doorkeeper 4.2.5 → 5.0.0

data/spec/requests/flows/implicit_grant_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 feature 'Implicit Grant Flow (feature spec)' do
   background do
@@ -17,6 +17,29 @@ feature 'Implicit Grant Flow (feature spec)' do
 
     i_should_be_on_client_callback @client
   end
+
+  context 'when application scopes are present and no scope is passed' do
+    background do
+      @client.update_attributes(scopes: 'public write read')
+    end
+
+    scenario 'access token has no scopes' do
+      default_scopes_exist :admin
+      visit authorization_endpoint_url(client: @client, response_type: 'token')
+      click_on 'Authorize'
+      access_token_should_exist_for @client, @resource_owner
+      token = Doorkeeper::AccessToken.first
+      expect(token.scopes).to be_empty
+    end
+
+    scenario 'access token has scopes which are common in application scopees and default scopes' do
+      default_scopes_exist :public, :write
+      visit authorization_endpoint_url(client: @client, response_type: 'token')
+      click_on 'Authorize'
+      access_token_should_exist_for @client, @resource_owner
+      access_token_should_have_scopes :public, :write
+    end
+  end
 end
 
 describe 'Implicit Grant Flow (request spec)' do
@@ -34,11 +57,13 @@ describe 'Implicit Grant Flow (request spec)' do
       token = client_is_authorized(@client, @resource_owner)
 
       post "/oauth/authorize",
-           client_id: @client.uid,
-           state: '',
-           redirect_uri: @client.redirect_uri,
-           response_type: 'token',
-           commit: 'Authorize'
+           params: {
+             client_id: @client.uid,
+             state: '',
+             redirect_uri: @client.redirect_uri,
+             response_type: 'token',
+             commit: 'Authorize'
+           }
 
       expect(response.location).not_to include(token.token)
     end
@@ -49,11 +74,13 @@ describe 'Implicit Grant Flow (request spec)' do
       token = client_is_authorized(@client, @resource_owner)
 
       post "/oauth/authorize",
-           client_id: @client.uid,
-           state: '',
-           redirect_uri: @client.redirect_uri,
-           response_type: 'token',
-           commit: 'Authorize'
+           params: {
+             client_id: @client.uid,
+             state: '',
+             redirect_uri: @client.redirect_uri,
+             response_type: 'token',
+             commit: 'Authorize'
+           }
 
       expect(response.location).to include(token.token)
     end

data/spec/requests/flows/password_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe 'Resource Owner Password Credentials Flow not set up' do
   before do
@@ -7,49 +7,92 @@ describe 'Resource Owner Password Credentials Flow not set up' do
   end
 
   context 'with valid user credentials' do
-    it 'doesn\'t issue new token' do
+    it 'does not issue new token' do
       expect do
         post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
-      end.to_not change { Doorkeeper::AccessToken.count }
+      end.to_not(change { Doorkeeper::AccessToken.count })
     end
   end
 end
 
 describe 'Resource Owner Password Credentials Flow' do
+  let(:client_attributes) { {} }
+
   before do
     config_is_set(:grant_flows, ["password"])
     config_is_set(:resource_owner_from_credentials) { User.authenticate! params[:username], params[:password] }
-    client_exists
+    client_exists(client_attributes)
     create_resource_owner
   end
 
   context 'with valid user credentials' do
-    it 'should issue new token with confidential client' do
-      expect do
-        post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
-      end.to change { Doorkeeper::AccessToken.count }.by(1)
+    context "with non-confidential/public client" do
+      let(:client_attributes) { { confidential: false } }
+
+      context "when client_secret absent" do
+        it "should issue new token" do
+          expect do
+            post password_token_endpoint_url(client_id: @client.uid, resource_owner: @resource_owner)
+          end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+          token = Doorkeeper::AccessToken.first
+
+          expect(token.application_id).to eq @client.id
+          should_have_json 'access_token', token.token
+        end
+      end
+
+      context "when client_secret present" do
+        it "should issue new token" do
+          expect do
+            post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
+          end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+          token = Doorkeeper::AccessToken.first
+
+          expect(token.application_id).to eq @client.id
+          should_have_json 'access_token', token.token
+        end
+
+        context "when client_secret incorrect" do
+          it "should not issue new token" do
+            expect do
+              post password_token_endpoint_url(client_id: @client.uid, client_secret: 'foobar', resource_owner: @resource_owner)
+            end.not_to(change { Doorkeeper::AccessToken.count })
+
+            expect(response).not_to be_ok
+          end
+        end
+      end
+    end
 
-      token = Doorkeeper::AccessToken.first
+    context "with confidential/private client" do
+      it "should issue new token" do
+        expect do
+          post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
+        end.to change { Doorkeeper::AccessToken.count }.by(1)
 
-      expect(token.application_id).to eq @client.id
-      should_have_json 'access_token', token.token
-    end
+        token = Doorkeeper::AccessToken.first
 
-    it 'should issue new token with public client (only client_id present)' do
-      expect do
-        post password_token_endpoint_url(client_id: @client.uid, resource_owner: @resource_owner)
-      end.to change { Doorkeeper::AccessToken.count }.by(1)
+        expect(token.application_id).to eq @client.id
+        should_have_json 'access_token', token.token
+      end
 
-      token = Doorkeeper::AccessToken.first
+      context "when client_secret absent" do
+        it "should not issue new token" do
+          expect do
+            post password_token_endpoint_url(client_id: @client.uid, resource_owner: @resource_owner)
+          end.not_to(change { Doorkeeper::AccessToken.count })
 
-      expect(token.application_id).to eq @client.id
-      should_have_json 'access_token', token.token
+          expect(response).not_to be_ok
+        end
+      end
     end
 
     it 'should issue new token without client credentials' do
       expect do
         post password_token_endpoint_url(resource_owner: @resource_owner)
-      end.to change { Doorkeeper::AccessToken.count }.by(1)
+      end.to(change { Doorkeeper::AccessToken.count }.by(1))
 
       token = Doorkeeper::AccessToken.first
 
@@ -77,6 +120,99 @@ describe 'Resource Owner Password Credentials Flow' do
       expect(Doorkeeper::AccessToken.count).to be(1)
       should_have_json 'access_token', Doorkeeper::AccessToken.first.token
     end
+
+    context 'with valid, default scope' do
+      before do
+        default_scopes_exist :public
+      end
+
+      it 'should issue new token' do
+        expect do
+          post password_token_endpoint_url(client: @client, resource_owner: @resource_owner, scope: 'public')
+        end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+        token = Doorkeeper::AccessToken.first
+
+        expect(token.application_id).to eq @client.id
+        should_have_json 'access_token', token.token
+        should_have_json 'scope', 'public'
+      end
+    end
+  end
+
+  context 'when application scopes are present and differs from configured default scopes and no scope is passed' do
+    before do
+      default_scopes_exist :public
+      @client.update_attributes(scopes: 'abc')
+    end
+
+    it 'issues new token without any scope' do
+      expect do
+      post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
+      end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+      token = Doorkeeper::AccessToken.first
+
+      expect(token.application_id).to eq @client.id
+      expect(token.scopes).to be_empty
+      should_have_json 'access_token', token.token
+      should_not_have_json 'scope'
+    end
+  end
+
+  context 'when application scopes contain some of the default scopes and no scope is passed' do
+    before do
+      @client.update_attributes(scopes: 'read write public')
+    end
+
+    it 'issues new token with one default scope that are present in application scopes' do
+      default_scopes_exist :public, :admin
+
+      expect do
+        post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
+      end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+      token = Doorkeeper::AccessToken.first
+
+      expect(token.application_id).to eq @client.id
+      should_have_json 'access_token', token.token
+      should_have_json 'scope', 'public'
+    end
+
+    it 'issues new token with multiple default scopes that are present in application scopes' do
+      default_scopes_exist :public, :read, :update
+
+      expect do
+        post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
+      end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+      token = Doorkeeper::AccessToken.first
+
+      expect(token.application_id).to eq @client.id
+      should_have_json 'access_token', token.token
+      should_have_json 'scope', 'public read'
+    end
+  end
+
+  context 'with invalid scopes' do
+    subject do
+      post password_token_endpoint_url(client: @client,
+                                       resource_owner: @resource_owner,
+                                       scope: 'random')
+    end
+
+    it 'should not issue new token' do
+      expect { subject }.to_not(change { Doorkeeper::AccessToken.count })
+    end
+
+    it 'should return invalid_scope error' do
+      subject
+      should_have_json 'error', 'invalid_scope'
+      should_have_json 'error_description', translated_error_message(:invalid_scope)
+      should_not_have_json 'access_token'
+
+      expect(response.status).to eq(401)
+    end
   end
 
   context 'with invalid user credentials' do
@@ -85,13 +221,13 @@ describe 'Resource Owner Password Credentials Flow' do
         post password_token_endpoint_url(client: @client,
                                          resource_owner_username: @resource_owner.name,
                                          resource_owner_password: 'wrongpassword')
-      end.to_not change { Doorkeeper::AccessToken.count }
+      end.to_not(change { Doorkeeper::AccessToken.count })
     end
 
     it 'should not issue new token without credentials' do
       expect do
         post password_token_endpoint_url(client: @client)
-      end.to_not change { Doorkeeper::AccessToken.count }
+      end.to_not(change { Doorkeeper::AccessToken.count })
     end
   end
 
@@ -101,7 +237,7 @@ describe 'Resource Owner Password Credentials Flow' do
         post password_token_endpoint_url(client_id: @client.uid,
                                          client_secret: 'bad_secret',
                                          resource_owner: @resource_owner)
-      end.to_not change { Doorkeeper::AccessToken.count }
+      end.to_not(change { Doorkeeper::AccessToken.count })
     end
   end
 
@@ -109,7 +245,7 @@ describe 'Resource Owner Password Credentials Flow' do
     it 'should not issue new token with bad client id' do
       expect do
         post password_token_endpoint_url(client_id: 'bad_id', resource_owner: @resource_owner)
-      end.to_not change { Doorkeeper::AccessToken.count }
+      end.to_not(change { Doorkeeper::AccessToken.count })
     end
   end
 end

data/spec/requests/flows/refresh_token_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe 'Refresh Token Flow' do
   before do
@@ -14,7 +14,7 @@ describe 'Refresh Token Flow' do
       authorization_code_exists application: @client
     end
 
-    it 'client gets the refresh token and refreshses it' do
+    it 'client gets the refresh token and refreshes it' do
       post token_endpoint_url(code: @authorization.token, client: @client)
 
       token = Doorkeeper::AccessToken.first
@@ -37,7 +37,7 @@ describe 'Refresh Token Flow' do
 
   context 'refreshing the token' do
     before do
-      @token = FactoryGirl.create(
+      @token = FactoryBot.create(
         :access_token,
         application: @client,
         resource_owner_id: 1,
@@ -101,14 +101,14 @@ describe 'Refresh Token Flow' do
       should_have_json 'error', 'invalid_grant'
     end
 
-    it 'client gets an error for revoked acccess token' do
+    it 'client gets an error for revoked access token' do
       @token.revoke
       post refresh_token_endpoint_url(client: @client, refresh_token: @token.refresh_token)
       should_not_have_json 'refresh_token'
       should_have_json 'error', 'invalid_grant'
     end
 
-    it 'second of simultaneous client requests get an error for revoked acccess token' do
+    it 'second of simultaneous client requests get an error for revoked access token' do
       allow_any_instance_of(Doorkeeper::AccessToken).to receive(:revoked?).and_return(false, true)
       post refresh_token_endpoint_url(client: @client, refresh_token: @token.refresh_token)
 
@@ -130,7 +130,7 @@ describe 'Refresh Token Flow' do
       )
       last_token.update_attribute :created_at, 5.seconds.ago
 
-      @token = FactoryGirl.create(
+      @token = FactoryBot.create(
         :access_token,
         application: @client,
         resource_owner_id: @resource_owner.id,

data/spec/requests/flows/revoke_token_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe 'Revoke Token Flow' do
   before do
@@ -6,10 +6,10 @@ describe 'Revoke Token Flow' do
   end
 
   context 'with default parameters' do
-    let(:client_application) { FactoryGirl.create :application }
+    let(:client_application) { FactoryBot.create :application }
     let(:resource_owner) { User.create!(name: 'John', password: 'sekret') }
     let(:access_token) do
-      FactoryGirl.create(:access_token,
+      FactoryBot.create(:access_token,
                          application: client_application,
                          resource_owner_id: resource_owner.id,
                          use_refresh_token: true)
@@ -24,31 +24,31 @@ describe 'Revoke Token Flow' do
       end
 
       it 'should revoke the access token provided' do
-        post revocation_token_endpoint_url, { token: access_token.token }, headers
+        post revocation_token_endpoint_url, params: { token: access_token.token }, headers: headers
 
         access_token.reload
 
-        expect(response).to be_success
+        expect(response).to be_successful
         expect(access_token.revoked?).to be_truthy
       end
 
       it 'should revoke the refresh token provided' do
-        post revocation_token_endpoint_url, { token: access_token.refresh_token }, headers
+        post revocation_token_endpoint_url, params: { token: access_token.refresh_token }, headers: headers
 
         access_token.reload
 
-        expect(response).to be_success
+        expect(response).to be_successful
         expect(access_token.revoked?).to be_truthy
       end
 
       context 'with invalid token to revoke' do
         it 'should not revoke any tokens and respond successfully' do
           num_prev_revoked_tokens = Doorkeeper::AccessToken.where(revoked_at: nil).count
-          post revocation_token_endpoint_url, { token: 'I_AM_AN_INVALID_TOKEN' }, headers
+          post revocation_token_endpoint_url, params: { token: 'I_AM_AN_INVALID_TOKEN' }, headers: headers
 
           # The authorization server responds with HTTP status code 200 even if
           # token is invalid
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(Doorkeeper::AccessToken.where(revoked_at: nil).count).to eq(num_prev_revoked_tokens)
         end
       end
@@ -60,28 +60,28 @@ describe 'Revoke Token Flow' do
           { 'HTTP_AUTHORIZATION' => "Basic #{credentials}" }
         end
         it 'should not revoke any tokens and respond successfully' do
-          post revocation_token_endpoint_url, { token: access_token.token }, headers
+          post revocation_token_endpoint_url, params: { token: access_token.token }, headers: headers
 
           access_token.reload
 
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(access_token.revoked?).to be_falsey
         end
       end
 
       context 'with no credentials and a valid token' do
         it 'should not revoke any tokens and respond successfully' do
-          post revocation_token_endpoint_url, { token: access_token.token }
+          post revocation_token_endpoint_url, params: { token: access_token.token }
 
           access_token.reload
 
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(access_token.revoked?).to be_falsey
         end
       end
 
       context 'with valid token for another client application' do
-        let(:other_client_application) { FactoryGirl.create :application }
+        let(:other_client_application) { FactoryBot.create :application }
         let(:headers) do
           client_id = other_client_application.uid
           client_secret = other_client_application.secret
@@ -90,11 +90,11 @@ describe 'Revoke Token Flow' do
         end
 
         it 'should not revoke the token as its unauthorized' do
-          post revocation_token_endpoint_url, { token: access_token.token }, headers
+          post revocation_token_endpoint_url, params: { token: access_token.token }, headers: headers
 
           access_token.reload
 
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(access_token.revoked?).to be_falsey
         end
       end
@@ -102,53 +102,53 @@ describe 'Revoke Token Flow' do
 
     context 'with public OAuth 2.0 client/application' do
       let(:access_token) do
-        FactoryGirl.create(:access_token,
+        FactoryBot.create(:access_token,
                            application: nil,
                            resource_owner_id: resource_owner.id,
                            use_refresh_token: true)
       end
 
       it 'should revoke the access token provided' do
-        post revocation_token_endpoint_url, { token: access_token.token }
+        post revocation_token_endpoint_url, params: { token: access_token.token }
 
         access_token.reload
 
-        expect(response).to be_success
+        expect(response).to be_successful
         expect(access_token.revoked?).to be_truthy
       end
 
       it 'should revoke the refresh token provided' do
-        post revocation_token_endpoint_url, { token: access_token.refresh_token }
+        post revocation_token_endpoint_url, params: { token: access_token.refresh_token }
 
         access_token.reload
 
-        expect(response).to be_success
+        expect(response).to be_successful
         expect(access_token.revoked?).to be_truthy
       end
 
       context 'with a valid token issued for a confidential client' do
         let(:access_token) do
-          FactoryGirl.create(:access_token,
+          FactoryBot.create(:access_token,
                              application: client_application,
                              resource_owner_id: resource_owner.id,
                              use_refresh_token: true)
         end
 
         it 'should not revoke the access token provided' do
-          post revocation_token_endpoint_url, { token: access_token.token }
+          post revocation_token_endpoint_url, params: { token: access_token.token }
 
           access_token.reload
 
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(access_token.revoked?).to be_falsey
         end
 
         it 'should not revoke the refresh token provided' do
-          post revocation_token_endpoint_url, { token: access_token.token }
+          post revocation_token_endpoint_url, params: { token: access_token.token }
 
           access_token.reload
 
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(access_token.revoked?).to be_falsey
         end
       end

data/spec/requests/flows/skip_authorization_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 feature 'Skip authorization form' do
   background do
@@ -15,13 +15,24 @@ feature 'Skip authorization form' do
     end
 
     scenario 'skips the authorization and return a new grant code' do
-      client_is_authorized(@client, @resource_owner, scopes: 'public')
-      visit authorization_endpoint_url(client: @client)
+      client_is_authorized(@client, @resource_owner, scopes: "public")
+      visit authorization_endpoint_url(client: @client, scope: "public")
+
+      i_should_not_see "Authorize"
+      client_should_be_authorized @client
+      i_should_be_on_client_callback @client
+      url_should_have_param "code", Doorkeeper::AccessGrant.first.token
+    end
+
+    scenario "skips the authorization if other scopes are not requested" do
+      client_exists scopes: "public read write"
+      client_is_authorized(@client, @resource_owner, scopes: "public")
+      visit authorization_endpoint_url(client: @client, scope: "public")
 
-      i_should_not_see 'Authorize'
+      i_should_not_see "Authorize"
       client_should_be_authorized @client
       i_should_be_on_client_callback @client
-      url_should_have_param 'code', Doorkeeper::AccessGrant.first.token
+      url_should_have_param "code", Doorkeeper::AccessGrant.first.token
     end
 
     scenario 'does not skip authorization when scopes differ (new request has fewer scopes)' do
@@ -43,12 +54,6 @@ feature 'Skip authorization form' do
       access_grant_should_have_scopes :public
     end
 
-    scenario 'doesn not skip authorization when scopes are greater' do
-      client_is_authorized(@client, @resource_owner, scopes: 'public')
-      visit authorization_endpoint_url(client: @client, scope: 'public write')
-      i_should_see 'Authorize'
-    end
-
     scenario 'creates grant with new scope when scopes are greater' do
       client_is_authorized(@client, @resource_owner, scopes: 'public')
       visit authorization_endpoint_url(client: @client, scope: 'public write')

data/spec/requests/protected_resources/metal_spec.rb

@@ -1,8 +1,8 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe 'ActionController::Metal API' do
   before do
-    @client   = FactoryGirl.create(:application)
+    @client   = FactoryBot.create(:application)
     @resource = User.create!(name: 'Joe', password: 'sekret')
     @token    = client_is_authorized(@client, @resource)
   end

data/spec/requests/protected_resources/private_api_spec.rb

@@ -1,8 +1,8 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 feature 'Private API' do
   background do
-    @client   = FactoryGirl.create(:application)
+    @client   = FactoryBot.create(:application)
     @resource = User.create!(name: 'Joe', password: 'sekret')
     @token    = client_is_authorized(@client, @resource)
   end