doorkeeper 4.2.5 → 5.0.0.rc1

data/spec/requests/flows/skip_authorization_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 feature 'Skip authorization form' do
   background do
@@ -15,13 +15,24 @@ feature 'Skip authorization form' do
     end
 
     scenario 'skips the authorization and return a new grant code' do
-      client_is_authorized(@client, @resource_owner, scopes: 'public')
-      visit authorization_endpoint_url(client: @client)
+      client_is_authorized(@client, @resource_owner, scopes: "public")
+      visit authorization_endpoint_url(client: @client, scope: "public")
+
+      i_should_not_see "Authorize"
+      client_should_be_authorized @client
+      i_should_be_on_client_callback @client
+      url_should_have_param "code", Doorkeeper::AccessGrant.first.token
+    end
+
+    scenario "skips the authorization if other scopes are not requested" do
+      client_exists scopes: "public read write"
+      client_is_authorized(@client, @resource_owner, scopes: "public")
+      visit authorization_endpoint_url(client: @client, scope: "public")
 
-      i_should_not_see 'Authorize'
+      i_should_not_see "Authorize"
       client_should_be_authorized @client
       i_should_be_on_client_callback @client
-      url_should_have_param 'code', Doorkeeper::AccessGrant.first.token
+      url_should_have_param "code", Doorkeeper::AccessGrant.first.token
     end
 
     scenario 'does not skip authorization when scopes differ (new request has fewer scopes)' do
@@ -43,12 +54,6 @@ feature 'Skip authorization form' do
       access_grant_should_have_scopes :public
     end
 
-    scenario 'doesn not skip authorization when scopes are greater' do
-      client_is_authorized(@client, @resource_owner, scopes: 'public')
-      visit authorization_endpoint_url(client: @client, scope: 'public write')
-      i_should_see 'Authorize'
-    end
-
     scenario 'creates grant with new scope when scopes are greater' do
       client_is_authorized(@client, @resource_owner, scopes: 'public')
       visit authorization_endpoint_url(client: @client, scope: 'public write')

data/spec/requests/protected_resources/metal_spec.rb

@@ -1,8 +1,8 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe 'ActionController::Metal API' do
   before do
-    @client   = FactoryGirl.create(:application)
+    @client   = FactoryBot.create(:application)
     @resource = User.create!(name: 'Joe', password: 'sekret')
     @token    = client_is_authorized(@client, @resource)
   end

data/spec/requests/protected_resources/private_api_spec.rb

@@ -1,8 +1,8 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 feature 'Private API' do
   background do
-    @client   = FactoryGirl.create(:application)
+    @client   = FactoryBot.create(:application)
     @resource = User.create!(name: 'Joe', password: 'sekret')
     @token    = client_is_authorized(@client, @resource)
   end

data/spec/routing/custom_controller_routes_spec.rb

@@ -1,27 +1,79 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe 'Custom controller for routes' do
-  it 'GET /space/scope/authorize routes to custom authorizations controller' do
+  before :all do
+    Rails.application.routes.disable_clear_and_finalize = true
+
+    Rails.application.routes.draw do
+      scope 'inner_space' do
+        use_doorkeeper scope: 'scope' do
+          controllers authorizations: 'custom_authorizations',
+                      tokens: 'custom_authorizations',
+                      applications: 'custom_authorizations',
+                      token_info: 'custom_authorizations'
+
+          as authorizations: 'custom_auth',
+             tokens: 'custom_token',
+             token_info: 'custom_token_info'
+        end
+      end
+
+      scope 'space' do
+        use_doorkeeper do
+          controllers authorizations: 'custom_authorizations',
+                      tokens: 'custom_authorizations',
+                      applications: 'custom_authorizations',
+                      token_info: 'custom_authorizations'
+
+          as authorizations: 'custom_auth',
+             tokens: 'custom_token',
+             token_info: 'custom_token_info'
+        end
+      end
+
+      scope 'outer_space' do
+        use_doorkeeper do
+          controllers authorizations: 'custom_authorizations',
+                      tokens: 'custom_authorizations',
+                      token_info: 'custom_authorizations'
+
+          as authorizations: 'custom_auth',
+             tokens: 'custom_token',
+             token_info: 'custom_token_info'
+
+          skip_controllers :tokens, :applications, :token_info
+        end
+      end
+    end
+  end
+
+  after :all do
+    Rails.application.routes.clear!
+
+    load File.expand_path('../dummy/config/routes.rb', __dir__)
+  end
+
+  it 'GET /inner_space/scope/authorize routes to custom authorizations controller' do
     expect(get('/inner_space/scope/authorize')).to route_to('custom_authorizations#new')
   end
 
-  it 'POST /space/scope/authorize routes to custom authorizations controller' do
+  it 'POST /inner_space/scope/authorize routes to custom authorizations controller' do
     expect(post('/inner_space/scope/authorize')).to route_to('custom_authorizations#create')
   end
 
-  it 'DELETE /space/scope/authorize routes to custom authorizations controller' do
+  it 'DELETE /inner_space/scope/authorize routes to custom authorizations controller' do
     expect(delete('/inner_space/scope/authorize')).to route_to('custom_authorizations#destroy')
   end
 
-  it 'POST /space/scope/token routes to tokens controller' do
+  it 'POST /inner_space/scope/token routes to tokens controller' do
     expect(post('/inner_space/scope/token')).to route_to('custom_authorizations#create')
   end
 
-  it 'GET /space/scope/applications routes to applications controller' do
+  it 'GET /inner_space/scope/applications routes to applications controller' do
     expect(get('/inner_space/scope/applications')).to route_to('custom_authorizations#index')
   end
 
-  it 'GET /space/scope/token/info routes to the token_info controller' do
+  it 'GET /inner_space/scope/token/info routes to the token_info controller' do
     expect(get('/inner_space/scope/token/info')).to route_to('custom_authorizations#show')
   end
 
@@ -45,6 +97,10 @@ describe 'Custom controller for routes' do
     expect(post('/space/oauth/revoke')).to route_to('custom_authorizations#revoke')
   end
 
+  it 'POST /space/oauth/introspect routes to tokens controller' do
+    expect(post('/space/oauth/introspect')).to route_to('custom_authorizations#introspect')
+  end
+
   it 'GET /space/oauth/applications routes to applications controller' do
     expect(get('/space/oauth/applications')).to route_to('custom_authorizations#index')
   end

data/spec/routing/default_routes_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe 'Default routes' do
   it 'GET /oauth/authorize routes to authorizations controller' do
@@ -21,6 +21,10 @@ describe 'Default routes' do
     expect(post('/oauth/revoke')).to route_to('doorkeeper/tokens#revoke')
   end
 
+  it 'POST /oauth/introspect routes to tokens controller' do
+    expect(post('/oauth/introspect')).to route_to('doorkeeper/tokens#introspect')
+  end
+
   it 'GET /oauth/applications routes to applications controller' do
     expect(get('/oauth/applications')).to route_to('doorkeeper/applications#index')
   end
@@ -29,7 +33,7 @@ describe 'Default routes' do
     expect(get('/oauth/authorized_applications')).to route_to('doorkeeper/authorized_applications#index')
   end
 
-  it 'GET /oauth/token/info route to authorzed tokeninfo controller' do
+  it 'GET /oauth/token/info route to authorized TokenInfo controller' do
     expect(get('/oauth/token/info')).to route_to('doorkeeper/token_info#show')
   end
 end

data/spec/routing/scoped_routes_spec.rb

@@ -1,6 +1,20 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe 'Scoped routes' do
+  before :all do
+    Rails.application.routes.disable_clear_and_finalize = true
+
+    Rails.application.routes.draw do
+      use_doorkeeper scope: 'scope'
+    end
+  end
+
+  after :all do
+    Rails.application.routes.clear!
+
+    load File.expand_path('../dummy/config/routes.rb', __dir__)
+  end
+
   it 'GET /scope/authorize routes to authorizations controller' do
     expect(get('/scope/authorize')).to route_to('doorkeeper/authorizations#new')
   end
@@ -25,7 +39,7 @@ describe 'Scoped routes' do
     expect(get('/scope/authorized_applications')).to route_to('doorkeeper/authorized_applications#index')
   end
 
-  it 'GET /scope/token/info route to authorzed tokeninfo controller' do
+  it 'GET /scope/token/info route to authorized TokenInfo controller' do
     expect(get('/scope/token/info')).to route_to('doorkeeper/token_info#show')
   end
 end

data/spec/spec_helper.rb

@@ -1,4 +1,55 @@
-$LOAD_PATH.unshift File.expand_path(File.join(File.dirname(__FILE__), '../lib'))
-$LOAD_PATH.unshift File.expand_path(File.join(File.dirname(__FILE__), '../app'))
+require 'coveralls'
 
-require 'doorkeeper'
+Coveralls.wear!('rails') do
+  add_filter('/spec/')
+  add_filter('/lib/generators/doorkeeper/templates/')
+end
+
+ENV['RAILS_ENV'] ||= 'test'
+
+$LOAD_PATH.unshift File.dirname(__FILE__)
+
+require "#{File.dirname(__FILE__)}/support/doorkeeper_rspec.rb"
+
+DOORKEEPER_ORM = Doorkeeper::RSpec.detect_orm
+
+require 'dummy/config/environment'
+require 'rspec/rails'
+require 'capybara/rspec'
+require 'database_cleaner'
+require 'generator_spec/test_case'
+
+# Load JRuby SQLite3 if in that platform
+if defined? JRUBY_VERSION
+  require 'jdbc/sqlite3'
+  Jdbc::SQLite3.load_driver
+end
+
+Doorkeeper::RSpec.print_configuration_info
+
+# Remove after dropping support of Rails 4.2
+require "#{File.dirname(__FILE__)}/support/http_method_shim.rb"
+
+require "support/orm/#{DOORKEEPER_ORM}"
+
+Dir["#{File.dirname(__FILE__)}/support/{dependencies,helpers,shared}/*.rb"].each { |file| require file }
+
+RSpec.configure do |config|
+  config.infer_spec_type_from_file_location!
+  config.mock_with :rspec
+
+  config.infer_base_class_for_anonymous_controllers = false
+
+  config.include RSpec::Rails::RequestExampleGroup, type: :request
+
+  config.before do
+    DatabaseCleaner.start
+    Doorkeeper.configure { orm DOORKEEPER_ORM }
+  end
+
+  config.after do
+    DatabaseCleaner.clean
+  end
+
+  config.order = 'random'
+end

data/spec/spec_helper_integration.rb

@@ -1,64 +1,2 @@
-if ENV['TRAVIS']
-  require 'coveralls'
-  Coveralls.wear!('rails') { add_filter('/spec/') }
-end
-
-ENV['RAILS_ENV'] ||= 'test'
-TABLE_NAME_PREFIX = ENV['table_name_prefix'] || nil
-TABLE_NAME_SUFFIX = ENV['table_name_suffix'] || nil
-
-orm = (ENV['BUNDLE_GEMFILE'] || '').match(/Gemfile\.(.+)\.rb/)
-DOORKEEPER_ORM = (orm && orm[1] || :active_record).to_sym
-
-$LOAD_PATH.unshift File.dirname(__FILE__)
-
-require 'capybara/rspec'
-require 'dummy/config/environment'
-require 'rspec/rails'
-require 'generator_spec/test_case'
-require 'timecop'
-require 'database_cleaner'
-
-# Load JRuby SQLite3 if in that platform
-begin
-  require 'jdbc/sqlite3'
-  Jdbc::SQLite3.load_driver
-rescue LoadError
-end
-
-Rails.logger.info "====> Doorkeeper.orm = #{Doorkeeper.configuration.orm.inspect}"
-if Doorkeeper.configuration.orm == :active_record
-  Rails.logger.info "======> active_record.table_name_prefix = #{Rails.configuration.active_record.table_name_prefix.inspect}"
-  Rails.logger.info "======> active_record.table_name_suffix = #{Rails.configuration.active_record.table_name_suffix.inspect}"
-end
-Rails.logger.info "====> Rails version: #{Rails.version}"
-Rails.logger.info "====> Ruby version: #{RUBY_VERSION}"
-
-require "support/orm/#{DOORKEEPER_ORM}"
-
-ENGINE_RAILS_ROOT = File.join(File.dirname(__FILE__), '../')
-
-Dir["#{File.dirname(__FILE__)}/support/{dependencies,helpers,shared}/*.rb"].each { |f| require f }
-
-# Remove after dropping support of Rails 4.2
-require "#{File.dirname(__FILE__)}/support/http_method_shim.rb"
-
-RSpec.configure do |config|
-  config.infer_spec_type_from_file_location!
-  config.mock_with :rspec
-
-  config.infer_base_class_for_anonymous_controllers = false
-
-  config.include RSpec::Rails::RequestExampleGroup, type: :request
-
-  config.before do
-    DatabaseCleaner.start
-    Doorkeeper.configure { orm DOORKEEPER_ORM }
-  end
-
-  config.after do
-    DatabaseCleaner.clean
-  end
-
-  config.order = 'random'
-end
+# For compatibility only
+require 'spec_helper'

data/spec/support/dependencies/factory_bot.rb

@@ -0,0 +1,2 @@
+require 'factory_bot'
+FactoryBot.find_definitions

data/spec/support/doorkeeper_rspec.rb

@@ -0,0 +1,19 @@
+module Doorkeeper
+  class RSpec
+    # Print's useful information about env: Ruby / Rails versions,
+    # Doorkeeper configuration, etc.
+    def self.print_configuration_info
+      puts <<-INFO.strip_heredoc
+        ====> Doorkeeper ORM = #{Doorkeeper.configuration.orm}
+        ====> Rails version: #{::Rails.version}
+        ====> Ruby version: #{RUBY_VERSION} on #{RUBY_PLATFORM}
+      INFO
+    end
+
+    # Tries to find ORM from the Gemfile used to run test suite
+    def self.detect_orm
+      orm = (ENV['BUNDLE_GEMFILE'] || '').match(/Gemfile\.(.+)\.rb/)
+      (orm && orm[1] || :active_record).to_sym
+    end
+  end
+end

data/spec/support/helpers/access_token_request_helper.rb

@@ -4,7 +4,7 @@ module AccessTokenRequestHelper
       application: client,
       resource_owner_id: resource_owner.id
     }.merge(access_token_attributes)
-    FactoryGirl.create(:access_token, attributes)
+    FactoryBot.create(:access_token, attributes)
   end
 end
 

data/spec/support/helpers/authorization_request_helper.rb

@@ -28,13 +28,13 @@ module AuthorizationRequestHelper
     expect(client.redirect_uri).to eq("#{current_uri.scheme}://#{current_uri.host}#{current_uri.path}")
   end
 
-  def allowing_forgery_protection(&block)
-    _original_value = ActionController::Base.allow_forgery_protection
+  def allowing_forgery_protection(&_block)
+    original_value = ActionController::Base.allow_forgery_protection
     ActionController::Base.allow_forgery_protection = true
 
-    block.call
+    yield
   ensure
-    ActionController::Base.allow_forgery_protection = _original_value
+    ActionController::Base.allow_forgery_protection = original_value
   end
 end
 

data/spec/support/helpers/model_helper.rb

@@ -1,6 +1,6 @@
 module ModelHelper
   def client_exists(client_attributes = {})
-    @client = FactoryGirl.create(:application, client_attributes)
+    @client = FactoryBot.create(:application, client_attributes)
   end
 
   def create_resource_owner
@@ -8,7 +8,7 @@ module ModelHelper
   end
 
   def authorization_code_exists(options = {})
-    @authorization = FactoryGirl.create(:access_grant, options)
+    @authorization = FactoryBot.create(:access_grant, options)
   end
 
   def access_grant_should_exist_for(client, resource_owner)
@@ -55,9 +55,14 @@ module ModelHelper
       error_classes = [Sequel::UniqueConstraintViolation, Sequel::ValidationFailed]
       proc { |error| expect(error.class).to be_in(error_classes) }
     when :mongo_mapper
-      MongoMapper::DocumentNotValid
+      error_classes = [MongoMapper::DocumentNotValid, Mongo::OperationFailure]
+      proc { |error| expect(error.class).to be_in(error_classes) }
     when /mongoid/
-      Mongoid::Errors::Validations
+      error_classes = [Mongoid::Errors::Validations]
+      error_classes << Moped::Errors::OperationFailure if defined?(::Moped) # Mongoid 4
+      error_classes << Mongo::Error::OperationFailure if defined?(::Mongo) # Mongoid 5
+
+      proc { |error| expect(error.class).to be_in(error_classes) }
     else
       raise "'#{DOORKEEPER_ORM}' ORM is not supported!"
     end

data/spec/support/helpers/request_spec_helper.rb

@@ -31,6 +31,10 @@ module RequestSpecHelper
     respond_to?(:response) ? response : page.driver.response
   end
 
+  def json_response
+    JSON.parse(request_response.body)
+  end
+
   def should_have_header(header, value)
     expect(headers[header]).to eq(value)
   end
@@ -48,15 +52,15 @@ module RequestSpecHelper
   end
 
   def should_have_json(key, value)
-    expect(JSON.parse(request_response.body).fetch(key)).to eq(value)
+    expect(json_response.fetch(key)).to eq(value)
   end
 
   def should_have_json_within(key, value, range)
-    expect(JSON.parse(request_response.body).fetch(key)).to be_within(range).of(value)
+    expect(json_response.fetch(key)).to be_within(range).of(value)
   end
 
   def should_not_have_json(key)
-    expect(JSON.parse(request_response.body)).not_to have_key(key)
+    expect(json_response).not_to have_key(key)
   end
 
   def sign_in
@@ -64,8 +68,8 @@ module RequestSpecHelper
     click_on 'Sign in'
   end
 
-  def create_access_token(authorization_code, client)
-    page.driver.post token_endpoint_url(code: authorization_code, client: client)
+  def create_access_token(authorization_code, client, code_verifier = nil)
+    page.driver.post token_endpoint_url(code: authorization_code, client: client, code_verifier: code_verifier)
   end
 
   def i_should_see_translated_error_message(key)
@@ -73,7 +77,7 @@ module RequestSpecHelper
   end
 
   def translated_error_message(key)
-    I18n.translate key, scope: [:doorkeeper, :errors, :messages]
+    I18n.translate key, scope: %i[doorkeeper errors messages]
   end
 
   def response_status_should_be(status)

data/spec/support/helpers/url_helper.rb

@@ -2,21 +2,24 @@ module UrlHelper
   def token_endpoint_url(options = {})
     parameters = {
       code: options[:code],
-      client_id: options[:client_id]     || (options[:client] ? options[:client].uid : nil),
+      client_id: options[:client_id] || (options[:client] ? options[:client].uid : nil),
       client_secret: options[:client_secret] || (options[:client] ? options[:client].secret : nil),
       redirect_uri: options[:redirect_uri]  || (options[:client] ? options[:client].redirect_uri : nil),
-      grant_type: options[:grant_type]    || 'authorization_code'
-    }
+      grant_type: options[:grant_type] || 'authorization_code',
+      code_verifier: options[:code_verifier],
+      code_challenge_method: options[:code_challenge_method]
+    }.reject { |_, v| v.blank? }
     "/oauth/token?#{build_query(parameters)}"
   end
 
   def password_token_endpoint_url(options = {})
     parameters = {
       code: options[:code],
-      client_id: options[:client_id]     || (options[:client] ? options[:client].uid : nil),
+      client_id: options[:client_id] || (options[:client] ? options[:client].uid : nil),
       client_secret: options[:client_secret] || (options[:client] ? options[:client].secret : nil),
       username: options[:resource_owner_username] || (options[:resource_owner] ? options[:resource_owner].name : nil),
       password: options[:resource_owner_password] || (options[:resource_owner] ? options[:resource_owner].password : nil),
+      scope: options[:scope],
       grant_type: 'password'
     }
     "/oauth/token?#{build_query(parameters)}"
@@ -24,21 +27,23 @@ module UrlHelper
 
   def authorization_endpoint_url(options = {})
     parameters = {
-      client_id: options[:client_id]     || options[:client].uid,
-      redirect_uri: options[:redirect_uri]  || options[:client].redirect_uri,
+      client_id: options[:client_id] || options[:client].uid,
+      redirect_uri: options[:redirect_uri] || options[:client].redirect_uri,
       response_type: options[:response_type] || 'code',
       scope: options[:scope],
-      state: options[:state]
-    }.reject { |k, v| v.blank? }
+      state: options[:state],
+      code_challenge: options[:code_challenge],
+      code_challenge_method: options[:code_challenge_method]
+    }.reject { |_, v| v.blank? }
     "/oauth/authorize?#{build_query(parameters)}"
   end
 
   def refresh_token_endpoint_url(options = {})
     parameters = {
       refresh_token: options[:refresh_token],
-      client_id: options[:client_id]     || options[:client].uid,
+      client_id: options[:client_id] || options[:client].uid,
       client_secret: options[:client_secret] || options[:client].secret,
-      grant_type: options[:grant_type]    || 'refresh_token'
+      grant_type: options[:grant_type] || 'refresh_token'
     }
     "/oauth/token?#{build_query(parameters)}"
   end

data/spec/support/http_method_shim.rb

@@ -3,34 +3,30 @@
 # supported in Rails 5+. Since we support back to 4, we need some sort of shim
 # to avoid super noisy deprecations when running tests.
 module RoutingHTTPMethodShim
-  def get(path, params = {}, headers = nil)
-    super(path, params: params, headers: headers)
+  def get(path, **args)
+    super(path, args[:params], args[:headers])
   end
 
-  def post(path, params = {}, headers = nil)
-    super(path, params: params, headers: headers)
+  def post(path, **args)
+    super(path, args[:params], args[:headers])
   end
 
-  def put(path, params = {}, headers = nil)
-    super(path, params: params, headers: headers)
+  def put(path, **args)
+    super(path, args[:params], args[:headers])
   end
 end
 
 module ControllerHTTPMethodShim
-  def get(path, params = {})
-    super(path, params: params)
-  end
-
-  def post(path, params = {})
-    super(path, params: params)
-  end
+  def process(action, http_method = 'GET', **args)
+    if (as = args.delete(:as))
+      @request.headers['Content-Type'] = Mime[as].to_s
+    end
 
-  def put(path, params = {})
-    super(path, params: params)
+    super(action, http_method, args[:params], args[:session], args[:flash])
   end
 end
 
-if ::Rails::VERSION::MAJOR >= 5
+if ::Rails::VERSION::MAJOR < 5
   RSpec.configure do |config|
     config.include ControllerHTTPMethodShim, type: :controller
     config.include RoutingHTTPMethodShim, type: :request

data/spec/support/shared/controllers_shared_context.rb

@@ -1,7 +1,5 @@
 shared_context 'valid token', token: :valid do
-  let :token_string do
-    '1A2B3C4D'
-  end
+  let(:token_string) { '1A2B3C4D' }
 
   let :token do
     double(Doorkeeper::AccessToken,
@@ -17,9 +15,7 @@ shared_context 'valid token', token: :valid do
 end
 
 shared_context 'invalid token', token: :invalid do
-  let :token_string do
-    '1A2B3C4D'
-  end
+  let(:token_string) { '1A2B3C4D' }
 
   let :token do
     double(Doorkeeper::AccessToken,

data/spec/support/shared/models_shared_examples.rb

@@ -34,15 +34,15 @@ shared_examples 'a unique token' do
     end
 
     it 'is not valid if token exists' do
-      token1 = FactoryGirl.create factory_name
-      token2 = FactoryGirl.create factory_name
+      token1 = FactoryBot.create factory_name
+      token2 = FactoryBot.create factory_name
       token2.token = token1.token
       expect(token2).not_to be_valid
     end
 
     it 'expects database to throw an error when tokens are the same' do
-      token1 = FactoryGirl.create factory_name
-      token2 = FactoryGirl.create factory_name
+      token1 = FactoryBot.create factory_name
+      token2 = FactoryBot.create factory_name
       token2.token = token1.token
       expect do
         token2.save!(validate: false)