doorkeeper 4.2.6 → 4.3.0

data/spec/models/doorkeeper/application_spec.rb

@@ -4,7 +4,7 @@ module Doorkeeper
   describe Application do
     let(:require_owner) { Doorkeeper.configuration.instance_variable_set('@confirm_application_owner', true) }
     let(:unset_require_owner) { Doorkeeper.configuration.instance_variable_set('@confirm_application_owner', false) }
-    let(:new_application) { FactoryGirl.build(:application) }
+    let(:new_application) { FactoryBot.build(:application) }
 
     let(:uid) { SecureRandom.hex(8) }
     let(:secret) { SecureRandom.hex(8) }
@@ -30,7 +30,7 @@ module Doorkeeper
       context 'application owner is required' do
         before(:each) do
           require_owner
-          @owner = FactoryGirl.build_stubbed(:doorkeeper_testing_user)
+          @owner = FactoryBot.build_stubbed(:doorkeeper_testing_user)
         end
 
         it 'is invalid without an owner' do
@@ -80,15 +80,15 @@ module Doorkeeper
     end
 
     it 'checks uniqueness of uid' do
-      app1 = FactoryGirl.create(:application)
-      app2 = FactoryGirl.create(:application)
+      app1 = FactoryBot.create(:application)
+      app2 = FactoryBot.create(:application)
       app2.uid = app1.uid
       expect(app2).not_to be_valid
     end
 
     it 'expects database to throw an error when uids are the same' do
-      app1 = FactoryGirl.create(:application)
-      app2 = FactoryGirl.create(:application)
+      app1 = FactoryBot.create(:application)
+      app2 = FactoryBot.create(:application)
       app2.uid = app1.uid
       expect { app2.save!(validate: false) }.to raise_error(uniqueness_error)
     end
@@ -123,19 +123,52 @@ module Doorkeeper
       end
 
       it 'should destroy its access grants' do
-        FactoryGirl.create(:access_grant, application: new_application)
+        FactoryBot.create(:access_grant, application: new_application)
         expect { new_application.destroy }.to change { Doorkeeper::AccessGrant.count }.by(-1)
       end
 
       it 'should destroy its access tokens' do
-        FactoryGirl.create(:access_token, application: new_application)
-        FactoryGirl.create(:access_token, application: new_application, revoked_at: Time.now.utc)
+        FactoryBot.create(:access_token, application: new_application)
+        FactoryBot.create(:access_token, application: new_application, revoked_at: Time.now.utc)
         expect do
           new_application.destroy
         end.to change { Doorkeeper::AccessToken.count }.by(-2)
       end
     end
 
+    describe :ordered_by do
+      let(:applications) { FactoryBot.create_list(:application, 5) }
+
+      context 'when a direction is not specified' do
+        it 'calls order with a default order of asc' do
+          names = applications.map(&:name).sort
+          expect(Application.ordered_by(:name).map(&:name)).to eq(names)
+        end
+      end
+
+      context 'when a direction is specified' do
+        it 'calls order with specified direction' do
+          names = applications.map(&:name).sort.reverse
+          expect(Application.ordered_by(:name, :desc).map(&:name)).to eq(names)
+        end
+      end
+    end
+
+    describe "#redirect_uri=" do
+      context "when array of valid redirect_uris" do
+        it "should join by newline" do
+          new_application.redirect_uri = ['http://localhost/callback1', 'http://localhost/callback2']
+          expect(new_application.redirect_uri).to eq("http://localhost/callback1\nhttp://localhost/callback2")
+        end
+      end
+      context "when string of valid redirect_uris" do
+        it "should store as-is" do
+          new_application.redirect_uri = "http://localhost/callback1\nhttp://localhost/callback2"
+          expect(new_application.redirect_uri).to eq("http://localhost/callback1\nhttp://localhost/callback2")
+        end
+      end
+    end
+
     describe :authorized_for do
       let(:resource_owner) { double(:resource_owner, id: 10) }
 
@@ -144,33 +177,33 @@ module Doorkeeper
       end
 
       it 'returns only application for a specific resource owner' do
-        FactoryGirl.create(:access_token, resource_owner_id: resource_owner.id + 1)
-        token = FactoryGirl.create(:access_token, resource_owner_id: resource_owner.id)
+        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id + 1)
+        token = FactoryBot.create(:access_token, resource_owner_id: resource_owner.id)
         expect(Application.authorized_for(resource_owner)).to eq([token.application])
       end
 
       it 'excludes revoked tokens' do
-        FactoryGirl.create(:access_token, resource_owner_id: resource_owner.id, revoked_at: 2.days.ago)
+        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id, revoked_at: 2.days.ago)
         expect(Application.authorized_for(resource_owner)).to be_empty
       end
 
       it 'returns all applications that have been authorized' do
-        token1 = FactoryGirl.create(:access_token, resource_owner_id: resource_owner.id)
-        token2 = FactoryGirl.create(:access_token, resource_owner_id: resource_owner.id)
+        token1 = FactoryBot.create(:access_token, resource_owner_id: resource_owner.id)
+        token2 = FactoryBot.create(:access_token, resource_owner_id: resource_owner.id)
         expect(Application.authorized_for(resource_owner)).to eq([token1.application, token2.application])
       end
 
       it 'returns only one application even if it has been authorized twice' do
-        application = FactoryGirl.create(:application)
-        FactoryGirl.create(:access_token, resource_owner_id: resource_owner.id, application: application)
-        FactoryGirl.create(:access_token, resource_owner_id: resource_owner.id, application: application)
+        application = FactoryBot.create(:application)
+        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id, application: application)
+        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id, application: application)
         expect(Application.authorized_for(resource_owner)).to eq([application])
       end
     end
 
     describe :authenticate do
       it 'finds the application via uid/secret' do
-        app = FactoryGirl.create :application
+        app = FactoryBot.create :application
         authenticated = Application.by_uid_and_secret(app.uid, app.secret)
         expect(authenticated).to eq(app)
       end

data/spec/requests/applications/applications_request_spec.rb

@@ -25,8 +25,8 @@ end
 
 feature 'Listing applications' do
   background do
-    FactoryGirl.create :application, name: 'Oauth Dude'
-    FactoryGirl.create :application, name: 'Awesome App'
+    FactoryBot.create :application, name: 'Oauth Dude'
+    FactoryBot.create :application, name: 'Awesome App'
   end
 
   scenario 'application list' do
@@ -38,7 +38,7 @@ end
 
 feature 'Show application' do
   given :app do
-    FactoryGirl.create :application, name: 'Just another oauth app'
+    FactoryBot.create :application, name: 'Just another oauth app'
   end
 
   scenario 'visiting application page' do
@@ -49,7 +49,7 @@ end
 
 feature 'Edit application' do
   let :app do
-    FactoryGirl.create :application, name: 'OMG my app'
+    FactoryBot.create :application, name: 'OMG my app'
   end
 
   background do
@@ -73,7 +73,7 @@ end
 
 feature 'Remove application' do
   background do
-    @app = FactoryGirl.create :application
+    @app = FactoryBot.create :application
   end
 
   scenario 'deleting an application from list' do

data/spec/requests/endpoints/token_spec.rb

@@ -9,7 +9,14 @@ describe 'Token endpoint' do
   it 'respond with correct headers' do
     post token_endpoint_url(code: @authorization.token, client: @client)
     should_have_header 'Pragma', 'no-cache'
-    should_have_header 'Cache-Control', 'no-store'
+
+    # Rails 5.2 changed headers
+    if ::Rails::VERSION::MAJOR >= 5 && ::Rails::VERSION::MINOR >= 2 || ::Rails::VERSION::MAJOR >= 6
+      should_have_header 'Cache-Control', 'private, no-store'
+    else
+      should_have_header 'Cache-Control', 'no-store'
+    end
+
     should_have_header 'Content-Type', 'application/json; charset=utf-8'
   end
 

data/spec/requests/flows/authorization_code_spec.rb

@@ -29,6 +29,7 @@ feature 'Authorization Code Flow' do
 
     access_grant_should_exist_for(@client, @resource_owner)
 
+    url_should_have_param('code', Doorkeeper::AccessGrant.first.token)
     i_should_see 'Authorization code:'
     i_should_see Doorkeeper::AccessGrant.first.token
   end

data/spec/requests/flows/client_credentials_spec.rb

@@ -1,7 +1,7 @@
 require 'spec_helper_integration'
 
 describe 'Client Credentials Request' do
-  let(:client) { FactoryGirl.create :application }
+  let(:client) { FactoryBot.create :application }
 
   context 'a valid request' do
     it 'authorizes the client and returns the token response' do

data/spec/requests/flows/implicit_grant_errors_spec.rb

@@ -17,13 +17,13 @@ feature 'Implicit Grant Flow Errors' do
     [:client_id,     :invalid_client],
     [:redirect_uri,  :invalid_redirect_uri]
   ].each do |error|
-    scenario "displays #{error.last.inspect} error for invalid #{error.first.inspect}" do
+    scenario "displays #{error.last} error for invalid #{error.first}" do
       visit authorization_endpoint_url(client: @client, error.first => 'invalid', response_type: 'token')
       i_should_not_see 'Authorize'
       i_should_see_translated_error_message error.last
     end
 
-    scenario "displays #{error.last.inspect} error when #{error.first.inspect} is missing" do
+    scenario "displays #{error.last} error when #{error.first} is missing" do
       visit authorization_endpoint_url(client: @client, error.first => '', response_type: 'token')
       i_should_not_see 'Authorize'
       i_should_see_translated_error_message error.last

data/spec/requests/flows/refresh_token_spec.rb

@@ -37,7 +37,7 @@ describe 'Refresh Token Flow' do
 
   context 'refreshing the token' do
     before do
-      @token = FactoryGirl.create(
+      @token = FactoryBot.create(
         :access_token,
         application: @client,
         resource_owner_id: 1,
@@ -101,14 +101,14 @@ describe 'Refresh Token Flow' do
       should_have_json 'error', 'invalid_grant'
     end
 
-    it 'client gets an error for revoked acccess token' do
+    it 'client gets an error for revoked access token' do
       @token.revoke
       post refresh_token_endpoint_url(client: @client, refresh_token: @token.refresh_token)
       should_not_have_json 'refresh_token'
       should_have_json 'error', 'invalid_grant'
     end
 
-    it 'second of simultaneous client requests get an error for revoked acccess token' do
+    it 'second of simultaneous client requests get an error for revoked access token' do
       allow_any_instance_of(Doorkeeper::AccessToken).to receive(:revoked?).and_return(false, true)
       post refresh_token_endpoint_url(client: @client, refresh_token: @token.refresh_token)
 
@@ -130,7 +130,7 @@ describe 'Refresh Token Flow' do
       )
       last_token.update_attribute :created_at, 5.seconds.ago
 
-      @token = FactoryGirl.create(
+      @token = FactoryBot.create(
         :access_token,
         application: @client,
         resource_owner_id: @resource_owner.id,

data/spec/requests/flows/revoke_token_spec.rb

@@ -6,10 +6,10 @@ describe 'Revoke Token Flow' do
   end
 
   context 'with default parameters' do
-    let(:client_application) { FactoryGirl.create :application }
+    let(:client_application) { FactoryBot.create :application }
     let(:resource_owner) { User.create!(name: 'John', password: 'sekret') }
     let(:access_token) do
-      FactoryGirl.create(:access_token,
+      FactoryBot.create(:access_token,
                          application: client_application,
                          resource_owner_id: resource_owner.id,
                          use_refresh_token: true)
@@ -28,7 +28,7 @@ describe 'Revoke Token Flow' do
 
         access_token.reload
 
-        expect(response).to be_success
+        expect(response).to be_successful
         expect(access_token.revoked?).to be_truthy
       end
 
@@ -37,7 +37,7 @@ describe 'Revoke Token Flow' do
 
         access_token.reload
 
-        expect(response).to be_success
+        expect(response).to be_successful
         expect(access_token.revoked?).to be_truthy
       end
 
@@ -48,7 +48,7 @@ describe 'Revoke Token Flow' do
 
           # The authorization server responds with HTTP status code 200 even if
           # token is invalid
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(Doorkeeper::AccessToken.where(revoked_at: nil).count).to eq(num_prev_revoked_tokens)
         end
       end
@@ -64,7 +64,7 @@ describe 'Revoke Token Flow' do
 
           access_token.reload
 
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(access_token.revoked?).to be_falsey
         end
       end
@@ -75,13 +75,13 @@ describe 'Revoke Token Flow' do
 
           access_token.reload
 
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(access_token.revoked?).to be_falsey
         end
       end
 
       context 'with valid token for another client application' do
-        let(:other_client_application) { FactoryGirl.create :application }
+        let(:other_client_application) { FactoryBot.create :application }
         let(:headers) do
           client_id = other_client_application.uid
           client_secret = other_client_application.secret
@@ -94,7 +94,7 @@ describe 'Revoke Token Flow' do
 
           access_token.reload
 
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(access_token.revoked?).to be_falsey
         end
       end
@@ -102,7 +102,7 @@ describe 'Revoke Token Flow' do
 
     context 'with public OAuth 2.0 client/application' do
       let(:access_token) do
-        FactoryGirl.create(:access_token,
+        FactoryBot.create(:access_token,
                            application: nil,
                            resource_owner_id: resource_owner.id,
                            use_refresh_token: true)
@@ -113,7 +113,7 @@ describe 'Revoke Token Flow' do
 
         access_token.reload
 
-        expect(response).to be_success
+        expect(response).to be_successful
         expect(access_token.revoked?).to be_truthy
       end
 
@@ -122,13 +122,13 @@ describe 'Revoke Token Flow' do
 
         access_token.reload
 
-        expect(response).to be_success
+        expect(response).to be_successful
         expect(access_token.revoked?).to be_truthy
       end
 
       context 'with a valid token issued for a confidential client' do
         let(:access_token) do
-          FactoryGirl.create(:access_token,
+          FactoryBot.create(:access_token,
                              application: client_application,
                              resource_owner_id: resource_owner.id,
                              use_refresh_token: true)
@@ -139,7 +139,7 @@ describe 'Revoke Token Flow' do
 
           access_token.reload
 
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(access_token.revoked?).to be_falsey
         end
 
@@ -148,7 +148,7 @@ describe 'Revoke Token Flow' do
 
           access_token.reload
 
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(access_token.revoked?).to be_falsey
         end
       end

data/spec/requests/protected_resources/metal_spec.rb

@@ -2,7 +2,7 @@ require 'spec_helper_integration'
 
 describe 'ActionController::Metal API' do
   before do
-    @client   = FactoryGirl.create(:application)
+    @client   = FactoryBot.create(:application)
     @resource = User.create!(name: 'Joe', password: 'sekret')
     @token    = client_is_authorized(@client, @resource)
   end

data/spec/requests/protected_resources/private_api_spec.rb

@@ -2,7 +2,7 @@ require 'spec_helper_integration'
 
 feature 'Private API' do
   background do
-    @client   = FactoryGirl.create(:application)
+    @client   = FactoryBot.create(:application)
     @resource = User.create!(name: 'Joe', password: 'sekret')
     @token    = client_is_authorized(@client, @resource)
   end

data/spec/routing/custom_controller_routes_spec.rb

@@ -45,6 +45,10 @@ describe 'Custom controller for routes' do
     expect(post('/space/oauth/revoke')).to route_to('custom_authorizations#revoke')
   end
 
+  it 'POST /space/oauth/introspect routes to tokens controller' do
+    expect(post('/space/oauth/introspect')).to route_to('custom_authorizations#introspect')
+  end
+
   it 'GET /space/oauth/applications routes to applications controller' do
     expect(get('/space/oauth/applications')).to route_to('custom_authorizations#index')
   end

data/spec/routing/default_routes_spec.rb

@@ -21,6 +21,10 @@ describe 'Default routes' do
     expect(post('/oauth/revoke')).to route_to('doorkeeper/tokens#revoke')
   end
 
+  it 'POST /oauth/introspect routes to tokens controller' do
+    expect(post('/oauth/introspect')).to route_to('doorkeeper/tokens#introspect')
+  end
+
   it 'GET /oauth/applications routes to applications controller' do
     expect(get('/oauth/applications')).to route_to('doorkeeper/applications#index')
   end
@@ -29,7 +33,7 @@ describe 'Default routes' do
     expect(get('/oauth/authorized_applications')).to route_to('doorkeeper/authorized_applications#index')
   end
 
-  it 'GET /oauth/token/info route to authorzed tokeninfo controller' do
+  it 'GET /oauth/token/info route to authorized tokeninfo controller' do
     expect(get('/oauth/token/info')).to route_to('doorkeeper/token_info#show')
   end
 end

data/spec/spec_helper_integration.rb

@@ -1,6 +1,17 @@
 if ENV['TRAVIS']
   require 'coveralls'
-  Coveralls.wear!('rails') { add_filter('/spec/') }
+
+  Coveralls.wear!('rails') do
+    add_filter('/spec/')
+    add_filter('/lib/generators/doorkeeper/templates/')
+  end
+else
+  require 'simplecov'
+
+  SimpleCov.start do
+    add_filter('/spec/')
+    add_filter('/lib/generators/doorkeeper/templates/')
+  end
 end
 
 ENV['RAILS_ENV'] ||= 'test'
@@ -25,10 +36,10 @@ begin
 rescue LoadError
 end
 
-Rails.logger.info "====> Doorkeeper.orm = #{Doorkeeper.configuration.orm.inspect}"
+Rails.logger.info "====> Doorkeeper.orm = #{Doorkeeper.configuration.orm}"
 if Doorkeeper.configuration.orm == :active_record
-  Rails.logger.info "======> active_record.table_name_prefix = #{Rails.configuration.active_record.table_name_prefix.inspect}"
-  Rails.logger.info "======> active_record.table_name_suffix = #{Rails.configuration.active_record.table_name_suffix.inspect}"
+  Rails.logger.info "======> active_record.table_name_prefix = #{Rails.configuration.active_record.table_name_prefix}"
+  Rails.logger.info "======> active_record.table_name_suffix = #{Rails.configuration.active_record.table_name_suffix}"
 end
 Rails.logger.info "====> Rails version: #{Rails.version}"
 Rails.logger.info "====> Ruby version: #{RUBY_VERSION}"