doorkeeper 3.1.0 → 4.4.3

data/spec/controllers/authorizations_controller_spec.rb

@@ -3,17 +3,33 @@ require 'spec_helper_integration'
 describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
   include AuthorizationRequestHelper
 
-  def fragments(param)
-    fragment = URI.parse(response.location).fragment
-    Rack::Utils.parse_query(fragment)[param]
+  if Rails::VERSION::MAJOR >= 5
+    class ActionDispatch::TestResponse
+      def query_params
+        @_query_params ||= begin
+          fragment = URI.parse(location).fragment
+          Rack::Utils.parse_query(fragment)
+        end
+      end
+    end
+  else
+    class ActionController::TestResponse
+      def query_params
+        @_query_params ||= begin
+          fragment = URI.parse(location).fragment
+          Rack::Utils.parse_query(fragment)
+        end
+      end
+    end
   end
 
   def translated_error_message(key)
-    I18n.translate key, scope: [:doorkeeper, :errors, :messages]
+    I18n.translate key, scope: %i[doorkeeper errors messages]
   end
 
-  let(:client) { FactoryGirl.create :application }
-  let(:user)   { User.create!(name: 'Joe', password: 'sekret') }
+  let(:client)        { FactoryBot.create :application }
+  let(:user)          { User.create!(name: 'Joe', password: 'sekret') }
+  let(:access_token)  { FactoryBot.build :access_token, resource_owner_id: user.id, application_id: client.id }
 
   before do
     allow(Doorkeeper.configuration).to receive(:grant_flows).and_return(["implicit"])
@@ -34,15 +50,15 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
     end
 
     it 'includes access token in fragment' do
-      expect(fragments('access_token')).to eq(Doorkeeper::AccessToken.first.token)
+      expect(response.query_params['access_token']).to eq(Doorkeeper::AccessToken.first.token)
     end
 
     it 'includes token type in fragment' do
-      expect(fragments('token_type')).to eq('bearer')
+      expect(response.query_params['token_type']).to eq('Bearer')
     end
 
     it 'includes token expiration in fragment' do
-      expect(fragments('expires_in').to_i).to eq(2.hours.to_i)
+      expect(response.query_params['expires_in'].to_i).to eq(2.hours.to_i)
     end
 
     it 'issues the token for the current client' do
@@ -69,15 +85,15 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
     end
 
     it 'does not include access token in fragment' do
-      expect(fragments('access_token')).to be_nil
+      expect(response.query_params['access_token']).to be_nil
     end
 
     it 'includes error in fragment' do
-      expect(fragments('error')).to eq('invalid_scope')
+      expect(response.query_params['error']).to eq('invalid_scope')
     end
 
     it 'includes error description in fragment' do
-      expect(fragments('error_description')).to eq(translated_error_message(:invalid_scope))
+      expect(response.query_params['error_description']).to eq(translated_error_message(:invalid_scope))
     end
 
     it 'does not issue any access token' do
@@ -86,16 +102,19 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
   end
 
   describe 'POST #create with application already authorized' do
-    it 'returns the existing access token in a fragment'
-  end
-
-  describe 'GET #new' do
     before do
-      get :new, client_id: client.uid, response_type: 'token', redirect_uri: client.redirect_uri
+      allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
+
+      access_token.save!
+      post :create, client_id: client.uid, response_type: 'token', redirect_uri: client.redirect_uri
+    end
+
+    it 'returns the existing access token in a fragment' do
+      expect(response.query_params['access_token']).to eq(access_token.token)
     end
 
-    it 'renders new template' do
-      expect(response).to render_template(:new)
+    it 'does not creates a new access token' do
+      expect(Doorkeeper::AccessToken.count).to eq(1)
     end
   end
 
@@ -125,7 +144,7 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
   describe 'GET #new code request with native url and skip_authorization true' do
     before do
       allow(Doorkeeper.configuration).to receive(:grant_flows).
-        and_return(%w(authorization_code))
+        and_return(%w[authorization_code])
       allow(Doorkeeper.configuration).to receive(:skip_authorization).and_return(proc do
         true
       end)
@@ -135,7 +154,7 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
 
     it 'should redirect immediately' do
       expect(response).to be_redirect
-      expect(response.location).to match(/oauth\/authorize\//)
+      expect(response.location).to match(/oauth\/authorize\/native\?code=#{Doorkeeper::AccessGrant.first.token}/)
     end
 
     it 'should issue a grant' do
@@ -145,6 +164,38 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
     it 'should not issue a token' do
       expect(Doorkeeper::AccessToken.count).to be 0
     end
+
+    context 'with opt_out_native_route_change' do
+      around(:each) do |example|
+        Doorkeeper.configure do
+          orm DOORKEEPER_ORM
+          opt_out_native_route_change
+        end
+
+        Rails.application.reload_routes!
+
+        example.run
+
+        Doorkeeper.configure do
+          orm DOORKEEPER_ORM
+        end
+
+        Rails.application.reload_routes!
+      end
+
+      it 'should redirect immediately' do
+        expect(response).to be_redirect
+        expect(response.location).to match(/oauth\/authorize\/#{Doorkeeper::AccessGrant.first.token}/)
+      end
+
+      it 'should issue a grant' do
+        expect(Doorkeeper::AccessGrant.count).to be 1
+      end
+
+      it 'should not issue a token' do
+        expect(Doorkeeper::AccessToken.count).to be 0
+      end
+    end
   end
 
   describe 'GET #new with skip_authorization true' do
@@ -165,11 +216,11 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
     end
 
     it 'includes token type in fragment' do
-      expect(fragments('token_type')).to eq('bearer')
+      expect(response.query_params['token_type']).to eq('Bearer')
     end
 
     it 'includes token expiration in fragment' do
-      expect(fragments('expires_in').to_i).to eq(2.hours.to_i)
+      expect(response.query_params['expires_in'].to_i).to eq(2.hours.to_i)
     end
 
     it 'issues the token for the current client' do
@@ -191,10 +242,6 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
       expect(response).to_not be_redirect
     end
 
-    it 'renders error template' do
-      expect(response).to render_template(:error)
-    end
-
     it 'does not issue any token' do
       expect(Doorkeeper::AccessGrant.count).to eq 0
       expect(Doorkeeper::AccessToken.count).to eq 0

data/spec/controllers/protected_resources_controller_spec.rb

@@ -2,27 +2,33 @@ require 'spec_helper_integration'
 
 module ControllerActions
   def index
-    render text: 'index'
+    render plain: 'index'
   end
 
   def show
-    render text: 'show'
+    render plain: 'show'
   end
+
+  def doorkeeper_unauthorized_render_options(*); end
+
+  def doorkeeper_forbidden_render_options(*); end
 end
 
 describe 'doorkeeper authorize filter' do
   context 'accepts token code specified as' do
     controller do
-      before_filter :doorkeeper_authorize!
+      before_action :doorkeeper_authorize!
 
       def index
-        render text: 'index'
+        render plain: 'index'
       end
     end
 
     let(:token_string) { '1A2BC3' }
     let(:token) do
-      double(Doorkeeper::AccessToken, acceptable?: true)
+      double(Doorkeeper::AccessToken,
+             acceptable?: true, previous_refresh_token: "",
+             revoke_previous_refresh_token!: true)
     end
 
     it 'access_token param' do
@@ -58,7 +64,7 @@ describe 'doorkeeper authorize filter' do
 
   context 'defined for all actions' do
     controller do
-      before_filter :doorkeeper_authorize!
+      before_action :doorkeeper_authorize!
 
       include ControllerActions
     end
@@ -66,12 +72,12 @@ describe 'doorkeeper authorize filter' do
     context 'with valid token', token: :valid do
       it 'allows into index action' do
         get :index, access_token: token_string
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       it 'allows into show action' do
         get :show, id: '4', access_token: token_string
-        expect(response).to be_success
+        expect(response).to be_successful
       end
     end
 
@@ -92,7 +98,7 @@ describe 'doorkeeper authorize filter' do
 
   context 'defined with scopes' do
     controller do
-      before_filter -> { doorkeeper_authorize! :write }
+      before_action -> { doorkeeper_authorize! :write }
 
       include ControllerActions
     end
@@ -100,17 +106,29 @@ describe 'doorkeeper authorize filter' do
     let(:token_string) { '1A2DUWE' }
 
     it 'allows if the token has particular scopes' do
-      token = double(Doorkeeper::AccessToken, accessible?: true, scopes: %w(write public))
+      token = double(Doorkeeper::AccessToken,
+                     accessible?: true, scopes: %w[write public],
+                     previous_refresh_token: "",
+                     revoke_previous_refresh_token!: true)
       expect(token).to receive(:acceptable?).with([:write]).and_return(true)
-      expect(Doorkeeper::AccessToken).to receive(:by_token).with(token_string).and_return(token)
+      expect(
+        Doorkeeper::AccessToken
+      ).to receive(:by_token).with(token_string).and_return(token)
+
       get :index, access_token: token_string
-      expect(response).to be_success
+      expect(response).to be_successful
     end
 
     it 'does not allow if the token does not include given scope' do
-      token = double(Doorkeeper::AccessToken, accessible?: true, scopes: ['public'], revoked?: false, expired?: false)
-      expect(Doorkeeper::AccessToken).to receive(:by_token).with(token_string).and_return(token)
+      token = double(Doorkeeper::AccessToken,
+                     accessible?: true, scopes: ['public'], revoked?: false,
+                     expired?: false, previous_refresh_token: "",
+                     revoke_previous_refresh_token!: true)
+      expect(
+        Doorkeeper::AccessToken
+      ).to receive(:by_token).with(token_string).and_return(token)
       expect(token).to receive(:acceptable?).with([:write]).and_return(false)
+
       get :index, access_token: token_string
       expect(response.status).to eq 403
       expect(response.header).to_not include('WWW-Authenticate')
@@ -119,7 +137,7 @@ describe 'doorkeeper authorize filter' do
 
   context 'when custom unauthorized render options are configured' do
     controller do
-      before_filter :doorkeeper_authorize!
+      before_action :doorkeeper_authorize!
 
       include ControllerActions
     end
@@ -127,13 +145,18 @@ describe 'doorkeeper authorize filter' do
     context 'with a JSON custom render', token: :invalid do
       before do
         module ControllerActions
+          remove_method :doorkeeper_unauthorized_render_options
+
           def doorkeeper_unauthorized_render_options(error: nil)
             { json: ActiveSupport::JSON.encode(error_message: error.description) }
           end
         end
       end
+
       after do
         module ControllerActions
+          remove_method :doorkeeper_unauthorized_render_options
+
           def doorkeeper_unauthorized_render_options(error: nil)
           end
         end
@@ -144,31 +167,35 @@ describe 'doorkeeper authorize filter' do
         expect(response.status).to eq 401
         expect(response.content_type).to eq('application/json')
         expect(response.header['WWW-Authenticate']).to match(/^Bearer/)
-        parsed_body = JSON.parse(response.body)
-        expect(parsed_body).not_to be_nil
-        expect(parsed_body['error_message']).to match('token is invalid')
+
+        expect(json_response).not_to be_nil
+        expect(json_response['error_message']).to match('token is invalid')
       end
     end
 
     context 'with a text custom render', token: :invalid do
       before do
         module ControllerActions
-          def doorkeeper_unauthorized_render_options(error: nil)
-            { text: 'Unauthorized' }
+          remove_method :doorkeeper_unauthorized_render_options
+
+          def doorkeeper_unauthorized_render_options(**)
+            { plain: 'Unauthorized' }
           end
         end
       end
+
       after do
         module ControllerActions
-          def doorkeeper_unauthorized_render_options(error: nil)
-          end
+          remove_method :doorkeeper_unauthorized_render_options
+
+          def doorkeeper_unauthorized_render_options(error: nil); end
         end
       end
 
       it 'it renders a custom text response', token: :invalid do
         get :index, access_token: token_string
         expect(response.status).to eq 401
-        expect(response.content_type).to eq('text/html')
+        expect(response.content_type).to eq('text/plain')
         expect(response.header['WWW-Authenticate']).to match(/^Bearer/)
         expect(response.body).to eq('Unauthorized')
       end
@@ -183,26 +210,32 @@ describe 'doorkeeper authorize filter' do
 
     after do
       module ControllerActions
-        def doorkeeper_forbidden_render_options(*)
-        end
+        remove_method :doorkeeper_forbidden_render_options
+
+        def doorkeeper_forbidden_render_options(*); end
       end
     end
 
     controller do
-      before_filter -> { doorkeeper_authorize! :write }
+      before_action -> { doorkeeper_authorize! :write }
 
       include ControllerActions
     end
 
     let(:token) do
       double(Doorkeeper::AccessToken,
-             accessible?: true, scopes: ['public'], revoked?: false, expired?: false)
+             accessible?: true, scopes: ['public'], revoked?: false,
+             expired?: false, previous_refresh_token: "",
+             revoke_previous_refresh_token!: true)
     end
+
     let(:token_string) { '1A2DUWE' }
 
     context 'with a JSON custom render' do
       before do
         module ControllerActions
+          remove_method :doorkeeper_forbidden_render_options
+
           def doorkeeper_forbidden_render_options(*)
             { json: { error_message: 'Forbidden' } }
           end
@@ -214,15 +247,16 @@ describe 'doorkeeper authorize filter' do
         expect(response.header).to_not include('WWW-Authenticate')
         expect(response.content_type).to eq('application/json')
         expect(response.status).to eq 403
-        parsed_body = JSON.parse(response.body)
-        expect(parsed_body).not_to be_nil
-        expect(parsed_body['error_message']).to match('Forbidden')
+
+        expect(json_response).not_to be_nil
+        expect(json_response['error_message']).to match('Forbidden')
       end
     end
 
     context 'with a status and JSON custom render' do
       before do
         module ControllerActions
+          remove_method :doorkeeper_forbidden_render_options
           def doorkeeper_forbidden_render_options(*)
             { json: { error_message: 'Not Found' },
               respond_not_found_when_forbidden: true }
@@ -239,8 +273,10 @@ describe 'doorkeeper authorize filter' do
     context 'with a text custom render' do
       before do
         module ControllerActions
+          remove_method :doorkeeper_forbidden_render_options
+
           def doorkeeper_forbidden_render_options(*)
-            { text: 'Forbidden' }
+            { plain: 'Forbidden' }
           end
         end
       end
@@ -256,8 +292,10 @@ describe 'doorkeeper authorize filter' do
     context 'with a status and text custom render' do
       before do
         module ControllerActions
+          remove_method :doorkeeper_forbidden_render_options
+
           def doorkeeper_forbidden_render_options(*)
-            { respond_not_found_when_forbidden: true, text: 'Not Found' }
+            { respond_not_found_when_forbidden: true, plain: 'Not Found' }
           end
         end
       end

data/spec/controllers/token_info_controller_spec.rb

@@ -1,26 +1,23 @@
 require 'spec_helper_integration'
 
 describe Doorkeeper::TokenInfoController do
-  describe 'when requesting tokeninfo with valid token' do
-    let(:doorkeeper_token) { FactoryGirl.create(:access_token) }
+  describe 'when requesting token info with valid token' do
+    let(:doorkeeper_token) { FactoryBot.create(:access_token) }
 
     before(:each) do
       allow(controller).to receive(:doorkeeper_token) { doorkeeper_token }
     end
 
-    def do_get
-      get :show
-    end
-
     describe 'successful request' do
-
       it 'responds with tokeninfo' do
-        do_get
+        get :show
+
         expect(response.body).to eq(doorkeeper_token.to_json)
       end
 
       it 'responds with a 200 status' do
-        do_get
+        get :show
+
         expect(response.status).to eq 200
       end
     end
@@ -29,8 +26,10 @@ describe Doorkeeper::TokenInfoController do
       before(:each) do
         allow(controller).to receive(:doorkeeper_token).and_return(nil)
       end
+
       it 'responds with 401 when doorkeeper_token is not valid' do
-        do_get
+        get :show
+
         expect(response.status).to eq 401
         expect(response.headers['WWW-Authenticate']).to match(/^Bearer/)
       end
@@ -38,14 +37,19 @@ describe Doorkeeper::TokenInfoController do
       it 'responds with 401 when doorkeeper_token is invalid, expired or revoked' do
         allow(controller).to receive(:doorkeeper_token).and_return(doorkeeper_token)
         allow(doorkeeper_token).to receive(:accessible?).and_return(false)
-        do_get
+
+        get :show
+
         expect(response.status).to eq 401
         expect(response.headers['WWW-Authenticate']).to match(/^Bearer/)
       end
 
       it 'responds body message for error' do
-        do_get
-        expect(response.body).to eq(Doorkeeper::OAuth::ErrorResponse.new(name: :invalid_request, status: :unauthorized).body.to_json)
+        get :show
+
+        expect(response.body).to eq(
+          Doorkeeper::OAuth::ErrorResponse.new(name: :invalid_request, status: :unauthorized).body.to_json
+        )
       end
     end
   end