doorkeeper 4.2.5 → 5.0.0

data/spec/lib/oauth/authorization_code_request_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module Doorkeeper::OAuth
   describe AuthorizationCodeRequest do
@@ -6,19 +6,26 @@ module Doorkeeper::OAuth
       double :server,
              access_token_expires_in: 2.days,
              refresh_token_enabled?: false,
-             custom_access_token_expires_in: ->(_app) { nil }
+             custom_access_token_expires_in: lambda { |context|
+               context.grant_type == Doorkeeper::OAuth::AUTHORIZATION_CODE ? 1234 : nil
+             }
     end
-    let(:grant)  { FactoryGirl.create :access_grant }
+
+    let(:grant)  { FactoryBot.create :access_grant }
     let(:client) { grant.application }
+    let(:redirect_uri) { client.redirect_uri }
+    let(:params) { { redirect_uri: redirect_uri } }
 
     subject do
-      AuthorizationCodeRequest.new server, grant, client, redirect_uri: client.redirect_uri
+      AuthorizationCodeRequest.new server, grant, client, params
     end
 
     it 'issues a new token for the client' do
       expect do
         subject.authorize
       end.to change { client.reload.access_tokens.count }.by(1)
+
+      expect(client.reload.access_tokens.sort_by(&:created_at).last.expires_in).to eq(1234)
     end
 
     it "issues the token with same grant's scopes" do
@@ -27,9 +34,7 @@ module Doorkeeper::OAuth
     end
 
     it 'revokes the grant' do
-      expect do
-        subject.authorize
-      end.to change { grant.reload.accessible? }
+      expect { subject.authorize }.to change { grant.reload.accessible? }
     end
 
     it 'requires the grant to be accessible' do
@@ -63,18 +68,63 @@ module Doorkeeper::OAuth
     end
 
     it "matches the client with grant's one" do
-      subject.client = FactoryGirl.create :application
+      subject.client = FactoryBot.create :application
       subject.validate
       expect(subject.error).to eq(:invalid_grant)
     end
 
     it 'skips token creation if there is a matching one' do
-      allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-      FactoryGirl.create(:access_token, application_id: client.id,
+      scopes = grant.scopes
+
+      Doorkeeper.configure do
+        orm DOORKEEPER_ORM
+        reuse_access_token
+        default_scopes(*scopes)
+      end
+
+      FactoryBot.create(:access_token, application_id: client.id,
         resource_owner_id: grant.resource_owner_id, scopes: grant.scopes.to_s)
-      expect do
-        subject.authorize
-      end.to_not change { Doorkeeper::AccessToken.count }
+
+      expect { subject.authorize }.to_not change { Doorkeeper::AccessToken.count }
+    end
+
+    it "calls configured request callback methods" do
+      expect(Doorkeeper.configuration.before_successful_strategy_response).to receive(:call).with(subject).once
+      expect(Doorkeeper.configuration.after_successful_strategy_response).to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
+      subject.authorize
+    end
+
+    context "when redirect_uri contains some query params" do
+      let(:redirect_uri) { client.redirect_uri + "?query=q" }
+
+      it "compares only host part with grant's redirect_uri" do
+        subject.validate
+        expect(subject.error).to eq(nil)
+      end
+    end
+
+    context "when redirect_uri is not an URI" do
+      let(:redirect_uri) { '123d#!s' }
+
+      it "responds with invalid_grant" do
+        subject.validate
+        expect(subject.error).to eq(:invalid_grant)
+      end
+    end
+
+    context "when redirect_uri is the native one" do
+      let(:redirect_uri) { 'urn:ietf:wg:oauth:2.0:oob' }
+
+      it "invalidates when redirect_uri of the grant is not native" do
+        subject.validate
+        expect(subject.error).to eq(:invalid_grant)
+      end
+
+      it "validates when redirect_uri of the grant is also native" do
+        allow(grant).to receive(:redirect_uri) { redirect_uri }
+        subject.validate
+        expect(subject.error).to eq(nil)
+      end
     end
   end
 end

data/spec/lib/oauth/base_request_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module Doorkeeper::OAuth
   describe BaseRequest do
@@ -13,19 +13,14 @@ module Doorkeeper::OAuth
         created_at:         0
     end
 
-    let(:client) do
-      double :client,
-        id: '1'
-    end
+    let(:client) { double :client, id: '1' }
 
-    let(:scopes_array) do
-      %w(public write)
-    end
+    let(:scopes_array) { %w[public write] }
 
     let(:server) do
       double :server,
         access_token_expires_in: 100,
-        custom_access_token_expires_in: ->(_) { nil },
+        custom_access_token_expires_in: ->(_context) { nil },
         refresh_token_enabled?: false
     end
 
@@ -74,7 +69,7 @@ module Doorkeeper::OAuth
         it "returns an ErrorResponse object" do
           error_description = I18n.translate(
             "server_error",
-            scope: [:doorkeeper, :errors, :messages]
+            scope: %i[doorkeeper errors messages]
           )
 
           result = subject.authorize
@@ -110,6 +105,44 @@ module Doorkeeper::OAuth
 
         expect(result).to be_an_instance_of(Doorkeeper::AccessToken)
       end
+
+      it "respects custom_access_token_expires_in" do
+        server = double(:server,
+                        access_token_expires_in: 100,
+                        custom_access_token_expires_in: ->(context) { context.scopes == "public" ? 500 : nil },
+                        refresh_token_enabled?: false)
+        result = subject.find_or_create_access_token(
+          client,
+          "1",
+          "public",
+          server
+        )
+        expect(result.expires_in).to eql(500)
+      end
+
+      it "respects use_refresh_token with a block" do
+        server = double(:server,
+                        access_token_expires_in: 100,
+                        custom_access_token_expires_in: ->(_context) { nil },
+                        refresh_token_enabled?: lambda { |context|
+                          context.scopes == "public"
+                        })
+        result = subject.find_or_create_access_token(
+          client,
+          "1",
+          "public",
+          server
+        )
+        expect(result.refresh_token).to_not be_nil
+
+        result = subject.find_or_create_access_token(
+          client,
+          "1",
+          "private",
+          server
+        )
+        expect(result.refresh_token).to be_nil
+      end
     end
 
     describe "#scopes" do

data/spec/lib/oauth/base_response_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module Doorkeeper::OAuth
   describe BaseResponse do

data/spec/lib/oauth/client/credentials_spec.rb

@@ -1,22 +1,22 @@
 require 'spec_helper'
-require 'active_support/core_ext/string'
-require 'doorkeeper/oauth/client'
 
 class Doorkeeper::OAuth::Client
   describe Credentials do
     let(:client_id) { 'some-uid' }
     let(:client_secret) { 'some-secret' }
 
-    it 'is blank when any of the credentials is blank' do
+    it 'is blank when the uid in credentials is blank' do
+      expect(Credentials.new(nil, nil)).to be_blank
       expect(Credentials.new(nil, 'something')).to be_blank
-      expect(Credentials.new('something', nil)).to be_blank
+      expect(Credentials.new('something', nil)).to be_present
+      expect(Credentials.new('something', 'something')).to be_present
     end
 
     describe :from_request do
       let(:request) { double.as_null_object }
 
       let(:method) do
-        ->(_request) { return 'uid', 'secret' }
+        ->(_request) { ['uid', 'secret'] }
       end
 
       it 'accepts anything that responds to #call' do

data/spec/lib/oauth/client_credentials/creator_spec.rb

@@ -1,10 +1,14 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 class Doorkeeper::OAuth::ClientCredentialsRequest
   describe Creator do
-    let(:client) { FactoryGirl.create :application }
+    let(:client) { FactoryBot.create :application }
     let(:scopes) { Doorkeeper::OAuth::Scopes.from_string('public') }
 
+    before do
+      default_scopes_exist :public
+    end
+
     it 'creates a new token' do
       expect do
         subject.call(client, scopes)

data/spec/lib/oauth/client_credentials/issuer_spec.rb

@@ -1,6 +1,4 @@
 require 'spec_helper'
-require 'active_support/all'
-require 'doorkeeper/oauth/client_credentials/issuer'
 
 class Doorkeeper::OAuth::ClientCredentialsRequest
   describe Issuer do
@@ -9,7 +7,7 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
       double(
         :server,
         access_token_expires_in: 100,
-        custom_access_token_expires_in: ->(_app) { nil }
+        custom_access_token_expires_in: ->(_context) { nil }
       )
     end
     let(:validation) { double :validation, valid?: true }
@@ -63,23 +61,44 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
       end
 
       context 'with custom expirations' do
-        let(:custom_ttl) { 1233 }
+        let(:custom_ttl_grant) { 1234 }
+        let(:custom_ttl_scope) { 1235 }
+        let(:custom_scope) { 'special' }
         let(:server) do
           double(
             :server,
-            custom_access_token_expires_in: ->(_app) { custom_ttl }
+            custom_access_token_expires_in: lambda { |context|
+              # scopes is normally an object but is a string in this test
+              if context.scopes == custom_scope
+                custom_ttl_scope
+              elsif context.grant_type == Doorkeeper::OAuth::CLIENT_CREDENTIALS
+                custom_ttl_grant
+              else
+                nil
+              end
+            }
           )
         end
 
-        it 'creates with correct token parameters' do
+        it 'respects grant based rules' do
           expect(creator).to receive(:call).with(
             client,
             scopes,
-            expires_in: custom_ttl,
+            expires_in: custom_ttl_grant,
             use_refresh_token: false
           )
           subject.create client, scopes, creator
         end
+
+        it 'respects scope based rules' do
+          expect(creator).to receive(:call).with(
+            client,
+            custom_scope,
+            expires_in: custom_ttl_scope,
+            use_refresh_token: false
+          )
+          subject.create client, custom_scope, creator
+        end
       end
     end
   end

data/spec/lib/oauth/client_credentials/validation_spec.rb

@@ -1,6 +1,4 @@
 require 'spec_helper'
-require 'active_support/all'
-require 'doorkeeper/oauth/client_credentials/validation'
 
 class Doorkeeper::OAuth::ClientCredentialsRequest
   describe Validation do
@@ -45,7 +43,8 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
           allow(application).to receive(:scopes).and_return(application_scopes)
           allow(server).to receive(:scopes).and_return(server_scopes)
           allow(request).to receive(:scopes).and_return(
-            Doorkeeper::OAuth::Scopes.from_string 'email')
+            Doorkeeper::OAuth::Scopes.from_string('email')
+          )
           expect(subject).not_to be_valid
         end
       end

data/spec/lib/oauth/client_credentials_integration_spec.rb

@@ -1,11 +1,11 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module Doorkeeper::OAuth
   describe ClientCredentialsRequest do
     let(:server) { Doorkeeper.configuration }
 
     context 'with a valid request' do
-      let(:client) { FactoryGirl.create :application }
+      let(:client) { FactoryBot.create :application }
 
       it 'issues an access token' do
         request = ClientCredentialsRequest.new(server, client, {})

data/spec/lib/oauth/client_credentials_request_spec.rb

@@ -1,17 +1,16 @@
 require 'spec_helper'
-require 'active_support/all'
-require 'active_model'
-require 'doorkeeper/oauth/client_credentials_request'
 
 module Doorkeeper::OAuth
   describe ClientCredentialsRequest do
     let(:server) do
       double(
         default_scopes: nil,
-        custom_access_token_expires_in: ->(_app) { nil }
+        access_token_expires_in: 2.hours,
+        custom_access_token_expires_in: ->(_context) { nil }
       )
     end
-    let(:application)   { double :application, scopes: Scopes.from_string('') }
+
+    let(:application)   { FactoryBot.create(:application, scopes: '') }
     let(:client)        { double :client, application: application }
     let(:token_creator) { double :issuer, create: true, token: double }
 

data/spec/lib/oauth/client_spec.rb

@@ -1,7 +1,4 @@
 require 'spec_helper'
-require 'active_support/core_ext/module/delegation'
-require 'active_support/core_ext/string'
-require 'doorkeeper/oauth/client'
 
 module Doorkeeper::OAuth
   describe Client do

data/spec/lib/oauth/code_request_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module Doorkeeper::OAuth
   describe CodeRequest do
@@ -10,7 +10,9 @@ module Doorkeeper::OAuth
         scopes: nil,
         state: nil,
         error: nil,
-        authorizable?: true
+        authorizable?: true,
+        code_challenge: nil,
+        code_challenge_method: nil,
       )
     end
 
@@ -32,9 +34,7 @@ module Doorkeeper::OAuth
 
     it 'does not create grant when not authorizable' do
       allow(pre_auth).to receive(:authorizable?).and_return(false)
-      expect do
-        subject.authorize
-      end.to_not change { Doorkeeper::AccessGrant.count }
+      expect { subject.authorize }.not_to change { Doorkeeper::AccessGrant.count }
     end
 
     it 'returns a error response' do

data/spec/lib/oauth/error_response_spec.rb

@@ -1,7 +1,4 @@
 require 'spec_helper'
-require 'active_model'
-require 'doorkeeper/oauth/error'
-require 'doorkeeper/oauth/error_response'
 
 module Doorkeeper::OAuth
   describe ErrorResponse do

data/spec/lib/oauth/error_spec.rb

@@ -1,6 +1,4 @@
 require 'spec_helper'
-require 'active_support/i18n'
-require 'doorkeeper/oauth/error'
 
 module Doorkeeper::OAuth
   describe Error do
@@ -13,7 +11,7 @@ module Doorkeeper::OAuth
       it 'is translated from translation messages' do
         expect(I18n).to receive(:translate).with(
           :some_error,
-          scope: [:doorkeeper, :errors, :messages],
+          scope: %i[doorkeeper errors messages],
           default: :server_error
         )
         error.description

data/spec/lib/oauth/forbidden_token_response_spec.rb

@@ -1,12 +1,9 @@
 require 'spec_helper'
-require 'active_model'
-require 'doorkeeper'
-require 'doorkeeper/oauth/forbidden_token_response'
 
 module Doorkeeper::OAuth
   describe ForbiddenTokenResponse do
     describe '#name' do
-      it  { expect(subject.name).to eq(:invalid_scope) }
+      it { expect(subject.name).to eq(:invalid_scope) }
     end
 
     describe '#status' do

data/spec/lib/oauth/helpers/scope_checker_spec.rb

@@ -1,7 +1,4 @@
 require 'spec_helper'
-require 'active_support/core_ext/string'
-require 'doorkeeper/oauth/helpers/scope_checker'
-require 'doorkeeper/oauth/scopes'
 
 module Doorkeeper::OAuth::Helpers
   describe ScopeChecker, '.valid?' do

data/spec/lib/oauth/helpers/unique_token_spec.rb

@@ -1,5 +1,4 @@
 require 'spec_helper'
-require 'doorkeeper/oauth/helpers/unique_token'
 
 module Doorkeeper::OAuth::Helpers
   describe UniqueToken do

data/spec/lib/oauth/helpers/uri_checker_spec.rb

@@ -1,6 +1,4 @@
 require 'spec_helper'
-require 'uri'
-require 'doorkeeper/oauth/helpers/uri_checker'
 
 module Doorkeeper::OAuth::Helpers
   describe URIChecker do
@@ -39,6 +37,16 @@ module Doorkeeper::OAuth::Helpers
         uri = 'http://'
         expect(URIChecker.valid?(uri)).to be_falsey
       end
+
+      it 'is invalid if is not an uri' do
+        uri = '   '
+        expect(URIChecker.valid?(uri)).to be_falsey
+      end
+
+      it 'is valid for native uris' do
+        uri = 'urn:ietf:wg:oauth:2.0:oob'
+        expect(URIChecker.valid?(uri)).to be_truthy
+      end
     end
 
     describe '.matches?' do
@@ -64,6 +72,44 @@ module Doorkeeper::OAuth::Helpers
         client_uri = 'http://example.com?app.co=test'
         expect(URIChecker.matches?(uri, client_uri)).to be_falsey
       end
+
+      context "client registered query params" do
+        it "doesn't allow query being absent" do
+          uri = 'http://app.co'
+          client_uri = 'http://app.co/?vendorId=AJ4L7XXW9'
+          expect(URIChecker.matches?(uri, client_uri)).to be_falsey
+        end
+
+        it "is false if query values differ but key same" do
+          uri = 'http://app.co/?vendorId=pancakes'
+          client_uri = 'http://app.co/?vendorId=waffles'
+          expect(URIChecker.matches?(uri, client_uri)).to be_falsey
+        end
+
+        it "is false if query values same but key differs" do
+          uri = 'http://app.co/?foo=pancakes'
+          client_uri = 'http://app.co/?bar=pancakes'
+          expect(URIChecker.matches?(uri, client_uri)).to be_falsey
+        end
+
+        it "is false if query present and match, but unknown queries present" do
+          uri = 'http://app.co/?vendorId=pancakes&unknown=query'
+          client_uri = 'http://app.co/?vendorId=waffles'
+          expect(URIChecker.matches?(uri, client_uri)).to be_falsey
+        end
+
+        it "is true if queries are present and matche" do
+          uri = 'http://app.co/?vendorId=AJ4L7XXW9&foo=bar'
+          client_uri = 'http://app.co/?vendorId=AJ4L7XXW9&foo=bar'
+          expect(URIChecker.matches?(uri, client_uri)).to be_truthy
+        end
+
+        it "is true if queries are present, match and in different order" do
+          uri = 'http://app.co/?bing=bang&foo=bar'
+          client_uri = 'http://app.co/?foo=bar&bing=bang'
+          expect(URIChecker.matches?(uri, client_uri)).to be_truthy
+        end
+      end
     end
 
     describe '.valid_for_authorization?' do
@@ -96,9 +142,75 @@ module Doorkeeper::OAuth::Helpers
       end
 
       it 'is false if invalid' do
-        uri = client_uri = 'http://app.co/aaa?waffles=abc'
+        uri = 'http://app.co/aaa?pankcakes=abc'
+        client_uri = 'http://app.co/aaa?waffles=abc'
         expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be false
       end
+
+      it 'calls .matches?' do
+        uri = 'http://app.co/aaa?pankcakes=abc'
+        client_uri = 'http://app.co/aaa?waffles=abc'
+        expect(URIChecker).to receive(:matches?).with(uri, client_uri).once
+        URIChecker.valid_for_authorization?(uri, client_uri)
+      end
+
+      it 'calls .valid?' do
+        uri = 'http://app.co/aaa?pankcakes=abc'
+        client_uri = 'http://app.co/aaa?waffles=abc'
+        expect(URIChecker).to receive(:valid?).with(uri).once
+        URIChecker.valid_for_authorization?(uri, client_uri)
+      end
+    end
+
+    describe '.query_matches?' do
+      it 'is true if no queries' do
+        expect(URIChecker.query_matches?('', '')).to be_truthy
+        expect(URIChecker.query_matches?(nil, nil)).to be_truthy
+      end
+
+      it 'is true if same query' do
+        expect(URIChecker.query_matches?('foo', 'foo')).to be_truthy
+      end
+
+      it 'is false if different query' do
+        expect(URIChecker.query_matches?('foo', 'bar')).to be_falsey
+      end
+
+      it 'is true if same queries' do
+        expect(URIChecker.query_matches?('foo&bar', 'foo&bar')).to be_truthy
+      end
+
+      it 'is true if same queries, different order' do
+        expect(URIChecker.query_matches?('foo&bar', 'bar&foo')).to be_truthy
+      end
+
+      it 'is false if one different query' do
+        expect(URIChecker.query_matches?('foo&bang', 'foo&bing')).to be_falsey
+      end
+
+      it 'is true if same query with same value' do
+        expect(URIChecker.query_matches?('foo=bar', 'foo=bar')).to be_truthy
+      end
+
+      it 'is true if same queries with same values' do
+        expect(URIChecker.query_matches?('foo=bar&bing=bang', 'foo=bar&bing=bang')).to be_truthy
+      end
+
+      it 'is true if same queries with same values, different order' do
+        expect(URIChecker.query_matches?('foo=bar&bing=bang', 'bing=bang&foo=bar')).to be_truthy
+      end
+
+      it 'is false if same query with different value' do
+        expect(URIChecker.query_matches?('foo=bar', 'foo=bang')).to be_falsey
+      end
+
+      it 'is false if some queries missing' do
+        expect(URIChecker.query_matches?('foo=bar', 'foo=bar&bing=bang')).to be_falsey
+      end
+
+      it 'is false if some queries different value' do
+        expect(URIChecker.query_matches?('foo=bar&bing=bang', 'foo=bar&bing=banana')).to be_falsey
+      end
     end
   end
 end

data/spec/lib/oauth/invalid_token_response_spec.rb

@@ -1,12 +1,9 @@
 require 'spec_helper'
-require 'active_model'
-require 'doorkeeper'
-require 'doorkeeper/oauth/invalid_token_response'
 
 module Doorkeeper::OAuth
   describe InvalidTokenResponse do
     describe "#name" do
-      it  { expect(subject.name).to eq(:invalid_token) }
+      it { expect(subject.name).to eq(:invalid_token) }
     end
 
     describe "#status" do
@@ -40,7 +37,7 @@ module Doorkeeper::OAuth
         end
       end
 
-      context "unkown" do
+      context "unknown" do
         let(:access_token) { double(revoked?: false, expired?: false) }
 
         it "sets a description" do