doorkeeper 4.3.2 → 5.0.0.rc1

data/spec/controllers/authorizations_controller_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
   include AuthorizationRequestHelper
@@ -6,7 +6,7 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
   if Rails::VERSION::MAJOR >= 5
     class ActionDispatch::TestResponse
       def query_params
-        @_query_params ||= begin
+        @query_params ||= begin
           fragment = URI.parse(location).fragment
           Rack::Utils.parse_query(fragment)
         end
@@ -15,7 +15,7 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
   else
     class ActionController::TestResponse
       def query_params
-        @_query_params ||= begin
+        @query_params ||= begin
           fragment = URI.parse(location).fragment
           Rack::Utils.parse_query(fragment)
         end
@@ -34,11 +34,14 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
   before do
     allow(Doorkeeper.configuration).to receive(:grant_flows).and_return(["implicit"])
     allow(controller).to receive(:current_resource_owner).and_return(user)
+    allow(Doorkeeper.configuration).to receive(:custom_access_token_expires_in).and_return(proc { |context|
+      context.grant_type == Doorkeeper::OAuth::IMPLICIT ? 1234 : nil
+    })
   end
 
   describe 'POST #create' do
     before do
-      post :create, client_id: client.uid, response_type: 'token', redirect_uri: client.redirect_uri
+      post :create, params: { client_id: client.uid, response_type: 'token', redirect_uri: client.redirect_uri }
     end
 
     it 'redirects after authorization' do
@@ -58,7 +61,7 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
     end
 
     it 'includes token expiration in fragment' do
-      expect(response.query_params['expires_in'].to_i).to eq(2.hours.to_i)
+      expect(response.query_params['expires_in'].to_i).to eq(1234)
     end
 
     it 'issues the token for the current client' do
@@ -70,10 +73,48 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
     end
   end
 
+  describe "POST #create in API mode" do
+    before do
+      allow(Doorkeeper.configuration).to receive(:api_only).and_return(true)
+      post :create, params: { client_id: client.uid, response_type: "token", redirect_uri: client.redirect_uri }
+    end
+
+    let(:response_json_body) { JSON.parse(response.body) }
+    let(:redirect_uri) { response_json_body["redirect_uri"] }
+
+    it "renders success after authorization" do
+      expect(response).to be_successful
+    end
+
+    it "renders correct redirect uri" do
+      expect(redirect_uri).to match(/^#{client.redirect_uri}/)
+    end
+
+    it "includes access token in fragment" do
+      expect(redirect_uri.match(/access_token=([a-f0-9]+)&?/)[1]).to eq(Doorkeeper::AccessToken.first.token)
+    end
+
+    it "includes token type in fragment" do
+      expect(redirect_uri.match(/token_type=(\w+)&?/)[1]).to eq "bearer"
+    end
+
+    it "includes token expiration in fragment" do
+      expect(redirect_uri.match(/expires_in=(\d+)&?/)[1].to_i).to eq 1234
+    end
+
+    it "issues the token for the current client" do
+      expect(Doorkeeper::AccessToken.first.application_id).to eq(client.id)
+    end
+
+    it "issues the token for the current resource owner" do
+      expect(Doorkeeper::AccessToken.first.resource_owner_id).to eq(user.id)
+    end
+  end
+
   describe 'POST #create with errors' do
     before do
       default_scopes_exist :public
-      post :create, client_id: client.uid, response_type: 'token', scope: 'invalid', redirect_uri: client.redirect_uri
+      post :create, params: { client_id: client.uid, response_type: 'token', scope: 'invalid', redirect_uri: client.redirect_uri }
     end
 
     it 'redirects after authorization' do
@@ -81,7 +122,7 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
     end
 
     it 'redirects to client redirect uri' do
-      expect(response.location).to match(%r{^#{client.redirect_uri}})
+      expect(response.location).to match(/^#{client.redirect_uri}/)
     end
 
     it 'does not include access token in fragment' do
@@ -101,12 +142,47 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
     end
   end
 
+  describe 'POST #create in API mode with errors' do
+    before do
+      allow(Doorkeeper.configuration).to receive(:api_only).and_return(true)
+      default_scopes_exist :public
+      post :create, params: { client_id: client.uid, response_type: 'token', scope: 'invalid', redirect_uri: client.redirect_uri }
+    end
+
+    let(:response_json_body) { JSON.parse(response.body) }
+    let(:redirect_uri) { response_json_body['redirect_uri'] }
+
+    it 'renders 400 error' do
+      expect(response.status).to eq 401
+    end
+
+    it 'includes correct redirect URI' do
+      expect(redirect_uri).to match(/^#{client.redirect_uri}/)
+    end
+
+    it 'does not include access token in fragment' do
+      expect(redirect_uri.match(/access_token=([a-f0-9]+)&?/)).to be_nil
+    end
+
+    it 'includes error in redirect uri' do
+      expect(redirect_uri.match(/error=([a-z_]+)&?/)[1]).to eq 'invalid_scope'
+    end
+
+    it 'includes error description in redirect uri' do
+      expect(redirect_uri.match(/error_description=(.+)&?/)[1]).to_not be_nil
+    end
+
+    it 'does not issue any access token' do
+      expect(Doorkeeper::AccessToken.all).to be_empty
+    end
+  end
+
   describe 'POST #create with application already authorized' do
     before do
       allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
 
       access_token.save!
-      post :create, client_id: client.uid, response_type: 'token', redirect_uri: client.redirect_uri
+      post :create, params: { client_id: client.uid, response_type: 'token', redirect_uri: client.redirect_uri }
     end
 
     it 'returns the existing access token in a fragment' do
@@ -118,13 +194,47 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
     end
   end
 
+  describe 'POST #create with callbacks' do
+    after do
+      client.update_attribute :redirect_uri, 'urn:ietf:wg:oauth:2.0:oob'
+    end
+
+    describe 'when successful' do
+      after do
+        post :create, params: { client_id: client.uid, response_type: 'token', redirect_uri: client.redirect_uri }
+      end
+
+      it 'should call :before_successful_authorization callback' do
+        expect(Doorkeeper.configuration).to receive_message_chain(:before_successful_authorization, :call).with(instance_of(described_class))
+      end
+
+      it 'should call :after_successful_authorization callback' do
+        expect(Doorkeeper.configuration).to receive_message_chain(:after_successful_authorization, :call).with(instance_of(described_class))
+      end
+    end
+
+    describe 'with errors' do
+      after do
+        post :create, params: { client_id: client.uid, response_type: 'token', redirect_uri: 'bad_uri' }
+      end
+
+      it 'should not call :before_successful_authorization callback' do
+        expect(Doorkeeper.configuration).not_to receive(:before_successful_authorization)
+      end
+
+      it 'should not call :after_successful_authorization callback' do
+        expect(Doorkeeper.configuration).not_to receive(:after_successful_authorization)
+      end
+    end
+  end
+
   describe 'GET #new token request with native url and skip_authorization true' do
     before do
       allow(Doorkeeper.configuration).to receive(:skip_authorization).and_return(proc do
         true
       end)
       client.update_attribute :redirect_uri, 'urn:ietf:wg:oauth:2.0:oob'
-      get :new, client_id: client.uid, response_type: 'token', redirect_uri: client.redirect_uri
+      get :new, params: { client_id: client.uid, response_type: 'token', redirect_uri: client.redirect_uri }
     end
 
     it 'should redirect immediately' do
@@ -143,13 +253,12 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
 
   describe 'GET #new code request with native url and skip_authorization true' do
     before do
-      allow(Doorkeeper.configuration).to receive(:grant_flows).
-        and_return(%w[authorization_code])
+      allow(Doorkeeper.configuration).to receive(:grant_flows).and_return(%w[authorization_code])
       allow(Doorkeeper.configuration).to receive(:skip_authorization).and_return(proc do
         true
       end)
       client.update_attribute :redirect_uri, 'urn:ietf:wg:oauth:2.0:oob'
-      get :new, client_id: client.uid, response_type: 'code', redirect_uri: client.redirect_uri
+      get :new, params: { client_id: client.uid, response_type: 'code', redirect_uri: client.redirect_uri }
     end
 
     it 'should redirect immediately' do
@@ -171,7 +280,7 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
       allow(Doorkeeper.configuration).to receive(:skip_authorization).and_return(proc do
         true
       end)
-      get :new, client_id: client.uid, response_type: 'token', redirect_uri: client.redirect_uri
+      get :new, params: { client_id: client.uid, response_type: 'token', redirect_uri: client.redirect_uri }
     end
 
     it 'should redirect immediately' do
@@ -188,7 +297,7 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
     end
 
     it 'includes token expiration in fragment' do
-      expect(response.query_params['expires_in'].to_i).to eq(2.hours.to_i)
+      expect(response.query_params['expires_in'].to_i).to eq(1234)
     end
 
     it 'issues the token for the current client' do
@@ -200,10 +309,72 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
     end
   end
 
+  describe 'GET #new in API mode' do
+    before do
+      allow(Doorkeeper.configuration).to receive(:api_only).and_return(true)
+      get :new, params: { client_id: client.uid, response_type: 'token', redirect_uri: client.redirect_uri }
+    end
+
+    it 'should render success' do
+      expect(response).to be_successful
+    end
+
+    it "sets status to pre-authorization" do
+      expect(json_response["status"]).to eq(I18n.t('doorkeeper.pre_authorization.status'))
+    end
+
+    it "sets correct values" do
+      expect(json_response['client_id']).to eq(client.uid)
+      expect(json_response['redirect_uri']).to eq(client.redirect_uri)
+      expect(json_response['state']).to be_nil
+      expect(json_response['response_type']).to eq('token')
+      expect(json_response['scope']).to eq('')
+    end
+  end
+
+  describe 'GET #new in API mode with skip_authorization true' do
+    before do
+      allow(Doorkeeper.configuration).to receive(:skip_authorization).and_return(proc { true })
+      allow(Doorkeeper.configuration).to receive(:api_only).and_return(true)
+
+      get :new, params: { client_id: client.uid, response_type: 'token', redirect_uri: client.redirect_uri }
+    end
+
+    it 'should render success' do
+      expect(response).to be_successful
+    end
+
+    it 'should issue a token' do
+      expect(Doorkeeper::AccessToken.count).to be 1
+    end
+
+    it "sets status to redirect" do
+      expect(JSON.parse(response.body)["status"]).to eq("redirect")
+    end
+
+    it "sets redirect_uri to correct value" do
+      redirect_uri = JSON.parse(response.body)["redirect_uri"]
+      expect(redirect_uri).to_not be_nil
+      expect(redirect_uri.match(/token_type=(\w+)&?/)[1]).to eq "bearer"
+      expect(redirect_uri.match(/expires_in=(\d+)&?/)[1].to_i).to eq 1234
+      expect(
+        redirect_uri.match(/access_token=([a-f0-9]+)&?/)[1]
+      ).to eq Doorkeeper::AccessToken.first.token
+    end
+
+    it "issues the token for the current client" do
+      expect(Doorkeeper::AccessToken.first.application_id).to eq(client.id)
+    end
+
+    it "issues the token for the current resource owner" do
+      expect(Doorkeeper::AccessToken.first.resource_owner_id).to eq(user.id)
+    end
+  end
+
   describe 'GET #new with errors' do
     before do
       default_scopes_exist :public
-      get :new, an_invalid: 'request'
+      get :new, params: { an_invalid: 'request' }
     end
 
     it 'does not redirect' do
@@ -215,4 +386,68 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
       expect(Doorkeeper::AccessToken.count).to eq 0
     end
   end
+
+  describe 'GET #new with callbacks' do
+    after do
+      client.update_attribute :redirect_uri, 'urn:ietf:wg:oauth:2.0:oob'
+      get :new, params: { client_id: client.uid, response_type: 'token', redirect_uri: client.redirect_uri }
+    end
+
+    describe 'when authorizing' do
+      before do
+        allow(Doorkeeper.configuration).to receive(:skip_authorization).and_return(proc { true })
+      end
+
+      it 'should call :before_successful_authorization callback' do
+        expect(Doorkeeper.configuration).to receive_message_chain(:before_successful_authorization, :call).with(instance_of(described_class))
+      end
+
+      it 'should call :after_successful_authorization callback' do
+        expect(Doorkeeper.configuration).to receive_message_chain(:after_successful_authorization, :call).with(instance_of(described_class))
+      end
+    end
+
+    describe 'when not authorizing' do
+      before do
+        allow(Doorkeeper.configuration).to receive(:skip_authorization).and_return(proc { false })
+      end
+
+      it 'should not call :before_successful_authorization callback' do
+        expect(Doorkeeper.configuration).not_to receive(:before_successful_authorization)
+      end
+
+      it 'should not call :after_successful_authorization callback' do
+        expect(Doorkeeper.configuration).not_to receive(:after_successful_authorization)
+      end
+    end
+
+    describe 'when not authorizing in api mode' do
+      before do
+        allow(Doorkeeper.configuration).to receive(:skip_authorization).and_return(proc { false })
+        allow(Doorkeeper.configuration).to receive(:api_only).and_return(true)
+      end
+
+      it 'should not call :before_successful_authorization callback' do
+        expect(Doorkeeper.configuration).not_to receive(:before_successful_authorization)
+      end
+
+      it 'should not call :after_successful_authorization callback' do
+        expect(Doorkeeper.configuration).not_to receive(:after_successful_authorization)
+      end
+    end
+  end
+
+  describe 'authorize response memoization' do
+    it 'memoizes the result of the authorization' do
+      strategy = double(:strategy, authorize: true)
+      expect(strategy).to receive(:authorize).once
+      allow(controller).to receive(:strategy) { strategy }
+      allow(controller).to receive(:create) do
+        2.times { controller.send :authorize_response }
+        controller.render json: {}, status: :ok
+      end
+
+      post :create
+    end
+  end
 end

data/spec/controllers/protected_resources_controller_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module ControllerActions
   def index
@@ -33,12 +33,12 @@ describe 'doorkeeper authorize filter' do
 
     it 'access_token param' do
       expect(Doorkeeper::AccessToken).to receive(:by_token).with(token_string).and_return(token)
-      get :index, access_token: token_string
+      get :index, params: { access_token: token_string }
     end
 
     it 'bearer_token param' do
       expect(Doorkeeper::AccessToken).to receive(:by_token).with(token_string).and_return(token)
-      get :index, bearer_token: token_string
+      get :index, params: { bearer_token: token_string }
     end
 
     it 'Authorization header' do
@@ -57,7 +57,7 @@ describe 'doorkeeper authorize filter' do
       expect(Doorkeeper::AccessToken).to receive(:by_token).exactly(2).times.and_return(token)
       request.env['HTTP_AUTHORIZATION'] = "Bearer #{token_string}"
       get :index
-      controller.send(:remove_instance_variable, :@_doorkeeper_token)
+      controller.send(:remove_instance_variable, :@doorkeeper_token)
       get :index
     end
   end
@@ -71,25 +71,25 @@ describe 'doorkeeper authorize filter' do
 
     context 'with valid token', token: :valid do
       it 'allows into index action' do
-        get :index, access_token: token_string
+        get :index, params: { access_token: token_string }
         expect(response).to be_successful
       end
 
       it 'allows into show action' do
-        get :show, id: '4', access_token: token_string
+        get :show, params: { id: '4', access_token: token_string }
         expect(response).to be_successful
       end
     end
 
     context 'with invalid token', token: :invalid do
       it 'does not allow into index action' do
-        get :index, access_token: token_string
+        get :index, params: { access_token: token_string }
         expect(response.status).to eq 401
         expect(response.header['WWW-Authenticate']).to match(/^Bearer/)
       end
 
       it 'does not allow into show action' do
-        get :show, id: '4', access_token: token_string
+        get :show, params: { id: '4', access_token: token_string }
         expect(response.status).to eq 401
         expect(response.header['WWW-Authenticate']).to match(/^Bearer/)
       end
@@ -115,7 +115,7 @@ describe 'doorkeeper authorize filter' do
         Doorkeeper::AccessToken
       ).to receive(:by_token).with(token_string).and_return(token)
 
-      get :index, access_token: token_string
+      get :index, params: { access_token: token_string }
       expect(response).to be_successful
     end
 
@@ -129,7 +129,7 @@ describe 'doorkeeper authorize filter' do
       ).to receive(:by_token).with(token_string).and_return(token)
       expect(token).to receive(:acceptable?).with([:write]).and_return(false)
 
-      get :index, access_token: token_string
+      get :index, params: { access_token: token_string }
       expect(response.status).to eq 403
       expect(response.header).to_not include('WWW-Authenticate')
     end
@@ -163,7 +163,7 @@ describe 'doorkeeper authorize filter' do
       end
 
       it 'it renders a custom JSON response', token: :invalid do
-        get :index, access_token: token_string
+        get :index, params: { access_token: token_string }
         expect(response.status).to eq 401
         expect(response.content_type).to eq('application/json')
         expect(response.header['WWW-Authenticate']).to match(/^Bearer/)
@@ -193,7 +193,7 @@ describe 'doorkeeper authorize filter' do
       end
 
       it 'it renders a custom text response', token: :invalid do
-        get :index, access_token: token_string
+        get :index, params: { access_token: token_string }
         expect(response.status).to eq 401
         expect(response.content_type).to eq('text/plain')
         expect(response.header['WWW-Authenticate']).to match(/^Bearer/)
@@ -243,7 +243,7 @@ describe 'doorkeeper authorize filter' do
       end
 
       it 'renders a custom JSON response' do
-        get :index, access_token: token_string
+        get :index, params: { access_token: token_string }
         expect(response.header).to_not include('WWW-Authenticate')
         expect(response.content_type).to eq('application/json')
         expect(response.status).to eq 403
@@ -265,7 +265,7 @@ describe 'doorkeeper authorize filter' do
       end
 
       it 'overrides the default status code' do
-        get :index, access_token: token_string
+        get :index, params: { access_token: token_string }
         expect(response.status).to eq 404
       end
     end
@@ -282,7 +282,7 @@ describe 'doorkeeper authorize filter' do
       end
 
       it 'renders a custom status code and text response' do
-        get :index, access_token: token_string
+        get :index, params: { access_token: token_string }
         expect(response.header).to_not include('WWW-Authenticate')
         expect(response.status).to eq 403
         expect(response.body).to eq('Forbidden')
@@ -301,7 +301,7 @@ describe 'doorkeeper authorize filter' do
       end
 
       it 'overrides the default status code' do
-        get :index, access_token: token_string
+        get :index, params: { access_token: token_string }
         expect(response.status).to eq 404
       end
     end

data/spec/controllers/token_info_controller_spec.rb

@@ -1,32 +1,24 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe Doorkeeper::TokenInfoController do
   describe 'when requesting token info with valid token' do
     let(:doorkeeper_token) { FactoryBot.create(:access_token) }
 
-    before(:each) do
-      allow(controller).to receive(:doorkeeper_token) { doorkeeper_token }
-    end
-
     describe 'successful request' do
-      it 'responds with tokeninfo' do
-        get :show
+      it 'responds with token info' do
+        get :show, params: { access_token: doorkeeper_token.token }
 
         expect(response.body).to eq(doorkeeper_token.to_json)
       end
 
       it 'responds with a 200 status' do
-        get :show
+        get :show, params: { access_token: doorkeeper_token.token }
 
         expect(response.status).to eq 200
       end
     end
 
     describe 'invalid token response' do
-      before(:each) do
-        allow(controller).to receive(:doorkeeper_token).and_return(nil)
-      end
-
       it 'responds with 401 when doorkeeper_token is not valid' do
         get :show
 

data/spec/controllers/tokens_controller_spec.rb

@@ -1,12 +1,9 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe Doorkeeper::TokensController do
   describe 'when authorization has succeeded' do
     let(:token) { double(:token, authorize: true) }
 
-    before do
-      allow(controller).to receive(:token) { token }
-    end
 
     it 'returns the authorization' do
       skip 'verify need of these specs'
@@ -77,7 +74,8 @@ describe Doorkeeper::TokensController do
       expect(strategy).to receive(:authorize).once
       allow(controller).to receive(:strategy) { strategy }
       allow(controller).to receive(:create) do
-        controller.send :authorize_response
+        2.times { controller.send :authorize_response }
+        controller.render json: {}, status: :ok
       end
 
       post :create
@@ -92,7 +90,7 @@ describe Doorkeeper::TokensController do
       it 'responds with full token introspection' do
         request.headers['Authorization'] = "Bearer #{access_token.token}"
 
-        post :introspect, token: access_token.token
+        post :introspect, params: { token: access_token.token }
 
         should_have_json 'active', true
         expect(json_response).to include('client_id', 'token_type', 'exp', 'iat')
@@ -106,7 +104,7 @@ describe Doorkeeper::TokensController do
       it 'responds with full token introspection' do
         request.headers['Authorization'] = basic_auth_header_for_client(client)
 
-        post :introspect, token: access_token.token
+        post :introspect, params: { token: access_token.token }
 
         should_have_json 'active', true
         expect(json_response).to include('client_id', 'token_type', 'exp', 'iat')
@@ -121,7 +119,7 @@ describe Doorkeeper::TokensController do
       it 'responds with full token introspection' do
         request.headers['Authorization'] = basic_auth_header_for_client(client)
 
-        post :introspect, token: access_token.token
+        post :introspect, params: { token: access_token.token }
 
         should_have_json 'active', true
         expect(json_response).to include('client_id', 'token_type', 'exp', 'iat')
@@ -137,7 +135,7 @@ describe Doorkeeper::TokensController do
       it 'responds with only active state' do
         request.headers['Authorization'] = basic_auth_header_for_client(different_client)
 
-        post :introspect, token: access_token.token
+        post :introspect, params: { token: access_token.token }
 
         expect(response).to be_successful
 
@@ -153,7 +151,7 @@ describe Doorkeeper::TokensController do
       it 'responds with invalid_client error' do
         request.headers['Authorization'] = basic_auth_header_for_client(client)
 
-        post :introspect, token: access_token.token
+        post :introspect, params: { token: access_token.token }
 
         expect(response).not_to be_successful
         response_status_should_be 401
@@ -170,7 +168,7 @@ describe Doorkeeper::TokensController do
       it 'responds with only active state' do
         request.headers['Authorization'] = basic_auth_header_for_client(client)
 
-        post :introspect, token: SecureRandom.hex(16)
+        post :introspect, params: { token: SecureRandom.hex(16) }
 
         should_have_json 'active', false
         expect(json_response).not_to include('client_id', 'token_type', 'exp', 'iat')
@@ -184,7 +182,7 @@ describe Doorkeeper::TokensController do
       it 'responds with only active state' do
         request.headers['Authorization'] = basic_auth_header_for_client(client)
 
-        post :introspect, token: access_token.token
+        post :introspect, params: { token: access_token.token }
 
         should_have_json 'active', false
         expect(json_response).not_to include('client_id', 'token_type', 'exp', 'iat')
@@ -198,7 +196,7 @@ describe Doorkeeper::TokensController do
       it 'responds with only active state' do
         request.headers['Authorization'] = basic_auth_header_for_client(client)
 
-        post :introspect, token: access_token.token
+        post :introspect, params: { token: access_token.token }
 
         should_have_json 'active', false
         expect(json_response).not_to include('client_id', 'token_type', 'exp', 'iat')
@@ -209,7 +207,7 @@ describe Doorkeeper::TokensController do
       let(:access_token) { FactoryBot.create(:access_token) }
 
       it 'responds with invalid_request error' do
-        post :introspect, token: access_token.token
+        post :introspect, params: { token: access_token.token }
 
         expect(response).not_to be_successful
         response_status_should_be 401

data/spec/dummy/app/assets/config/manifest.js

@@ -0,0 +1,2 @@
+// JS and CSS bundles
+//

data/spec/dummy/config/environments/test.rb

@@ -7,6 +7,10 @@ Dummy::Application.configure do
   # and recreated between test runs.  Don't rely on the data there!
   config.cache_classes = true
 
+  config.assets.enabled = true
+  config.assets.version = '1.0'
+  config.assets.digest = false
+
   # Do not eager load code on boot. This avoids loading your whole application
   # just for the purpose of running a single test. If you are using a tool that
   # preloads Rails for running tests, you may have to set it to true.
@@ -36,9 +40,4 @@ Dummy::Application.configure do
   config.active_support.deprecation = :stderr
 
   config.eager_load = true
-
-  if DOORKEEPER_ORM == :active_record
-    config.active_record.table_name_prefix = TABLE_NAME_PREFIX.to_s
-    config.active_record.table_name_suffix = TABLE_NAME_SUFFIX.to_s
-  end
 end

data/spec/dummy/config/initializers/doorkeeper.rb

@@ -29,6 +29,12 @@ Doorkeeper.configure do
   # Issue access tokens with refresh token (disabled by default)
   use_refresh_token
 
+  # Forbids creating/updating applications with arbitrary scopes that are
+  # not in configuration, i.e. `default_scopes` or `optional_scopes`.
+  # (disabled by default)
+  #
+  # enforce_configured_scopes
+
   # Provide support for an owner to be assigned to each registered application (disabled by default)
   # Optional parameter confirmation: true (default false) if you want to enforce ownership of
   # a registered application