doorkeeper 4.2.5 → 5.0.0.rc1

data/spec/lib/oauth/helpers/uri_checker_spec.rb

@@ -1,6 +1,4 @@
 require 'spec_helper'
-require 'uri'
-require 'doorkeeper/oauth/helpers/uri_checker'
 
 module Doorkeeper::OAuth::Helpers
   describe URIChecker do
@@ -39,6 +37,16 @@ module Doorkeeper::OAuth::Helpers
         uri = 'http://'
         expect(URIChecker.valid?(uri)).to be_falsey
       end
+
+      it 'is invalid if is not an uri' do
+        uri = '   '
+        expect(URIChecker.valid?(uri)).to be_falsey
+      end
+
+      it 'is valid for native uris' do
+        uri = 'urn:ietf:wg:oauth:2.0:oob'
+        expect(URIChecker.valid?(uri)).to be_truthy
+      end
     end
 
     describe '.matches?' do
@@ -64,6 +72,44 @@ module Doorkeeper::OAuth::Helpers
         client_uri = 'http://example.com?app.co=test'
         expect(URIChecker.matches?(uri, client_uri)).to be_falsey
       end
+
+      context "client registered query params" do
+        it "doesn't allow query being absent" do
+          uri = 'http://app.co'
+          client_uri = 'http://app.co/?vendorId=AJ4L7XXW9'
+          expect(URIChecker.matches?(uri, client_uri)).to be_falsey
+        end
+
+        it "is false if query values differ but key same" do
+          uri = 'http://app.co/?vendorId=pancakes'
+          client_uri = 'http://app.co/?vendorId=waffles'
+          expect(URIChecker.matches?(uri, client_uri)).to be_falsey
+        end
+
+        it "is false if query values same but key differs" do
+          uri = 'http://app.co/?foo=pancakes'
+          client_uri = 'http://app.co/?bar=pancakes'
+          expect(URIChecker.matches?(uri, client_uri)).to be_falsey
+        end
+
+        it "is false if query present and match, but unknown queries present" do
+          uri = 'http://app.co/?vendorId=pancakes&unknown=query'
+          client_uri = 'http://app.co/?vendorId=waffles'
+          expect(URIChecker.matches?(uri, client_uri)).to be_falsey
+        end
+
+        it "is true if queries are present and matche" do
+          uri = 'http://app.co/?vendorId=AJ4L7XXW9&foo=bar'
+          client_uri = 'http://app.co/?vendorId=AJ4L7XXW9&foo=bar'
+          expect(URIChecker.matches?(uri, client_uri)).to be_truthy
+        end
+
+        it "is true if queries are present, match and in different order" do
+          uri = 'http://app.co/?bing=bang&foo=bar'
+          client_uri = 'http://app.co/?foo=bar&bing=bang'
+          expect(URIChecker.matches?(uri, client_uri)).to be_truthy
+        end
+      end
     end
 
     describe '.valid_for_authorization?' do
@@ -96,9 +142,75 @@ module Doorkeeper::OAuth::Helpers
       end
 
       it 'is false if invalid' do
-        uri = client_uri = 'http://app.co/aaa?waffles=abc'
+        uri = 'http://app.co/aaa?pankcakes=abc'
+        client_uri = 'http://app.co/aaa?waffles=abc'
         expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be false
       end
+
+      it 'calls .matches?' do
+        uri = 'http://app.co/aaa?pankcakes=abc'
+        client_uri = 'http://app.co/aaa?waffles=abc'
+        expect(URIChecker).to receive(:matches?).with(uri, client_uri).once
+        URIChecker.valid_for_authorization?(uri, client_uri)
+      end
+
+      it 'calls .valid?' do
+        uri = 'http://app.co/aaa?pankcakes=abc'
+        client_uri = 'http://app.co/aaa?waffles=abc'
+        expect(URIChecker).to receive(:valid?).with(uri).once
+        URIChecker.valid_for_authorization?(uri, client_uri)
+      end
+    end
+
+    describe '.query_matches?' do
+      it 'is true if no queries' do
+        expect(URIChecker.query_matches?('', '')).to be_truthy
+        expect(URIChecker.query_matches?(nil, nil)).to be_truthy
+      end
+
+      it 'is true if same query' do
+        expect(URIChecker.query_matches?('foo', 'foo')).to be_truthy
+      end
+
+      it 'is false if different query' do
+        expect(URIChecker.query_matches?('foo', 'bar')).to be_falsey
+      end
+
+      it 'is true if same queries' do
+        expect(URIChecker.query_matches?('foo&bar', 'foo&bar')).to be_truthy
+      end
+
+      it 'is true if same queries, different order' do
+        expect(URIChecker.query_matches?('foo&bar', 'bar&foo')).to be_truthy
+      end
+
+      it 'is false if one different query' do
+        expect(URIChecker.query_matches?('foo&bang', 'foo&bing')).to be_falsey
+      end
+
+      it 'is true if same query with same value' do
+        expect(URIChecker.query_matches?('foo=bar', 'foo=bar')).to be_truthy
+      end
+
+      it 'is true if same queries with same values' do
+        expect(URIChecker.query_matches?('foo=bar&bing=bang', 'foo=bar&bing=bang')).to be_truthy
+      end
+
+      it 'is true if same queries with same values, different order' do
+        expect(URIChecker.query_matches?('foo=bar&bing=bang', 'bing=bang&foo=bar')).to be_truthy
+      end
+
+      it 'is false if same query with different value' do
+        expect(URIChecker.query_matches?('foo=bar', 'foo=bang')).to be_falsey
+      end
+
+      it 'is false if some queries missing' do
+        expect(URIChecker.query_matches?('foo=bar', 'foo=bar&bing=bang')).to be_falsey
+      end
+
+      it 'is false if some queries different value' do
+        expect(URIChecker.query_matches?('foo=bar&bing=bang', 'foo=bar&bing=banana')).to be_falsey
+      end
     end
   end
 end

data/spec/lib/oauth/invalid_token_response_spec.rb

@@ -1,12 +1,9 @@
 require 'spec_helper'
-require 'active_model'
-require 'doorkeeper'
-require 'doorkeeper/oauth/invalid_token_response'
 
 module Doorkeeper::OAuth
   describe InvalidTokenResponse do
     describe "#name" do
-      it  { expect(subject.name).to eq(:invalid_token) }
+      it { expect(subject.name).to eq(:invalid_token) }
     end
 
     describe "#status" do
@@ -40,7 +37,7 @@ module Doorkeeper::OAuth
         end
       end
 
-      context "unkown" do
+      context "unknown" do
         let(:access_token) { double(revoked?: false, expired?: false) }
 
         it "sets a description" do

data/spec/lib/oauth/password_access_token_request_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module Doorkeeper::OAuth
   describe PasswordAccessTokenRequest do
@@ -8,10 +8,12 @@ module Doorkeeper::OAuth
         default_scopes: Doorkeeper::OAuth::Scopes.new,
         access_token_expires_in: 2.hours,
         refresh_token_enabled?: false,
-        custom_access_token_expires_in: ->(_app) { nil }
+        custom_access_token_expires_in: lambda { |context|
+          context.grant_type == Doorkeeper::OAuth::PASSWORD ? 1234 : nil
+        }
       )
     end
-    let(:client) { FactoryGirl.create(:application) }
+    let(:client) { FactoryBot.create(:application) }
     let(:owner)  { double :owner, id: 99 }
 
     subject do
@@ -22,6 +24,7 @@ module Doorkeeper::OAuth
       expect do
         subject.authorize
       end.to change { client.reload.access_tokens.count }.by(1)
+      expect(client.reload.access_tokens.sort_by(&:created_at).last.expires_in).to eq(1234)
     end
 
     it 'issues a new token without a client' do
@@ -53,7 +56,7 @@ module Doorkeeper::OAuth
     end
 
     it 'creates token even when there is already one (default)' do
-      FactoryGirl.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
+      FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
       expect do
         subject.authorize
       end.to change { Doorkeeper::AccessToken.count }.by(1)
@@ -61,12 +64,18 @@ module Doorkeeper::OAuth
 
     it 'skips token creation if there is already one' do
       allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-      FactoryGirl.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
+      FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
       expect do
         subject.authorize
       end.to_not change { Doorkeeper::AccessToken.count }
     end
 
+    it "calls configured request callback methods" do
+      expect(Doorkeeper.configuration.before_successful_strategy_response).to receive(:call).with(subject).once
+      expect(Doorkeeper.configuration.after_successful_strategy_response).to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
+      subject.authorize
+    end
+
     describe 'with scopes' do
       subject do
         PasswordAccessTokenRequest.new(server, client, owner, scope: 'public')
@@ -86,5 +95,37 @@ module Doorkeeper::OAuth
         expect(Doorkeeper::AccessToken.last.scopes).to include('public')
       end
     end
+
+    describe 'with custom expiry' do
+      let(:server) do
+        double(
+          :server,
+          default_scopes: Doorkeeper::OAuth::Scopes.new,
+          access_token_expires_in: 2.hours,
+          refresh_token_enabled?: false,
+          custom_access_token_expires_in: lambda { |context|
+            context.scopes.exists?('public') ? 222 : nil
+          }
+        )
+      end
+
+      it 'checks scopes' do
+        subject = PasswordAccessTokenRequest.new(server, client, owner, scope: 'public')
+        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('public'))
+        expect do
+          subject.authorize
+        end.to change { Doorkeeper::AccessToken.count }.by(1)
+        expect(Doorkeeper::AccessToken.last.expires_in).to eq(222)
+      end
+
+      it 'falls back to the default otherwise' do
+        subject = PasswordAccessTokenRequest.new(server, client, owner, scope: 'private')
+        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('private'))
+        expect do
+          subject.authorize
+        end.to change { Doorkeeper::AccessToken.count }.by(1)
+        expect(Doorkeeper::AccessToken.last.expires_in).to eq(2.hours)
+      end
+    end
   end
 end

data/spec/lib/oauth/pre_authorization_spec.rb

@@ -1,13 +1,13 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module Doorkeeper::OAuth
   describe PreAuthorization do
-    let(:server) {
+    let(:server) do
       server = Doorkeeper.configuration
       allow(server).to receive(:default_scopes).and_return(Scopes.new)
       allow(server).to receive(:scopes).and_return(Scopes.from_string('public profile'))
       server
-    }
+    end
 
     let(:application) do
       application = double :application
@@ -123,9 +123,19 @@ module Doorkeeper::OAuth
       expect(subject.scopes).to eq(Scopes.from_string('default'))
     end
 
-    it 'accepts test uri' do
-      subject.redirect_uri = 'urn:ietf:wg:oauth:2.0:oob'
-      expect(subject).to be_authorizable
+    context 'with native redirect uri' do
+      let(:native_redirect_uri) { 'urn:ietf:wg:oauth:2.0:oob' }
+
+      it 'accepts redirect_uri when it matches with the client' do
+        subject.redirect_uri = native_redirect_uri
+        allow(subject.client).to receive(:redirect_uri) { native_redirect_uri }
+        expect(subject).to be_authorizable
+      end
+
+      it 'invalidates redirect_uri when it does\'n match with the client' do
+        subject.redirect_uri = 'urn:ietf:wg:oauth:2.0:oob'
+        expect(subject).not_to be_authorizable
+      end
     end
 
     it 'matches the redirect uri against client\'s one' do
@@ -151,5 +161,29 @@ module Doorkeeper::OAuth
       subject.redirect_uri = nil
       expect(subject).not_to be_authorizable
     end
+
+    describe "as_json" do
+      let(:client_id) { "client_uid_123" }
+      let(:client_name) { "Acme Co." }
+
+      before do
+        allow(client).to receive(:uid).and_return client_id
+        allow(client).to receive(:name).and_return client_name
+      end
+
+      let(:json) { subject.as_json({}) }
+
+      it { is_expected.to respond_to :as_json }
+
+      it "returns correct values" do
+        expect(json[:client_id]).to eq client_id
+        expect(json[:redirect_uri]).to eq subject.redirect_uri
+        expect(json[:state]).to eq subject.state
+        expect(json[:response_type]).to eq subject.response_type
+        expect(json[:scope]).to eq subject.scope
+        expect(json[:client_name]).to eq client_name
+        expect(json[:status]).to eq I18n.t('doorkeeper.pre_authorization.status')
+      end
+    end
   end
 end

data/spec/lib/oauth/refresh_token_request_spec.rb

@@ -1,18 +1,21 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module Doorkeeper::OAuth
   describe RefreshTokenRequest do
     before do
       allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(false)
     end
+
     let(:server) do
       double :server,
              access_token_expires_in: 2.minutes,
-             custom_access_token_expires_in: -> (_oauth_client) { nil }
+             custom_access_token_expires_in: ->(_context) { nil }
     end
+
     let(:refresh_token) do
-      FactoryGirl.create(:access_token, use_refresh_token: true)
+      FactoryBot.create(:access_token, use_refresh_token: true)
     end
+
     let(:client) { refresh_token.application }
     let(:credentials) { Client::Credentials.new(client.uid, client.secret) }
 
@@ -20,25 +23,35 @@ module Doorkeeper::OAuth
 
     it 'issues a new token for the client' do
       expect { subject.authorize }.to change { client.reload.access_tokens.count }.by(1)
-      expect(client.reload.access_tokens.last.expires_in).to eq(120)
+      # #sort_by used for MongoDB ORM extensions for valid ordering
+      expect(client.reload.access_tokens.sort_by(&:created_at).last.expires_in).to eq(120)
     end
 
     it 'issues a new token for the client with custom expires_in' do
       server = double :server,
                       access_token_expires_in: 2.minutes,
-                      custom_access_token_expires_in: ->(_oauth_client) { 1234 }
+                      custom_access_token_expires_in: lambda { |context|
+                        context.grant_type == Doorkeeper::OAuth::REFRESH_TOKEN ? 1234 : nil
+                      }
 
       allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(false)
 
       RefreshTokenRequest.new(server, refresh_token, credentials).authorize
 
-      expect(client.reload.access_tokens.last.expires_in).to eq(1234)
+      # #sort_by used for MongoDB ORM extensions for valid ordering
+      expect(client.reload.access_tokens.sort_by(&:created_at).last.expires_in).to eq(1234)
     end
 
     it 'revokes the previous token' do
       expect { subject.authorize }.to change { refresh_token.revoked? }.from(false).to(true)
     end
 
+    it "calls configured request callback methods" do
+      expect(Doorkeeper.configuration.before_successful_strategy_response).to receive(:call).with(subject).once
+      expect(Doorkeeper.configuration.after_successful_strategy_response).to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
+      subject.authorize
+    end
+
     it 'requires the refresh token' do
       subject.refresh_token = nil
       subject.validate
@@ -52,7 +65,7 @@ module Doorkeeper::OAuth
     end
 
     it "requires the token's client and current client to match" do
-      subject.client = FactoryGirl.create(:application)
+      subject.client = FactoryBot.create(:application)
       subject.validate
       expect(subject.error).to eq(:invalid_grant)
     end
@@ -74,7 +87,9 @@ module Doorkeeper::OAuth
       let(:server) do
         double :server,
                access_token_expires_in: 2.minutes,
-               custom_access_token_expires_in: ->(_oauth_client) { 1234 }
+               custom_access_token_expires_in: lambda { |context|
+                 context.grant_type == Doorkeeper::OAuth::REFRESH_TOKEN ? 1234 : nil
+               }
       end
 
       before do
@@ -93,13 +108,14 @@ module Doorkeeper::OAuth
       it 'sets the previous refresh token in the new access token' do
         subject.authorize
         expect(
-          client.access_tokens.last.previous_refresh_token
+          # #sort_by used for MongoDB ORM extensions for valid ordering
+          client.access_tokens.sort_by(&:created_at).last.previous_refresh_token
         ).to eq(refresh_token.refresh_token)
       end
     end
 
     context 'clientless access tokens' do
-      let!(:refresh_token) { FactoryGirl.create(:clientless_access_token, use_refresh_token: true) }
+      let!(:refresh_token) { FactoryBot.create(:clientless_access_token, use_refresh_token: true) }
 
       subject { RefreshTokenRequest.new server, refresh_token, nil }
 
@@ -110,7 +126,7 @@ module Doorkeeper::OAuth
 
     context 'with scopes' do
       let(:refresh_token) do
-        FactoryGirl.create :access_token,
+        FactoryBot.create :access_token,
                            use_refresh_token: true,
                            scopes: 'public write'
       end
@@ -119,13 +135,13 @@ module Doorkeeper::OAuth
 
       it 'transfers scopes from the old token to the new token' do
         subject.authorize
-        expect(Doorkeeper::AccessToken.last.scopes).to eq([:public, :write])
+        expect(Doorkeeper::AccessToken.last.scopes).to eq(%i[public write])
       end
 
       it 'reduces scopes to the provided scopes' do
         parameters[:scopes] = 'public'
         subject.authorize
-        expect(Doorkeeper::AccessToken.last.scopes).to eq([:public])
+        expect(Doorkeeper::AccessToken.last.scopes).to eq(%i[public])
       end
 
       it 'validates that scopes are included in the original access token' do
@@ -139,7 +155,7 @@ module Doorkeeper::OAuth
         parameters[:scopes] = 'public update'
         parameters[:scope] = 'public'
         subject.authorize
-        expect(Doorkeeper::AccessToken.last.scopes).to eq([:public])
+        expect(Doorkeeper::AccessToken.last.scopes).to eq(%i[public])
       end
 
       it 'uses params[:scope] in favor of scopes if present (invalid)' do

data/spec/lib/oauth/scopes_spec.rb

@@ -1,7 +1,4 @@
 require 'spec_helper'
-require 'active_support/core_ext/module/delegation'
-require 'active_support/core_ext/string'
-require 'doorkeeper/oauth/scopes'
 
 module Doorkeeper::OAuth
   describe Scopes do
@@ -62,7 +59,7 @@ module Doorkeeper::OAuth
     describe '#+' do
       it 'can add to another scope object' do
         scopes = Scopes.from_string('public') + Scopes.from_string('admin')
-        expect(scopes.all).to eq(%w(public admin))
+        expect(scopes.all).to eq(%w[public admin])
       end
 
       it 'does not change the existing object' do
@@ -70,6 +67,11 @@ module Doorkeeper::OAuth
         expect(origin.to_s).to eq('public')
       end
 
+      it 'can add an array to a scope object' do
+        scopes = Scopes.from_string('public') + ['admin']
+        expect(scopes.all).to eq(%w[public admin])
+      end
+
       it 'raises an error if cannot handle addition' do
         expect do
           Scopes.from_string('public') + 'admin'
@@ -77,6 +79,24 @@ module Doorkeeper::OAuth
       end
     end
 
+    describe '#&' do
+      it 'can get intersection with another scope object' do
+        scopes = Scopes.from_string('public admin') & Scopes.from_string('write admin')
+        expect(scopes.all).to eq(%w[admin])
+      end
+
+      it 'does not change the existing object' do
+        origin = Scopes.from_string('public admin')
+        origin & Scopes.from_string('write admin')
+        expect(origin.to_s).to eq('public admin')
+      end
+
+      it 'can get intersection with an array' do
+        scopes = Scopes.from_string('public admin') & %w[write admin]
+        expect(scopes.all).to eq(%w[admin])
+      end
+    end
+
     describe '#==' do
       it 'is equal to another set of scopes' do
         expect(Scopes.from_string('public')).to eq(Scopes.from_string('public'))
@@ -89,6 +109,10 @@ module Doorkeeper::OAuth
       it 'differs from another set of scopes when scopes are not the same' do
         expect(Scopes.from_string('public write')).not_to eq(Scopes.from_string('write'))
       end
+
+      it "does not raise an error when compared to a non-enumerable object" do
+        expect { Scopes.from_string("public") == false }.not_to raise_error
+      end
     end
 
     describe '#has_scopes?' do

data/spec/lib/oauth/token_request_spec.rb

@@ -1,11 +1,11 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module Doorkeeper::OAuth
   describe TokenRequest do
     let :application do
-      scopes = double(all: ['public'])
-      double(:application, id: 9990, scopes: scopes)
+      FactoryBot.create(:application, scopes: "public")
     end
+
     let :pre_auth do
       double(
         :pre_auth,
@@ -38,9 +38,7 @@ module Doorkeeper::OAuth
 
     it 'does not create token when not authorizable' do
       allow(pre_auth).to receive(:authorizable?).and_return(false)
-      expect do
-        subject.authorize
-      end.to_not change { Doorkeeper::AccessToken.count }
+      expect { subject.authorize }.not_to change { Doorkeeper::AccessToken.count }
     end
 
     it 'returns a error response' do
@@ -52,8 +50,8 @@ module Doorkeeper::OAuth
       before do
         Doorkeeper.configure do
           orm DOORKEEPER_ORM
-          custom_access_token_expires_in do |_oauth_client|
-            1234
+          custom_access_token_expires_in do |context|
+            context.grant_type == Doorkeeper::OAuth::IMPLICIT ? 1234 : nil
           end
         end
       end
@@ -75,7 +73,7 @@ module Doorkeeper::OAuth
 
       it 'creates a new token if scopes do not match' do
         allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-        FactoryGirl.create(:access_token, application_id: pre_auth.client.id,
+        FactoryBot.create(:access_token, application_id: pre_auth.client.id,
                            resource_owner_id: owner.id, scopes: '')
         expect do
           subject.authorize
@@ -86,12 +84,11 @@ module Doorkeeper::OAuth
         allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
         allow(application.scopes).to receive(:has_scopes?).and_return(true)
         allow(application.scopes).to receive(:all?).and_return(true)
-        FactoryGirl.create(:access_token, application_id: pre_auth.client.id,
+
+        FactoryBot.create(:access_token, application_id: pre_auth.client.id,
                            resource_owner_id: owner.id, scopes: 'public')
 
-        expect do
-          subject.authorize
-        end.to_not change { Doorkeeper::AccessToken.count }
+        expect { subject.authorize }.not_to change { Doorkeeper::AccessToken.count }
       end
     end
   end

data/spec/lib/oauth/token_response_spec.rb

@@ -1,5 +1,4 @@
 require 'spec_helper'
-require 'doorkeeper/oauth/token_response'
 
 module Doorkeeper::OAuth
   describe TokenResponse do

data/spec/lib/oauth/token_spec.rb

@@ -1,6 +1,4 @@
 require 'spec_helper'
-require 'active_support/core_ext/string'
-require 'doorkeeper/oauth/token'
 
 module Doorkeeper
   unless defined?(AccessToken)
@@ -14,7 +12,7 @@ module Doorkeeper
         let(:request) { double.as_null_object }
 
         let(:method) do
-          ->(request) { return 'token-value' }
+          ->(*) { 'token-value' }
         end
 
         it 'accepts anything that responds to #call' do
@@ -96,19 +94,44 @@ module Doorkeeper
       end
 
       describe :authenticate do
-        it 'calls the finder if token was returned' do
-          token = ->(_r) { 'token' }
-          expect(AccessToken).to receive(:by_token).with('token')
-          Token.authenticate double, token
+        context 'refresh tokens are disabled (default)' do
+          context 'refresh tokens are enabled' do
+            it 'does not revoke previous refresh_token if token was found' do
+              token = ->(_r) { 'token' }
+              expect(
+                AccessToken
+              ).to receive(:by_token).with('token').and_return(token)
+              expect(token).not_to receive(:revoke_previous_refresh_token!)
+              Token.authenticate double, token
+            end
+          end
+
+          it 'calls the finder if token was returned' do
+            token = ->(_r) { 'token' }
+            expect(AccessToken).to receive(:by_token).with('token')
+            Token.authenticate double, token
+          end
         end
 
-        it 'revokes previous refresh_token if token was found' do
-          token = ->(_r) { 'token' }
-          expect(
-            AccessToken
-          ).to receive(:by_token).with('token').and_return(token)
-          expect(token).to receive(:revoke_previous_refresh_token!)
-          Token.authenticate double, token
+        context 'refresh tokens are enabled' do
+          before do
+            Doorkeeper.configure { use_refresh_token }
+          end
+
+          it 'revokes previous refresh_token if token was found' do
+            token = ->(_r) { 'token' }
+            expect(
+              AccessToken
+            ).to receive(:by_token).with('token').and_return(token)
+            expect(token).to receive(:revoke_previous_refresh_token!)
+            Token.authenticate double, token
+          end
+
+          it 'calls the finder if token was returned' do
+            token = ->(_r) { 'token' }
+            expect(AccessToken).to receive(:by_token).with('token')
+            Token.authenticate double, token
+          end
         end
       end
     end