doorkeeper 3.1.0 → 4.4.3

data/spec/models/doorkeeper/access_token_spec.rb

@@ -2,7 +2,7 @@ require 'spec_helper_integration'
 
 module Doorkeeper
   describe AccessToken do
-    subject { FactoryGirl.build(:access_token) }
+    subject { FactoryBot.build(:access_token) }
 
     it { expect(subject).to be_valid }
 
@@ -12,15 +12,24 @@ module Doorkeeper
       let(:factory_name) { :access_token }
     end
 
+    module CustomGeneratorArgs
+      def self.generate
+      end
+    end
+
     describe :generate_token do
       it 'generates a token using the default method' do
-        FactoryGirl.create :access_token
+        FactoryBot.create :access_token
 
-        token = FactoryGirl.create :access_token
+        token = FactoryBot.create :access_token
         expect(token.token).to be_a(String)
       end
 
       it 'generates a token using a custom object' do
+        eigenclass = class << CustomGeneratorArgs; self; end
+        eigenclass.class_eval do
+          remove_method :generate
+        end
         module CustomGeneratorArgs
           def self.generate(opts = {})
             "custom_generator_token_#{opts[:resource_owner_id]}"
@@ -32,11 +41,15 @@ module Doorkeeper
           access_token_generator "Doorkeeper::CustomGeneratorArgs"
         end
 
-        token = FactoryGirl.create :access_token
+        token = FactoryBot.create :access_token
         expect(token.token).to match(%r{custom_generator_token_\d+})
       end
 
       it 'allows the custom generator to access the application details' do
+        eigenclass = class << CustomGeneratorArgs; self; end
+        eigenclass.class_eval do
+          remove_method :generate
+        end
         module CustomGeneratorArgs
           def self.generate(opts = {})
             "custom_generator_token_#{opts[:application].name}"
@@ -48,11 +61,15 @@ module Doorkeeper
           access_token_generator "Doorkeeper::CustomGeneratorArgs"
         end
 
-        token = FactoryGirl.create :access_token
+        token = FactoryBot.create :access_token
         expect(token.token).to match(%r{custom_generator_token_Application \d+})
       end
 
       it 'allows the custom generator to access the scopes' do
+        eigenclass = class << CustomGeneratorArgs; self; end
+        eigenclass.class_eval do
+          remove_method :generate
+        end
         module CustomGeneratorArgs
           def self.generate(opts = {})
             "custom_generator_token_#{opts[:scopes].count}_#{opts[:scopes]}"
@@ -64,12 +81,16 @@ module Doorkeeper
           access_token_generator "Doorkeeper::CustomGeneratorArgs"
         end
 
-        token = FactoryGirl.create :access_token, scopes: 'public write'
+        token = FactoryBot.create :access_token, scopes: 'public write'
 
         expect(token.token).to eq 'custom_generator_token_2_public write'
       end
 
       it 'allows the custom generator to access the expiry length' do
+        eigenclass = class << CustomGeneratorArgs; self; end
+        eigenclass.class_eval do
+          remove_method :generate
+        end
         module CustomGeneratorArgs
           def self.generate(opts = {})
             "custom_generator_token_#{opts[:expires_in]}"
@@ -81,10 +102,27 @@ module Doorkeeper
           access_token_generator "Doorkeeper::CustomGeneratorArgs"
         end
 
-        token = FactoryGirl.create :access_token
+        token = FactoryBot.create :access_token
         expect(token.token).to eq 'custom_generator_token_7200'
       end
 
+      it 'allows the custom generator to access the created time' do
+        module CustomGeneratorArgs
+          def self.generate(opts = {})
+            "custom_generator_token_#{opts[:created_at].to_i}"
+          end
+        end
+
+        Doorkeeper.configure do
+          orm DOORKEEPER_ORM
+          access_token_generator "Doorkeeper::CustomGeneratorArgs"
+        end
+
+        token = FactoryBot.create :access_token
+        created_at = token.created_at
+        expect(token.token).to eq "custom_generator_token_#{created_at.to_i}"
+      end
+
       it 'raises an error if the custom object does not support generate' do
         module NoGenerate
         end
@@ -94,8 +132,31 @@ module Doorkeeper
           access_token_generator "Doorkeeper::NoGenerate"
         end
 
-        expect { FactoryGirl.create :access_token }.to(
-          raise_error(Doorkeeper::Errors::UnableToGenerateToken))
+        expect { FactoryBot.create :access_token }.to(
+          raise_error(Doorkeeper::Errors::UnableToGenerateToken)
+        )
+      end
+
+      it 'raises original error if something went wrong in custom generator' do
+        eigenclass = class << CustomGeneratorArgs; self; end
+        eigenclass.class_eval do
+          remove_method :generate
+        end
+
+        module CustomGeneratorArgs
+          def self.generate(opts = {})
+            raise LoadError, 'custom behaviour'
+          end
+        end
+
+        Doorkeeper.configure do
+          orm DOORKEEPER_ORM
+          access_token_generator "Doorkeeper::CustomGeneratorArgs"
+        end
+
+        expect { FactoryBot.create :access_token }.to(
+          raise_error(LoadError)
+        )
       end
 
       it 'raises an error if the custom object does not exist' do
@@ -104,36 +165,37 @@ module Doorkeeper
           access_token_generator "Doorkeeper::NotReal"
         end
 
-        expect { FactoryGirl.create :access_token }.to(
-          raise_error(Doorkeeper::Errors::TokenGeneratorNotFound))
+        expect { FactoryBot.create :access_token }.to(
+          raise_error(Doorkeeper::Errors::TokenGeneratorNotFound, /NotReal/)
+        )
       end
     end
 
     describe :refresh_token do
       it 'has empty refresh token if it was not required' do
-        token = FactoryGirl.create :access_token
+        token = FactoryBot.create :access_token
         expect(token.refresh_token).to be_nil
       end
 
       it 'generates a refresh token if it was requested' do
-        token = FactoryGirl.create :access_token, use_refresh_token: true
+        token = FactoryBot.create :access_token, use_refresh_token: true
         expect(token.refresh_token).not_to be_nil
       end
 
       it 'is not valid if token exists' do
-        token1 = FactoryGirl.create :access_token, use_refresh_token: true
-        token2 = FactoryGirl.create :access_token, use_refresh_token: true
+        token1 = FactoryBot.create :access_token, use_refresh_token: true
+        token2 = FactoryBot.create :access_token, use_refresh_token: true
         token2.refresh_token = token1.refresh_token
         expect(token2).not_to be_valid
       end
 
       it 'expects database to raise an error if refresh tokens are the same' do
-        token1 = FactoryGirl.create :access_token, use_refresh_token: true
-        token2 = FactoryGirl.create :access_token, use_refresh_token: true
+        token1 = FactoryBot.create :access_token, use_refresh_token: true
+        token2 = FactoryBot.create :access_token, use_refresh_token: true
         expect do
           token2.refresh_token = token1.refresh_token
           token2.save(validate: false)
-        end.to raise_error(ActiveRecord::RecordNotUnique)
+        end.to raise_error(uniqueness_error)
       end
     end
 
@@ -143,6 +205,12 @@ module Doorkeeper
         subject.resource_owner_id = nil
         expect(subject).to be_valid
       end
+
+      it 'is valid without application_id' do
+        # For resource owner credentials flow
+        subject.application_id = nil
+        expect(subject).to be_valid
+      end
     end
 
     describe '#same_credential?' do
@@ -150,22 +218,22 @@ module Doorkeeper
       context 'with default parameters' do
 
         let(:resource_owner_id) { 100 }
-        let(:application)    { FactoryGirl.create :application }
+        let(:application)    { FactoryBot.create :application }
         let(:default_attributes) do
           { application: application, resource_owner_id: resource_owner_id }
         end
-        let(:access_token1) { FactoryGirl.create :access_token, default_attributes }
+        let(:access_token1) { FactoryBot.create :access_token, default_attributes }
 
         context 'the second token has the same owner and same app' do
-          let(:access_token2) { FactoryGirl.create :access_token, default_attributes }
+          let(:access_token2) { FactoryBot.create :access_token, default_attributes }
           it 'success' do
             expect(access_token1.same_credential?(access_token2)).to be_truthy
           end
         end
 
         context 'the second token has same owner and different app' do
-          let(:other_application) { FactoryGirl.create :application }
-          let(:access_token2) { FactoryGirl.create :access_token, application: other_application, resource_owner_id: resource_owner_id }
+          let(:other_application) { FactoryBot.create :application }
+          let(:access_token2) { FactoryBot.create :access_token, application: other_application, resource_owner_id: resource_owner_id }
 
           it 'fail' do
             expect(access_token1.same_credential?(access_token2)).to be_falsey
@@ -174,8 +242,8 @@ module Doorkeeper
 
         context 'the second token has different owner and different app' do
 
-          let(:other_application) { FactoryGirl.create :application }
-          let(:access_token2) { FactoryGirl.create :access_token, application: other_application, resource_owner_id: 42 }
+          let(:other_application) { FactoryBot.create :application }
+          let(:access_token2) { FactoryBot.create :access_token, application: other_application, resource_owner_id: 42 }
 
           it 'fail' do
             expect(access_token1.same_credential?(access_token2)).to be_falsey
@@ -183,7 +251,7 @@ module Doorkeeper
         end
 
         context 'the second token has different owner and same app' do
-          let(:access_token2) { FactoryGirl.create :access_token, application: application, resource_owner_id: 42 }
+          let(:access_token2) { FactoryBot.create :access_token, application: application, resource_owner_id: 42 }
 
           it 'fail' do
             expect(access_token1.same_credential?(access_token2)).to be_falsey
@@ -194,7 +262,7 @@ module Doorkeeper
 
     describe '#acceptable?' do
       context 'a token that is not accessible' do
-        let(:token) { FactoryGirl.create(:access_token, created_at: 6.hours.ago) }
+        let(:token) { FactoryBot.create(:access_token, created_at: 6.hours.ago) }
 
         it 'should return false' do
           expect(token.acceptable?(nil)).to be false
@@ -202,7 +270,7 @@ module Doorkeeper
       end
 
       context 'a token that has the incorrect scopes' do
-        let(:token) { FactoryGirl.create(:access_token) }
+        let(:token) { FactoryBot.create(:access_token) }
 
         it 'should return false' do
           expect(token.acceptable?(['public'])).to be false
@@ -211,7 +279,7 @@ module Doorkeeper
 
       context 'a token is acceptable with the correct scopes' do
         let(:token) do
-          token = FactoryGirl.create(:access_token)
+          token = FactoryBot.create(:access_token)
           token[:scopes] = 'public'
           token
         end
@@ -224,13 +292,13 @@ module Doorkeeper
 
     describe '.revoke_all_for' do
       let(:resource_owner) { double(id: 100) }
-      let(:application)    { FactoryGirl.create :application }
+      let(:application)    { FactoryBot.create :application }
       let(:default_attributes) do
         { application: application, resource_owner_id: resource_owner.id }
       end
 
       it 'revokes all tokens for given application and resource owner' do
-        FactoryGirl.create :access_token, default_attributes
+        FactoryBot.create :access_token, default_attributes
         AccessToken.revoke_all_for application.id, resource_owner
         AccessToken.all.each do |token|
           expect(token).to be_revoked
@@ -238,13 +306,13 @@ module Doorkeeper
       end
 
       it 'matches application' do
-        FactoryGirl.create :access_token, default_attributes.merge(application: FactoryGirl.create(:application))
+        FactoryBot.create :access_token, default_attributes.merge(application: FactoryBot.create(:application))
         AccessToken.revoke_all_for application.id, resource_owner
         expect(AccessToken.all).not_to be_empty
       end
 
       it 'matches resource owner' do
-        FactoryGirl.create :access_token, default_attributes.merge(resource_owner_id: 90)
+        FactoryBot.create :access_token, default_attributes.merge(resource_owner_id: 90)
         AccessToken.revoke_all_for application.id, resource_owner
         expect(AccessToken.all).not_to be_empty
       end
@@ -252,7 +320,7 @@ module Doorkeeper
 
     describe '.matching_token_for' do
       let(:resource_owner_id) { 100 }
-      let(:application)       { FactoryGirl.create :application }
+      let(:application)       { FactoryBot.create :application }
       let(:scopes) { Doorkeeper::OAuth::Scopes.from_string('public write') }
       let(:default_attributes) do
         {
@@ -263,63 +331,63 @@ module Doorkeeper
       end
 
       it 'returns only one token' do
-        token = FactoryGirl.create :access_token, default_attributes
+        token = FactoryBot.create :access_token, default_attributes
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to eq(token)
       end
 
       it 'accepts resource owner as object' do
         resource_owner = double(to_key: true, id: 100)
-        token = FactoryGirl.create :access_token, default_attributes
+        token = FactoryBot.create :access_token, default_attributes
         last_token = AccessToken.matching_token_for(application, resource_owner, scopes)
         expect(last_token).to eq(token)
       end
 
       it 'accepts nil as resource owner' do
-        token = FactoryGirl.create :access_token, default_attributes.merge(resource_owner_id: nil)
+        token = FactoryBot.create :access_token, default_attributes.merge(resource_owner_id: nil)
         last_token = AccessToken.matching_token_for(application, nil, scopes)
         expect(last_token).to eq(token)
       end
 
       it 'excludes revoked tokens' do
-        FactoryGirl.create :access_token, default_attributes.merge(revoked_at: 1.day.ago)
+        FactoryBot.create :access_token, default_attributes.merge(revoked_at: 1.day.ago)
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to be_nil
       end
 
       it 'matches the application' do
-        FactoryGirl.create :access_token, default_attributes.merge(application: FactoryGirl.create(:application))
+        FactoryBot.create :access_token, default_attributes.merge(application: FactoryBot.create(:application))
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to be_nil
       end
 
       it 'matches the resource owner' do
-        FactoryGirl.create :access_token, default_attributes.merge(resource_owner_id: 2)
+        FactoryBot.create :access_token, default_attributes.merge(resource_owner_id: 2)
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to be_nil
       end
 
       it 'matches token with fewer scopes' do
-        FactoryGirl.create :access_token, default_attributes.merge(scopes: 'public')
+        FactoryBot.create :access_token, default_attributes.merge(scopes: 'public')
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to be_nil
       end
 
       it 'matches token with different scopes' do
-        FactoryGirl.create :access_token, default_attributes.merge(scopes: 'public email')
+        FactoryBot.create :access_token, default_attributes.merge(scopes: 'public email')
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to be_nil
       end
 
       it 'matches token with more scopes' do
-        FactoryGirl.create :access_token, default_attributes.merge(scopes: 'public write email')
+        FactoryBot.create :access_token, default_attributes.merge(scopes: 'public write email')
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to be_nil
       end
 
       it 'matches application scopes' do
-        application = FactoryGirl.create :application, scopes: "private read"
-        FactoryGirl.create :access_token, default_attributes.merge(
+        application = FactoryBot.create :application, scopes: "private read"
+        FactoryBot.create :access_token, default_attributes.merge(
           application: application
         )
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
@@ -327,14 +395,14 @@ module Doorkeeper
       end
 
       it 'returns the last created token' do
-        FactoryGirl.create :access_token, default_attributes.merge(created_at: 1.day.ago)
-        token = FactoryGirl.create :access_token, default_attributes
+        FactoryBot.create :access_token, default_attributes.merge(created_at: 1.day.ago)
+        token = FactoryBot.create :access_token, default_attributes
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to eq(token)
       end
 
       it 'returns as_json hash' do
-        token = FactoryGirl.create :access_token, default_attributes
+        token = FactoryBot.create :access_token, default_attributes
         token_hash = {
           resource_owner_id:  token.resource_owner_id,
           scopes:             token.scopes,

data/spec/models/doorkeeper/application_spec.rb

@@ -4,7 +4,7 @@ module Doorkeeper
   describe Application do
     let(:require_owner) { Doorkeeper.configuration.instance_variable_set('@confirm_application_owner', true) }
     let(:unset_require_owner) { Doorkeeper.configuration.instance_variable_set('@confirm_application_owner', false) }
-    let(:new_application) { FactoryGirl.build(:application) }
+    let(:new_application) { FactoryBot.build(:application) }
 
     let(:uid) { SecureRandom.hex(8) }
     let(:secret) { SecureRandom.hex(8) }
@@ -30,7 +30,7 @@ module Doorkeeper
       context 'application owner is required' do
         before(:each) do
           require_owner
-          @owner = FactoryGirl.build_stubbed(:user)
+          @owner = FactoryBot.build_stubbed(:doorkeeper_testing_user)
         end
 
         it 'is invalid without an owner' do
@@ -49,6 +49,11 @@ module Doorkeeper
       expect(new_application).not_to be_valid
     end
 
+    it 'is invalid without determining confidentiality' do
+      new_application.confidential = nil
+      expect(new_application).not_to be_valid
+    end
+
     it 'generates uid on create' do
       expect(new_application.uid).to be_nil
       new_application.save
@@ -80,17 +85,17 @@ module Doorkeeper
     end
 
     it 'checks uniqueness of uid' do
-      app1 = FactoryGirl.create(:application)
-      app2 = FactoryGirl.create(:application)
+      app1 = FactoryBot.create(:application)
+      app2 = FactoryBot.create(:application)
       app2.uid = app1.uid
       expect(app2).not_to be_valid
     end
 
     it 'expects database to throw an error when uids are the same' do
-      app1 = FactoryGirl.create(:application)
-      app2 = FactoryGirl.create(:application)
+      app1 = FactoryBot.create(:application)
+      app2 = FactoryBot.create(:application)
       app2.uid = app1.uid
-      expect { app2.save!(validate: false) }.to raise_error(ActiveRecord::RecordNotUnique)
+      expect { app2.save!(validate: false) }.to raise_error(uniqueness_error)
     end
 
     it 'generate secret on create' do
@@ -123,19 +128,52 @@ module Doorkeeper
       end
 
       it 'should destroy its access grants' do
-        FactoryGirl.create(:access_grant, application: new_application)
+        FactoryBot.create(:access_grant, application: new_application)
         expect { new_application.destroy }.to change { Doorkeeper::AccessGrant.count }.by(-1)
       end
 
       it 'should destroy its access tokens' do
-        FactoryGirl.create(:access_token, application: new_application)
-        FactoryGirl.create(:access_token, application: new_application, revoked_at: Time.now)
+        FactoryBot.create(:access_token, application: new_application)
+        FactoryBot.create(:access_token, application: new_application, revoked_at: Time.now.utc)
         expect do
           new_application.destroy
         end.to change { Doorkeeper::AccessToken.count }.by(-2)
       end
     end
 
+    describe :ordered_by do
+      let(:applications) { FactoryBot.create_list(:application, 5) }
+
+      context 'when a direction is not specified' do
+        it 'calls order with a default order of asc' do
+          names = applications.map(&:name).sort
+          expect(Application.ordered_by(:name).map(&:name)).to eq(names)
+        end
+      end
+
+      context 'when a direction is specified' do
+        it 'calls order with specified direction' do
+          names = applications.map(&:name).sort.reverse
+          expect(Application.ordered_by(:name, :desc).map(&:name)).to eq(names)
+        end
+      end
+    end
+
+    describe "#redirect_uri=" do
+      context "when array of valid redirect_uris" do
+        it "should join by newline" do
+          new_application.redirect_uri = ['http://localhost/callback1', 'http://localhost/callback2']
+          expect(new_application.redirect_uri).to eq("http://localhost/callback1\nhttp://localhost/callback2")
+        end
+      end
+      context "when string of valid redirect_uris" do
+        it "should store as-is" do
+          new_application.redirect_uri = "http://localhost/callback1\nhttp://localhost/callback2"
+          expect(new_application.redirect_uri).to eq("http://localhost/callback1\nhttp://localhost/callback2")
+        end
+      end
+    end
+
     describe :authorized_for do
       let(:resource_owner) { double(:resource_owner, id: 10) }
 
@@ -144,43 +182,121 @@ module Doorkeeper
       end
 
       it 'returns only application for a specific resource owner' do
-        FactoryGirl.create(:access_token, resource_owner_id: resource_owner.id + 1)
-        token = FactoryGirl.create(:access_token, resource_owner_id: resource_owner.id)
+        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id + 1)
+        token = FactoryBot.create(:access_token, resource_owner_id: resource_owner.id)
         expect(Application.authorized_for(resource_owner)).to eq([token.application])
       end
 
       it 'excludes revoked tokens' do
-        FactoryGirl.create(:access_token, resource_owner_id: resource_owner.id, revoked_at: 2.days.ago)
+        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id, revoked_at: 2.days.ago)
         expect(Application.authorized_for(resource_owner)).to be_empty
       end
 
       it 'returns all applications that have been authorized' do
-        token1 = FactoryGirl.create(:access_token, resource_owner_id: resource_owner.id)
-        token2 = FactoryGirl.create(:access_token, resource_owner_id: resource_owner.id)
+        token1 = FactoryBot.create(:access_token, resource_owner_id: resource_owner.id)
+        token2 = FactoryBot.create(:access_token, resource_owner_id: resource_owner.id)
         expect(Application.authorized_for(resource_owner)).to eq([token1.application, token2.application])
       end
 
       it 'returns only one application even if it has been authorized twice' do
-        application = FactoryGirl.create(:application)
-        FactoryGirl.create(:access_token, resource_owner_id: resource_owner.id, application: application)
-        FactoryGirl.create(:access_token, resource_owner_id: resource_owner.id, application: application)
+        application = FactoryBot.create(:application)
+        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id, application: application)
+        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id, application: application)
         expect(Application.authorized_for(resource_owner)).to eq([application])
       end
+    end
 
-      it 'should fail to mass assign a new application', if: ::Rails::VERSION::MAJOR < 4 do
-        mass_assign = { name: 'Something',
-                        redirect_uri: 'http://somewhere.com/something',
-                        uid: 123,
-                        secret: 'something' }
-        expect(Application.create(mass_assign).uid).not_to eq(123)
+    describe :by_uid_and_secret do
+      context "when application is private/confidential" do
+        it "finds the application via uid/secret" do
+          app = FactoryBot.create :application
+          authenticated = Application.by_uid_and_secret(app.uid, app.secret)
+          expect(authenticated).to eq(app)
+        end
+        context "when secret is wrong" do
+          it "should not find the application" do
+            app = FactoryBot.create :application
+            authenticated = Application.by_uid_and_secret(app.uid, 'bad')
+            expect(authenticated).to eq(nil)
+          end
+        end
+      end
+
+      context "when application is public/non-confidential" do
+        context "when secret is blank" do
+          it "should find the application" do
+            app = FactoryBot.create :application, confidential: false
+            authenticated = Application.by_uid_and_secret(app.uid, nil)
+            expect(authenticated).to eq(app)
+          end
+        end
+        context "when secret is wrong" do
+          it "should not find the application" do
+            app = FactoryBot.create :application, confidential: false
+            authenticated = Application.by_uid_and_secret(app.uid, 'bad')
+            expect(authenticated).to eq(nil)
+          end
+        end
+      end
+    end
+
+    describe :confidential? do
+      subject { FactoryBot.create(:application, confidential: confidential).confidential? }
+
+      context 'when application is private/confidential' do
+        let(:confidential) { true }
+        it { expect(subject).to eq(true) }
+      end
+
+      context 'when application is public/non-confidential' do
+        let(:confidential) { false }
+        it { expect(subject).to eq(false) }
+      end
+    end
+
+    describe :confidential do
+      subject { FactoryBot.create(:application, confidential: confidential).confidential }
+
+      context 'when application is private/confidential' do
+        let(:confidential) { true }
+        it { expect(subject).to eq(true) }
+      end
+
+      context 'when application is public/non-confidential' do
+        let(:confidential) { false }
+        it { expect(subject).to eq(false) }
+      end
+
+      context 'when the application does not support confidentiality' do
+        let(:confidential) { false }
+
+        before { allow(Application).to receive(:supports_confidentiality?).and_return(false) }
+
+        it 'warns of the CVE' do
+          expect(ActiveSupport::Deprecation).to receive(:warn).with(
+            'You are susceptible to security bug ' \
+            'CVE-2018-1000211. Please follow instructions outlined in ' \
+            'Doorkeeper::CVE_2018_1000211_WARNING'
+          )
+          Application.new.confidential
+        end
+
+        it { expect(subject).to eq(true) }
       end
     end
 
-    describe :authenticate do
-      it 'finds the application via uid/secret' do
-        app = FactoryGirl.create :application
-        authenticated = Application.by_uid_and_secret(app.uid, app.secret)
-        expect(authenticated).to eq(app)
+    describe :supports_confidentiality? do
+      context 'when no column' do
+        it 'returns false' do
+          expect(Application).to receive(:column_names).and_return(%w[foo bar])
+          expect(Application.supports_confidentiality?).to eq(false)
+        end
+      end
+      context 'when column' do
+        it 'returns true' do
+          expect(Application).to receive(:column_names).and_return(%w[foo bar confidential])
+          expect(Application.supports_confidentiality?).to eq(true)
+        end
       end
     end
   end