doorkeeper 4.2.5 → 5.0.0

data/spec/validators/redirect_uri_validator_spec.rb

@@ -1,8 +1,8 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe RedirectUriValidator do
   subject do
-    FactoryGirl.create(:application)
+    FactoryBot.create(:application)
   end
 
   it 'is valid when the uri is a uri' do
@@ -10,6 +10,21 @@ describe RedirectUriValidator do
     expect(subject).to be_valid
   end
 
+  # Most mobile and desktop operating systems allow apps to register a custom URL
+  # scheme that will launch the app when a URL with that scheme is visited from
+  # the system browser.
+  #
+  # @see https://www.oauth.com/oauth2-servers/redirect-uris/redirect-uris-native-apps/
+  it 'is valid when the uri is custom native URI' do
+    subject.redirect_uri = 'myapp://callback'
+    expect(subject).to be_valid
+  end
+
+  it 'is valid when the uri has a query parameter' do
+    subject.redirect_uri = 'https://example.com/abcd?xyz=123'
+    expect(subject).to be_valid
+  end
+
   it 'accepts native redirect uri' do
     subject.redirect_uri = 'urn:ietf:wg:oauth:2.0:oob'
     expect(subject).to be_valid
@@ -39,11 +54,6 @@ describe RedirectUriValidator do
     expect(subject.errors[:redirect_uri].first).to eq('cannot contain a fragment.')
   end
 
-  it 'is invalid when the uri has a query parameter' do
-    subject.redirect_uri = 'https://example.com/abcd?xyz=123'
-    expect(subject).to be_valid
-  end
-
   context 'force secured uri' do
     it 'accepts an valid uri' do
       subject.redirect_uri = 'https://example.com/callback'
@@ -68,6 +78,40 @@ describe RedirectUriValidator do
       expect(subject).to be_valid
     end
 
+    it 'accepts a non secured protocol when conditional option defined' do
+      Doorkeeper.configure do
+        orm DOORKEEPER_ORM
+        force_ssl_in_redirect_uri { |uri| uri.host != 'localhost' }
+      end
+
+      application = FactoryBot.build(:application, redirect_uri: 'http://localhost/callback')
+      expect(application).to be_valid
+
+      application = FactoryBot.build(:application, redirect_uri: 'https://test.com/callback')
+      expect(application).to be_valid
+
+      application = FactoryBot.build(:application, redirect_uri: 'http://localhost2/callback')
+      expect(application).not_to be_valid
+
+      application = FactoryBot.build(:application, redirect_uri: 'https://test.com/callback')
+      expect(application).to be_valid
+    end
+
+    it 'forbids redirect uri if required' do
+      subject.redirect_uri = 'javascript://document.cookie'
+
+      Doorkeeper.configure do
+        orm DOORKEEPER_ORM
+        forbid_redirect_uri { |uri| uri.scheme == 'javascript' }
+      end
+
+      expect(subject).to be_invalid
+      expect(subject.errors[:redirect_uri].first).to eq('is forbidden by the server.')
+
+      subject.redirect_uri = 'https://localhost/callback'
+      expect(subject).to be_valid
+    end
+
     it 'invalidates the uri when the uri does not use a secure protocol' do
       subject.redirect_uri = 'http://example.com/callback'
       expect(subject).not_to be_valid
@@ -75,4 +119,11 @@ describe RedirectUriValidator do
       expect(error).to eq('must be an HTTPS/SSL URI.')
     end
   end
+
+  context 'multiple redirect uri' do
+    it 'invalidates the second uri when the first uri is native uri' do
+      subject.redirect_uri = "urn:ietf:wg:oauth:2.0:oob\nexample.com/callback"
+      expect(subject).to be_invalid
+    end
+  end
 end

data/spec/version/version_spec.rb

@@ -0,0 +1,15 @@
+require 'spec_helper'
+
+describe Doorkeeper::VERSION do
+  context '#gem_version' do
+    it 'returns Gem::Version instance' do
+      expect(Doorkeeper.gem_version).to be_an_instance_of(Gem::Version)
+    end
+  end
+
+  context 'VERSION' do
+    it 'returns gem version string' do
+      expect(Doorkeeper::VERSION::STRING).to match(/^\d+\.\d+\.\d+(\.\w+)?$/)
+    end
+  end
+end