doorkeeper 3.1.0 → 4.4.3

data/spec/lib/oauth/error_response_spec.rb

@@ -43,19 +43,19 @@ module Doorkeeper::OAuth
       end
     end
 
-    describe '.authenticate_info' do
+    describe '.headers' do
       let(:error_response) { ErrorResponse.new(name: :some_error, state: :some_state) }
-      subject { error_response.authenticate_info }
+      subject { error_response.headers }
 
-      it { expect(subject).to include("realm=\"#{error_response.realm}\"") }
-      it { expect(subject).to include("error=\"#{error_response.name}\"") }
-      it { expect(subject).to include("error_description=\"#{error_response.description}\"") }
-    end
+      it { expect(subject).to include 'WWW-Authenticate' }
 
-    describe '.headers' do
-      subject { ErrorResponse.new(name: :some_error, state: :some_state).headers }
+      describe "WWW-Authenticate header" do
+        subject { error_response.headers["WWW-Authenticate"] }
 
-      it { expect(subject).to include 'WWW-Authenticate' }
+        it { expect(subject).to include("realm=\"#{error_response.realm}\"") }
+        it { expect(subject).to include("error=\"#{error_response.name}\"") }
+        it { expect(subject).to include("error_description=\"#{error_response.description}\"") }
+      end
     end
   end
 end

data/spec/lib/oauth/error_spec.rb

@@ -13,7 +13,7 @@ module Doorkeeper::OAuth
       it 'is translated from translation messages' do
         expect(I18n).to receive(:translate).with(
           :some_error,
-          scope: [:doorkeeper, :errors, :messages],
+          scope: %i[doorkeeper errors messages],
           default: :server_error
         )
         error.description

data/spec/lib/oauth/helpers/uri_checker_spec.rb

@@ -5,6 +5,11 @@ require 'doorkeeper/oauth/helpers/uri_checker'
 module Doorkeeper::OAuth::Helpers
   describe URIChecker do
     describe '.valid?' do
+      it 'is valid for native uris' do
+        uri = 'urn:ietf:wg:oauth:2.0:oob'
+        expect(URIChecker.valid?(uri)).to be_truthy
+      end
+
       it 'is valid for valid uris' do
         uri = 'http://app.co'
         expect(URIChecker.valid?(uri)).to be_truthy
@@ -39,6 +44,11 @@ module Doorkeeper::OAuth::Helpers
         uri = 'http://'
         expect(URIChecker.valid?(uri)).to be_falsey
       end
+
+      it 'is invalid if is not an uri' do
+        uri = '   '
+        expect(URIChecker.valid?(uri)).to be_falsey
+      end
     end
 
     describe '.matches?' do
@@ -64,6 +74,44 @@ module Doorkeeper::OAuth::Helpers
         client_uri = 'http://example.com?app.co=test'
         expect(URIChecker.matches?(uri, client_uri)).to be_falsey
       end
+
+      context "client registered query params" do
+        it "doesn't allow query being absent" do
+          uri = 'http://app.co'
+          client_uri = 'http://app.co/?vendorId=AJ4L7XXW9'
+          expect(URIChecker.matches?(uri, client_uri)).to be_falsey
+        end
+
+        it "is false if query values differ but key same" do
+          uri = 'http://app.co/?vendorId=pancakes'
+          client_uri = 'http://app.co/?vendorId=waffles'
+          expect(URIChecker.matches?(uri, client_uri)).to be_falsey
+        end
+
+        it "is false if query values same but key differs" do
+          uri = 'http://app.co/?foo=pancakes'
+          client_uri = 'http://app.co/?bar=pancakes'
+          expect(URIChecker.matches?(uri, client_uri)).to be_falsey
+        end
+
+        it "is false if query present and match, but unknown queries present" do
+          uri = 'http://app.co/?vendorId=pancakes&unknown=query'
+          client_uri = 'http://app.co/?vendorId=waffles'
+          expect(URIChecker.matches?(uri, client_uri)).to be_falsey
+        end
+
+        it "is true if queries are present and matche" do
+          uri = 'http://app.co/?vendorId=AJ4L7XXW9&foo=bar'
+          client_uri = 'http://app.co/?vendorId=AJ4L7XXW9&foo=bar'
+          expect(URIChecker.matches?(uri, client_uri)).to be_truthy
+        end
+
+        it "is true if queries are present, match and in different order" do
+          uri = 'http://app.co/?bing=bang&foo=bar'
+          client_uri = 'http://app.co/?foo=bar&bing=bang'
+          expect(URIChecker.matches?(uri, client_uri)).to be_truthy
+        end
+      end
     end
 
     describe '.valid_for_authorization?' do
@@ -96,9 +144,75 @@ module Doorkeeper::OAuth::Helpers
       end
 
       it 'is false if invalid' do
-        uri = client_uri = 'http://app.co/aaa?waffles=abc'
+        uri = 'http://app.co/aaa?pankcakes=abc'
+        client_uri = 'http://app.co/aaa?waffles=abc'
         expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be false
       end
+
+      it 'calls .matches?' do
+        uri = 'http://app.co/aaa?pankcakes=abc'
+        client_uri = 'http://app.co/aaa?waffles=abc'
+        expect(URIChecker).to receive(:matches?).with(uri, client_uri).once
+        URIChecker.valid_for_authorization?(uri, client_uri)
+      end
+
+      it 'calls .valid?' do
+        uri = 'http://app.co/aaa?pankcakes=abc'
+        client_uri = 'http://app.co/aaa?waffles=abc'
+        expect(URIChecker).to receive(:valid?).with(uri).once
+        URIChecker.valid_for_authorization?(uri, client_uri)
+      end
+    end
+
+    describe '.query_matches?' do
+      it 'is true if no queries' do
+        expect(URIChecker.query_matches?('', '')).to be_truthy
+        expect(URIChecker.query_matches?(nil, nil)).to be_truthy
+      end
+
+      it 'is true if same query' do
+        expect(URIChecker.query_matches?('foo', 'foo')).to be_truthy
+      end
+
+      it 'is false if different query' do
+        expect(URIChecker.query_matches?('foo', 'bar')).to be_falsey
+      end
+
+      it 'is true if same queries' do
+        expect(URIChecker.query_matches?('foo&bar', 'foo&bar')).to be_truthy
+      end
+
+      it 'is true if same queries, different order' do
+        expect(URIChecker.query_matches?('foo&bar', 'bar&foo')).to be_truthy
+      end
+
+      it 'is false if one different query' do
+        expect(URIChecker.query_matches?('foo&bang', 'foo&bing')).to be_falsey
+      end
+
+      it 'is true if same query with same value' do
+        expect(URIChecker.query_matches?('foo=bar', 'foo=bar')).to be_truthy
+      end
+
+      it 'is true if same queries with same values' do
+        expect(URIChecker.query_matches?('foo=bar&bing=bang', 'foo=bar&bing=bang')).to be_truthy
+      end
+
+      it 'is true if same queries with same values, different order' do
+        expect(URIChecker.query_matches?('foo=bar&bing=bang', 'bing=bang&foo=bar')).to be_truthy
+      end
+
+      it 'is false if same query with different value' do
+        expect(URIChecker.query_matches?('foo=bar', 'foo=bang')).to be_falsey
+      end
+
+      it 'is false if some queries missing' do
+        expect(URIChecker.query_matches?('foo=bar', 'foo=bar&bing=bang')).to be_falsey
+      end
+
+      it 'is false if some queries different value' do
+        expect(URIChecker.query_matches?('foo=bar&bing=bang', 'foo=bar&bing=banana')).to be_falsey
+      end
     end
   end
 end

data/spec/lib/oauth/invalid_token_response_spec.rb

@@ -5,23 +5,51 @@ require 'doorkeeper/oauth/invalid_token_response'
 
 module Doorkeeper::OAuth
   describe InvalidTokenResponse do
-    describe '#name' do
+    describe "#name" do
       it  { expect(subject.name).to eq(:invalid_token) }
     end
 
-    describe '#status' do
+    describe "#status" do
       it { expect(subject.status).to eq(:unauthorized) }
     end
 
     describe :from_access_token do
-      it 'revoked' do
-        response = InvalidTokenResponse.from_access_token double(revoked?: true, expired?: true)
-        expect(response.description).to include('revoked')
+      let(:response) { InvalidTokenResponse.from_access_token(access_token) }
+
+      context "revoked" do
+        let(:access_token) { double(revoked?: true, expired?: true) }
+
+        it "sets a description" do
+          expect(response.description).to include("revoked")
+        end
+
+        it "sets the reason" do
+          expect(response.reason).to eq(:revoked)
+        end
       end
 
-      it 'expired' do
-        response = InvalidTokenResponse.from_access_token double(revoked?: false, expired?: true)
-        expect(response.description).to include('expired')
+      context "expired" do
+        let(:access_token) { double(revoked?: false, expired?: true) }
+
+        it "sets a description" do
+          expect(response.description).to include("expired")
+        end
+
+        it "sets the reason" do
+          expect(response.reason).to eq(:expired)
+        end
+      end
+
+      context "unknown" do
+        let(:access_token) { double(revoked?: false, expired?: false) }
+
+        it "sets a description" do
+          expect(response.description).to include("invalid")
+        end
+
+        it "sets the reason" do
+          expect(response.reason).to eq(:unknown)
+        end
       end
     end
   end

data/spec/lib/oauth/password_access_token_request_spec.rb

@@ -11,23 +11,22 @@ module Doorkeeper::OAuth
         custom_access_token_expires_in: ->(_app) { nil }
       )
     end
-    let(:credentials) { Client::Credentials.new(client.uid, client.secret) }
-    let(:client) { FactoryGirl.create(:application) }
+    let(:client) { FactoryBot.create(:application) }
     let(:owner)  { double :owner, id: 99 }
 
     subject do
-      PasswordAccessTokenRequest.new(server, credentials, owner)
+      PasswordAccessTokenRequest.new(server, client, owner)
     end
 
     it 'issues a new token for the client' do
       expect do
         subject.authorize
-      end.to change { client.access_tokens.count }.by(1)
+      end.to change { client.reload.access_tokens.count }.by(1)
     end
 
     it 'issues a new token without a client' do
       expect do
-        subject.credentials = nil
+        subject.client = nil
         subject.authorize
       end.to change { Doorkeeper::AccessToken.count }.by(1)
     end
@@ -35,6 +34,7 @@ module Doorkeeper::OAuth
     it 'does not issue a new token with an invalid client' do
       expect do
         subject.client = nil
+        subject.parameters = { client_id: 'bad_id' }
         subject.authorize
       end.to_not change { Doorkeeper::AccessToken.count }
 
@@ -48,12 +48,12 @@ module Doorkeeper::OAuth
     end
 
     it 'optionally accepts the client' do
-      subject.credentials = nil
+      subject.client = nil
       expect(subject).to be_valid
     end
 
     it 'creates token even when there is already one (default)' do
-      FactoryGirl.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
+      FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
       expect do
         subject.authorize
       end.to change { Doorkeeper::AccessToken.count }.by(1)
@@ -61,12 +61,18 @@ module Doorkeeper::OAuth
 
     it 'skips token creation if there is already one' do
       allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-      FactoryGirl.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
+      FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
       expect do
         subject.authorize
       end.to_not change { Doorkeeper::AccessToken.count }
     end
 
+    it "calls configured request callback methods" do
+      expect(Doorkeeper.configuration.before_successful_strategy_response).to receive(:call).with(subject).once
+      expect(Doorkeeper.configuration.after_successful_strategy_response).to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
+      subject.authorize
+    end
+
     describe 'with scopes' do
       subject do
         PasswordAccessTokenRequest.new(server, client, owner, scope: 'public')

data/spec/lib/oauth/pre_authorization_spec.rb

@@ -123,14 +123,19 @@ module Doorkeeper::OAuth
       expect(subject.scopes).to eq(Scopes.from_string('default'))
     end
 
-    it 'accepts test uri' do
-      subject.redirect_uri = 'urn:ietf:wg:oauth:2.0:oob'
-      expect(subject).to be_authorizable
-    end
+    context 'with native redirect uri' do
+      let(:native_redirect_uri) { 'urn:ietf:wg:oauth:2.0:oob' }
 
-    it 'matches the redirect uri against client\'s one' do
-      subject.redirect_uri = 'http://nothesame.com'
-      expect(subject).not_to be_authorizable
+      it 'accepts redirect_uri when it matches with the client' do
+        subject.redirect_uri = native_redirect_uri
+        allow(subject.client).to receive(:redirect_uri) { native_redirect_uri }
+        expect(subject).to be_authorizable
+      end
+
+      it 'invalidates redirect_uri when it does\'n match with the client' do
+        subject.redirect_uri = native_redirect_uri
+        expect(subject).not_to be_authorizable
+      end
     end
 
     it 'stores the state' do

data/spec/lib/oauth/refresh_token_request_spec.rb

@@ -2,24 +2,29 @@ require 'spec_helper_integration'
 
 module Doorkeeper::OAuth
   describe RefreshTokenRequest do
+    before do
+      allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(false)
+    end
+
     let(:server) do
       double :server,
              access_token_expires_in: 2.minutes,
              custom_access_token_expires_in: -> (_oauth_client) { nil }
     end
+
     let(:refresh_token) do
-      FactoryGirl.create(:access_token, use_refresh_token: true)
+      FactoryBot.create(:access_token, use_refresh_token: true)
     end
+
     let(:client) { refresh_token.application }
     let(:credentials) { Client::Credentials.new(client.uid, client.secret) }
 
     subject { RefreshTokenRequest.new server, refresh_token, credentials }
 
     it 'issues a new token for the client' do
-      expect do
-        subject.authorize
-      end.to change { client.access_tokens.count }.by(1)
-      expect(client.reload.access_tokens.last.expires_in).to eq(120)
+      expect { subject.authorize }.to change { client.reload.access_tokens.count }.by(1)
+      # #sort_by used for MongoDB ORM extensions for valid ordering
+      expect(client.reload.access_tokens.sort_by(&:created_at).last.expires_in).to eq(120)
     end
 
     it 'issues a new token for the client with custom expires_in' do
@@ -27,15 +32,24 @@ module Doorkeeper::OAuth
                       access_token_expires_in: 2.minutes,
                       custom_access_token_expires_in: ->(_oauth_client) { 1234 }
 
+      allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(false)
+
       RefreshTokenRequest.new(server, refresh_token, credentials).authorize
 
-      expect(client.reload.access_tokens.last.expires_in).to eq(1234)
+      # #sort_by used for MongoDB ORM extensions for valid ordering
+      expect(client.reload.access_tokens.sort_by(&:created_at).last.expires_in).to eq(1234)
     end
 
     it 'revokes the previous token' do
       expect { subject.authorize }.to change { refresh_token.revoked? }.from(false).to(true)
     end
 
+    it "calls configured request callback methods" do
+      expect(Doorkeeper.configuration.before_successful_strategy_response).to receive(:call).with(subject).once
+      expect(Doorkeeper.configuration.after_successful_strategy_response).to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
+      subject.authorize
+    end
+
     it 'requires the refresh token' do
       subject.refresh_token = nil
       subject.validate
@@ -49,7 +63,7 @@ module Doorkeeper::OAuth
     end
 
     it "requires the token's client and current client to match" do
-      subject.client = FactoryGirl.create(:application)
+      subject.client = FactoryBot.create(:application)
       subject.validate
       expect(subject.error).to eq(:invalid_grant)
     end
@@ -67,8 +81,37 @@ module Doorkeeper::OAuth
       expect(subject).to be_valid
     end
 
+    context 'refresh tokens expire on access token use' do
+      let(:server) do
+        double :server,
+               access_token_expires_in: 2.minutes,
+               custom_access_token_expires_in: ->(_oauth_client) { 1234 }
+      end
+
+      before do
+        allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(true)
+      end
+
+      it 'issues a new token for the client' do
+        expect { subject.authorize }.to change { client.reload.access_tokens.count }.by(1)
+      end
+
+      it 'does not revoke the previous token' do
+        subject.authorize
+        expect(refresh_token).not_to be_revoked
+      end
+
+      it 'sets the previous refresh token in the new access token' do
+        subject.authorize
+        expect(
+          # #sort_by used for MongoDB ORM extensions for valid ordering
+          client.access_tokens.sort_by(&:created_at).last.previous_refresh_token
+        ).to eq(refresh_token.refresh_token)
+      end
+    end
+
     context 'clientless access tokens' do
-      let!(:refresh_token) { FactoryGirl.create(:clientless_access_token, use_refresh_token: true) }
+      let!(:refresh_token) { FactoryBot.create(:clientless_access_token, use_refresh_token: true) }
 
       subject { RefreshTokenRequest.new server, refresh_token, nil }
 
@@ -79,7 +122,7 @@ module Doorkeeper::OAuth
 
     context 'with scopes' do
       let(:refresh_token) do
-        FactoryGirl.create :access_token,
+        FactoryBot.create :access_token,
                            use_refresh_token: true,
                            scopes: 'public write'
       end

data/spec/lib/oauth/scopes_spec.rb

@@ -62,15 +62,19 @@ module Doorkeeper::OAuth
     describe '#+' do
       it 'can add to another scope object' do
         scopes = Scopes.from_string('public') + Scopes.from_string('admin')
-        expect(scopes.all).to eq(%w(public admin))
+        expect(scopes.all).to eq(%w[public admin])
       end
 
       it 'does not change the existing object' do
         origin = Scopes.from_string('public')
-        new_scope = origin + Scopes.from_string('admin')
         expect(origin.to_s).to eq('public')
       end
 
+      it 'can add an array to a scope object' do
+        scopes = Scopes.from_string('public') + ['admin']
+        expect(scopes.all).to eq(%w[public admin])
+      end
+
       it 'raises an error if cannot handle addition' do
         expect do
           Scopes.from_string('public') + 'admin'
@@ -78,6 +82,24 @@ module Doorkeeper::OAuth
       end
     end
 
+    describe '#&' do
+      it 'can get intersection with another scope object' do
+        scopes = Scopes.from_string('public admin') & Scopes.from_string('write admin')
+        expect(scopes.all).to eq(%w[admin])
+      end
+
+      it 'does not change the existing object' do
+        origin = Scopes.from_string('public admin')
+        origin & Scopes.from_string('write admin')
+        expect(origin.to_s).to eq('public admin')
+      end
+
+      it 'can get intersection with an array' do
+        scopes = Scopes.from_string('public admin') & %w[write admin]
+        expect(scopes.all).to eq(%w[admin])
+      end
+    end
+
     describe '#==' do
       it 'is equal to another set of scopes' do
         expect(Scopes.from_string('public')).to eq(Scopes.from_string('public'))
@@ -90,6 +112,10 @@ module Doorkeeper::OAuth
       it 'differs from another set of scopes when scopes are not the same' do
         expect(Scopes.from_string('public write')).not_to eq(Scopes.from_string('write'))
       end
+
+      it "does not raise an error when compared to a non-enumerable object" do
+        expect { Scopes.from_string("public") == false }.not_to raise_error
+      end
     end
 
     describe '#has_scopes?' do

data/spec/lib/oauth/token_request_spec.rb

@@ -6,6 +6,7 @@ module Doorkeeper::OAuth
       scopes = double(all: ['public'])
       double(:application, id: 9990, scopes: scopes)
     end
+
     let :pre_auth do
       double(
         :pre_auth,
@@ -38,9 +39,7 @@ module Doorkeeper::OAuth
 
     it 'does not create token when not authorizable' do
       allow(pre_auth).to receive(:authorizable?).and_return(false)
-      expect do
-        subject.authorize
-      end.to_not change { Doorkeeper::AccessToken.count }
+      expect { subject.authorize }.not_to change { Doorkeeper::AccessToken.count }
     end
 
     it 'returns a error response' do
@@ -75,7 +74,7 @@ module Doorkeeper::OAuth
 
       it 'creates a new token if scopes do not match' do
         allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-        FactoryGirl.create(:access_token, application_id: pre_auth.client.id,
+        FactoryBot.create(:access_token, application_id: pre_auth.client.id,
                            resource_owner_id: owner.id, scopes: '')
         expect do
           subject.authorize
@@ -86,12 +85,11 @@ module Doorkeeper::OAuth
         allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
         allow(application.scopes).to receive(:has_scopes?).and_return(true)
         allow(application.scopes).to receive(:all?).and_return(true)
-        FactoryGirl.create(:access_token, application_id: pre_auth.client.id,
+
+        FactoryBot.create(:access_token, application_id: pre_auth.client.id,
                            resource_owner_id: owner.id, scopes: 'public')
 
-        expect do
-          subject.authorize
-        end.to_not change { Doorkeeper::AccessToken.count }
+        expect { subject.authorize }.not_to change { Doorkeeper::AccessToken.count }
       end
     end
   end

data/spec/lib/oauth/token_spec.rb

@@ -30,7 +30,7 @@ module Doorkeeper
         it 'stops at the first credentials found' do
           not_called_method = double
           expect(not_called_method).not_to receive(:call)
-          Token.from_request request, ->(r) {}, method, not_called_method
+          Token.from_request request, ->(_r) {}, method, not_called_method
         end
 
         it 'returns the credential from extractor method' do
@@ -96,13 +96,20 @@ module Doorkeeper
       end
 
       describe :authenticate do
-        let(:finder) { double :finder }
-
-        it 'calls the finder if token was found' do
-          token = ->(r) { 'token' }
+        it 'calls the finder if token was returned' do
+          token = ->(_r) { 'token' }
           expect(AccessToken).to receive(:by_token).with('token')
           Token.authenticate double, token
         end
+
+        it 'revokes previous refresh_token if token was found' do
+          token = ->(_r) { 'token' }
+          expect(
+            AccessToken
+          ).to receive(:by_token).with('token').and_return(token)
+          expect(token).to receive(:revoke_previous_refresh_token!)
+          Token.authenticate double, token
+        end
       end
     end
   end

data/spec/lib/server_spec.rb

@@ -1,7 +1,4 @@
 require 'spec_helper'
-require 'active_support/all'
-require 'doorkeeper/errors'
-require 'doorkeeper/server'
 
 describe Doorkeeper::Server do
   let(:fake_class) { double :fake_class }
@@ -48,5 +45,15 @@ describe Doorkeeper::Server do
       expect(fake_class).to receive(:new).with(subject)
       subject.authorization_request :code
     end
+
+    it 'builds the request with composit strategy name' do
+      allow(Doorkeeper.configuration).
+        to receive(:authorization_response_types).
+        and_return(['id_token token'])
+
+      stub_const 'Doorkeeper::Request::IdTokenToken', fake_class
+      expect(fake_class).to receive(:new).with(subject)
+      subject.authorization_request 'id_token token'
+    end
   end
 end

data/spec/models/doorkeeper/access_grant_spec.rb

@@ -1,7 +1,7 @@
 require 'spec_helper_integration'
 
 describe Doorkeeper::AccessGrant do
-  subject { FactoryGirl.build(:access_grant) }
+  subject { FactoryBot.build(:access_grant) }
 
   it { expect(subject).to be_valid }