
         Doorkeeper.configure do
           orm DOORKEEPER_ORM
@@ -29,7 +29,7 @@ module Doorkeeper
         end
       end
 
-      context "application owner is required" do
+      context 'application owner is required' do
         before(:each) do
           require_owner
           @owner = mock_application_owner
@@ -86,9 +86,7 @@ module Doorkeeper
       app1 = FactoryGirl.create(:application)
       app2 = FactoryGirl.create(:application)
       app2.uid = app1.uid
-      expect {
-        app2.save!(:validate => false)
-      }.to raise_error
+      expect { app2.save!(validate: false) }.to raise_error
     end
 
     it 'generate secret on create' do
@@ -115,53 +113,55 @@ module Doorkeeper
       end
 
       it 'should destroy its access grants' do
-        FactoryGirl.create(:access_grant, :application => new_application)
+        FactoryGirl.create(:access_grant, application: new_application)
         expect { new_application.destroy }.to change { Doorkeeper::AccessGrant.count }.by(-1)
       end
 
       it 'should destroy its access tokens' do
-        FactoryGirl.create(:access_token, :application => new_application)
-        FactoryGirl.create(:access_token, :application => new_application, :revoked_at => Time.now)
-        expect { new_application.destroy }.to change { Doorkeeper::AccessToken.count }.by(-2)
+        FactoryGirl.create(:access_token, application: new_application)
+        FactoryGirl.create(:access_token, application: new_application, revoked_at: Time.now)
+        expect do
+          new_application.destroy
+        end.to change { Doorkeeper::AccessToken.count }.by(-2)
       end
     end
 
     describe :authorized_for do
-      let(:resource_owner) { double(:resource_owner, :id => 10) }
+      let(:resource_owner) { double(:resource_owner, id: 10) }
 
-      it "is empty if the application is not authorized for anyone" do
+      it 'is empty if the application is not authorized for anyone' do
         expect(Application.authorized_for(resource_owner)).to be_empty
       end
 
-      it "returns only application for a specific resource owner" do
-        FactoryGirl.create(:access_token, :resource_owner_id => resource_owner.id + 1)
-        token = FactoryGirl.create(:access_token, :resource_owner_id => resource_owner.id)
+      it 'returns only application for a specific resource owner' do
+        FactoryGirl.create(:access_token, resource_owner_id: resource_owner.id + 1)
+        token = FactoryGirl.create(:access_token, resource_owner_id: resource_owner.id)
         expect(Application.authorized_for(resource_owner)).to eq([token.application])
       end
 
-      it "excludes revoked tokens" do
-        FactoryGirl.create(:access_token, :resource_owner_id => resource_owner.id, :revoked_at => 2.days.ago)
+      it 'excludes revoked tokens' do
+        FactoryGirl.create(:access_token, resource_owner_id: resource_owner.id, revoked_at: 2.days.ago)
         expect(Application.authorized_for(resource_owner)).to be_empty
       end
 
-      it "returns all applications that have been authorized" do
-        token1 = FactoryGirl.create(:access_token, :resource_owner_id => resource_owner.id)
-        token2 = FactoryGirl.create(:access_token, :resource_owner_id => resource_owner.id)
+      it 'returns all applications that have been authorized' do
+        token1 = FactoryGirl.create(:access_token, resource_owner_id: resource_owner.id)
+        token2 = FactoryGirl.create(:access_token, resource_owner_id: resource_owner.id)
         expect(Application.authorized_for(resource_owner)).to eq([token1.application, token2.application])
       end
 
-      it "returns only one application even if it has been authorized twice" do
+      it 'returns only one application even if it has been authorized twice' do
         application = FactoryGirl.create(:application)
-        FactoryGirl.create(:access_token, :resource_owner_id => resource_owner.id, :application => application)
-        FactoryGirl.create(:access_token, :resource_owner_id => resource_owner.id, :application => application)
+        FactoryGirl.create(:access_token, resource_owner_id: resource_owner.id, application: application)
+        FactoryGirl.create(:access_token, resource_owner_id: resource_owner.id, application: application)
         expect(Application.authorized_for(resource_owner)).to eq([application])
       end
 
-      it "should fail to mass assign a new application", if: ::Rails::VERSION::MAJOR < 4 do
-        mass_assign = { :name => 'Something',
-                        :redirect_uri => 'http://somewhere.com/something',
-                        :uid => 123,
-                        :secret => 'something' }
+      it 'should fail to mass assign a new application', if: ::Rails::VERSION::MAJOR < 4 do
+        mass_assign = { name: 'Something',
+                        redirect_uri: 'http://somewhere.com/something',
+                        uid: 123,
+                        secret: 'something' }
         expect(Application.create(mass_assign).uid).not_to eq(123)
       end
     end