doorkeeper 4.4.0 → 5.6.6

data/spec/lib/oauth/refresh_token_request_spec.rb

@@ -1,166 +0,0 @@
-require 'spec_helper_integration'
-
-module Doorkeeper::OAuth
-  describe RefreshTokenRequest do
-    before do
-      allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(false)
-    end
-
-    let(:server) do
-      double :server,
-             access_token_expires_in: 2.minutes,
-             custom_access_token_expires_in: -> (_oauth_client) { nil }
-    end
-
-    let(:refresh_token) do
-      FactoryBot.create(:access_token, use_refresh_token: true)
-    end
-
-    let(:client) { refresh_token.application }
-    let(:credentials) { Client::Credentials.new(client.uid, client.secret) }
-
-    subject { RefreshTokenRequest.new server, refresh_token, credentials }
-
-    it 'issues a new token for the client' do
-      expect { subject.authorize }.to change { client.reload.access_tokens.count }.by(1)
-      # #sort_by used for MongoDB ORM extensions for valid ordering
-      expect(client.reload.access_tokens.sort_by(&:created_at).last.expires_in).to eq(120)
-    end
-
-    it 'issues a new token for the client with custom expires_in' do
-      server = double :server,
-                      access_token_expires_in: 2.minutes,
-                      custom_access_token_expires_in: ->(_oauth_client) { 1234 }
-
-      allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(false)
-
-      RefreshTokenRequest.new(server, refresh_token, credentials).authorize
-
-      # #sort_by used for MongoDB ORM extensions for valid ordering
-      expect(client.reload.access_tokens.sort_by(&:created_at).last.expires_in).to eq(1234)
-    end
-
-    it 'revokes the previous token' do
-      expect { subject.authorize }.to change { refresh_token.revoked? }.from(false).to(true)
-    end
-
-    it "calls configured request callback methods" do
-      expect(Doorkeeper.configuration.before_successful_strategy_response).to receive(:call).with(subject).once
-      expect(Doorkeeper.configuration.after_successful_strategy_response).to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
-      subject.authorize
-    end
-
-    it 'requires the refresh token' do
-      subject.refresh_token = nil
-      subject.validate
-      expect(subject.error).to eq(:invalid_request)
-    end
-
-    it 'requires credentials to be valid if provided' do
-      subject.client = nil
-      subject.validate
-      expect(subject.error).to eq(:invalid_client)
-    end
-
-    it "requires the token's client and current client to match" do
-      subject.client = FactoryBot.create(:application)
-      subject.validate
-      expect(subject.error).to eq(:invalid_grant)
-    end
-
-    it 'rejects revoked tokens' do
-      refresh_token.revoke
-      subject.validate
-      expect(subject.error).to eq(:invalid_grant)
-    end
-
-    it 'accepts expired tokens' do
-      refresh_token.expires_in = -1
-      refresh_token.save
-      subject.validate
-      expect(subject).to be_valid
-    end
-
-    context 'refresh tokens expire on access token use' do
-      let(:server) do
-        double :server,
-               access_token_expires_in: 2.minutes,
-               custom_access_token_expires_in: ->(_oauth_client) { 1234 }
-      end
-
-      before do
-        allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(true)
-      end
-
-      it 'issues a new token for the client' do
-        expect { subject.authorize }.to change { client.reload.access_tokens.count }.by(1)
-      end
-
-      it 'does not revoke the previous token' do
-        subject.authorize
-        expect(refresh_token).not_to be_revoked
-      end
-
-      it 'sets the previous refresh token in the new access token' do
-        subject.authorize
-        expect(
-          # #sort_by used for MongoDB ORM extensions for valid ordering
-          client.access_tokens.sort_by(&:created_at).last.previous_refresh_token
-        ).to eq(refresh_token.refresh_token)
-      end
-    end
-
-    context 'clientless access tokens' do
-      let!(:refresh_token) { FactoryBot.create(:clientless_access_token, use_refresh_token: true) }
-
-      subject { RefreshTokenRequest.new server, refresh_token, nil }
-
-      it 'issues a new token without a client' do
-        expect { subject.authorize }.to change { Doorkeeper::AccessToken.count }.by(1)
-      end
-    end
-
-    context 'with scopes' do
-      let(:refresh_token) do
-        FactoryBot.create :access_token,
-                           use_refresh_token: true,
-                           scopes: 'public write'
-      end
-      let(:parameters) { {} }
-      subject { RefreshTokenRequest.new server, refresh_token, credentials, parameters }
-
-      it 'transfers scopes from the old token to the new token' do
-        subject.authorize
-        expect(Doorkeeper::AccessToken.last.scopes).to eq([:public, :write])
-      end
-
-      it 'reduces scopes to the provided scopes' do
-        parameters[:scopes] = 'public'
-        subject.authorize
-        expect(Doorkeeper::AccessToken.last.scopes).to eq([:public])
-      end
-
-      it 'validates that scopes are included in the original access token' do
-        parameters[:scopes] = 'public update'
-
-        subject.validate
-        expect(subject.error).to eq(:invalid_scope)
-      end
-
-      it 'uses params[:scope] in favor of scopes if present (valid)' do
-        parameters[:scopes] = 'public update'
-        parameters[:scope] = 'public'
-        subject.authorize
-        expect(Doorkeeper::AccessToken.last.scopes).to eq([:public])
-      end
-
-      it 'uses params[:scope] in favor of scopes if present (invalid)' do
-        parameters[:scopes] = 'public'
-        parameters[:scope] = 'public update'
-
-        subject.validate
-        expect(subject.error).to eq(:invalid_scope)
-      end
-    end
-  end
-end

data/spec/lib/oauth/scopes_spec.rb

@@ -1,149 +0,0 @@
-require 'spec_helper'
-require 'active_support/core_ext/module/delegation'
-require 'active_support/core_ext/string'
-require 'doorkeeper/oauth/scopes'
-
-module Doorkeeper::OAuth
-  describe Scopes do
-    describe '#add' do
-      it 'allows you to add scopes with symbols' do
-        subject.add :public
-        expect(subject.all).to eq(['public'])
-      end
-
-      it 'allows you to add scopes with strings' do
-        subject.add 'public'
-        expect(subject.all).to eq(['public'])
-      end
-
-      it 'do not add already included scopes' do
-        subject.add :public
-        subject.add :public
-        expect(subject.all).to eq(['public'])
-      end
-    end
-
-    describe '#exists' do
-      before do
-        subject.add :public
-      end
-
-      it 'returns true if scope with given name is present' do
-        expect(subject.exists?('public')).to be_truthy
-      end
-
-      it 'returns false if scope with given name does not exist' do
-        expect(subject.exists?('other')).to be_falsey
-      end
-
-      it 'handles symbols' do
-        expect(subject.exists?(:public)).to be_truthy
-        expect(subject.exists?(:other)).to be_falsey
-      end
-    end
-
-    describe '.from_string' do
-      let(:string) { 'public write' }
-
-      subject { Scopes.from_string(string) }
-
-      it { expect(subject).to be_a(Scopes) }
-
-      describe '#all' do
-        it 'should be an array of the expected scopes' do
-          scopes_array = subject.all
-          expect(scopes_array.size).to eq(2)
-          expect(scopes_array).to include('public')
-          expect(scopes_array).to include('write')
-        end
-      end
-    end
-
-    describe '#+' do
-      it 'can add to another scope object' do
-        scopes = Scopes.from_string('public') + Scopes.from_string('admin')
-        expect(scopes.all).to eq(%w[public admin])
-      end
-
-      it 'does not change the existing object' do
-        origin = Scopes.from_string('public')
-        expect(origin.to_s).to eq('public')
-      end
-
-      it 'can add an array to a scope object' do
-        scopes = Scopes.from_string('public') + ['admin']
-        expect(scopes.all).to eq(%w[public admin])
-      end
-
-      it 'raises an error if cannot handle addition' do
-        expect do
-          Scopes.from_string('public') + 'admin'
-        end.to raise_error(NoMethodError)
-      end
-    end
-
-    describe '#&' do
-      it 'can get intersection with another scope object' do
-        scopes = Scopes.from_string('public admin') & Scopes.from_string('write admin')
-        expect(scopes.all).to eq(%w[admin])
-      end
-
-      it 'does not change the existing object' do
-        origin = Scopes.from_string('public admin')
-        origin & Scopes.from_string('write admin')
-        expect(origin.to_s).to eq('public admin')
-      end
-
-      it 'can get intersection with an array' do
-        scopes = Scopes.from_string('public admin') & %w[write admin]
-        expect(scopes.all).to eq(%w[admin])
-      end
-    end
-
-    describe '#==' do
-      it 'is equal to another set of scopes' do
-        expect(Scopes.from_string('public')).to eq(Scopes.from_string('public'))
-      end
-
-      it 'is equal to another set of scopes with no particular order' do
-        expect(Scopes.from_string('public write')).to eq(Scopes.from_string('write public'))
-      end
-
-      it 'differs from another set of scopes when scopes are not the same' do
-        expect(Scopes.from_string('public write')).not_to eq(Scopes.from_string('write'))
-      end
-
-      it "does not raise an error when compared to a non-enumerable object" do
-        expect { Scopes.from_string("public") == false }.not_to raise_error
-      end
-    end
-
-    describe '#has_scopes?' do
-      subject { Scopes.from_string('public admin') }
-
-      it 'returns true when at least one scope is included' do
-        expect(subject.has_scopes?(Scopes.from_string('public'))).to be_truthy
-      end
-
-      it 'returns true when all scopes are included' do
-        expect(subject.has_scopes?(Scopes.from_string('public admin'))).to be_truthy
-      end
-
-      it 'is true if all scopes are included in any order' do
-        expect(subject.has_scopes?(Scopes.from_string('admin public'))).to be_truthy
-      end
-
-      it 'is false if no scopes are included' do
-        expect(subject.has_scopes?(Scopes.from_string('notexistent'))).to be_falsey
-      end
-
-      it 'returns false when any scope is not included' do
-        expect(subject.has_scopes?(Scopes.from_string('public nope'))).to be_falsey
-      end
-
-      it 'is false if no scopes are included even for existing ones' do
-        expect(subject.has_scopes?(Scopes.from_string('public admin notexistent'))).to be_falsey
-      end
-    end
-  end
-end

data/spec/lib/oauth/token_request_spec.rb

@@ -1,96 +0,0 @@
-require 'spec_helper_integration'
-
-module Doorkeeper::OAuth
-  describe TokenRequest do
-    let :application do
-      scopes = double(all: ['public'])
-      double(:application, id: 9990, scopes: scopes)
-    end
-
-    let :pre_auth do
-      double(
-        :pre_auth,
-        client: application,
-        redirect_uri: 'http://tst.com/cb',
-        state: nil,
-        scopes: Scopes.from_string('public'),
-        error: nil,
-        authorizable?: true
-      )
-    end
-
-    let :owner do
-      double :owner, id: 7866
-    end
-
-    subject do
-      TokenRequest.new(pre_auth, owner)
-    end
-
-    it 'creates an access token' do
-      expect do
-        subject.authorize
-      end.to change { Doorkeeper::AccessToken.count }.by(1)
-    end
-
-    it 'returns a code response' do
-      expect(subject.authorize).to be_a(CodeResponse)
-    end
-
-    it 'does not create token when not authorizable' do
-      allow(pre_auth).to receive(:authorizable?).and_return(false)
-      expect { subject.authorize }.not_to change { Doorkeeper::AccessToken.count }
-    end
-
-    it 'returns a error response' do
-      allow(pre_auth).to receive(:authorizable?).and_return(false)
-      expect(subject.authorize).to be_a(ErrorResponse)
-    end
-
-    context 'with custom expirations' do
-      before do
-        Doorkeeper.configure do
-          orm DOORKEEPER_ORM
-          custom_access_token_expires_in do |_oauth_client|
-            1234
-          end
-        end
-      end
-
-      it 'should use the custom ttl' do
-        subject.authorize
-        token = Doorkeeper::AccessToken.first
-        expect(token.expires_in).to eq(1234)
-      end
-    end
-
-    context 'token reuse' do
-      it 'creates a new token if there are no matching tokens' do
-        allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-        expect do
-          subject.authorize
-        end.to change { Doorkeeper::AccessToken.count }.by(1)
-      end
-
-      it 'creates a new token if scopes do not match' do
-        allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-        FactoryBot.create(:access_token, application_id: pre_auth.client.id,
-                           resource_owner_id: owner.id, scopes: '')
-        expect do
-          subject.authorize
-        end.to change { Doorkeeper::AccessToken.count }.by(1)
-      end
-
-      it 'skips token creation if there is a matching one' do
-        allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-        allow(application.scopes).to receive(:has_scopes?).and_return(true)
-        allow(application.scopes).to receive(:all?).and_return(true)
-
-        FactoryBot.create(:access_token, application_id: pre_auth.client.id,
-                           resource_owner_id: owner.id, scopes: 'public')
-
-        expect { subject.authorize }.not_to change { Doorkeeper::AccessToken.count }
-      end
-    end
-  end
-end

data/spec/lib/oauth/token_response_spec.rb

@@ -1,85 +0,0 @@
-require 'spec_helper'
-require 'doorkeeper/oauth/token_response'
-
-module Doorkeeper::OAuth
-  describe TokenResponse do
-    subject { TokenResponse.new(double.as_null_object) }
-
-    it 'includes access token response headers' do
-      headers = subject.headers
-      expect(headers.fetch('Cache-Control')).to eq('no-store')
-      expect(headers.fetch('Pragma')).to eq('no-cache')
-    end
-
-    it 'status is ok' do
-      expect(subject.status).to eq(:ok)
-    end
-
-    describe '.body' do
-      let(:access_token) do
-        double :access_token,
-               token:              'some-token',
-               expires_in:         '3600',
-               expires_in_seconds: '300',
-               scopes_string:      'two scopes',
-               refresh_token:      'some-refresh-token',
-               token_type:         'bearer',
-               created_at:         0
-      end
-
-      subject { TokenResponse.new(access_token).body }
-
-      it 'includes :access_token' do
-        expect(subject['access_token']).to eq('some-token')
-      end
-
-      it 'includes :token_type' do
-        expect(subject['token_type']).to eq('bearer')
-      end
-
-      # expires_in_seconds is returned as `expires_in` in order to match
-      # the OAuth spec (section 4.2.2)
-      it 'includes :expires_in' do
-        expect(subject['expires_in']).to eq('300')
-      end
-
-      it 'includes :scope' do
-        expect(subject['scope']).to eq('two scopes')
-      end
-
-      it 'includes :refresh_token' do
-        expect(subject['refresh_token']).to eq('some-refresh-token')
-      end
-
-      it 'includes :created_at' do
-        expect(subject['created_at']).to eq(0)
-      end
-    end
-
-    describe '.body filters out empty values' do
-      let(:access_token) do
-        double :access_token,
-               token:              'some-token',
-               expires_in_seconds: '',
-               scopes_string:      '',
-               refresh_token:      '',
-               token_type:         'bearer',
-               created_at:         0
-      end
-
-      subject { TokenResponse.new(access_token).body }
-
-      it 'includes :expires_in' do
-        expect(subject['expires_in']).to be_nil
-      end
-
-      it 'includes :scope' do
-        expect(subject['scope']).to be_nil
-      end
-
-      it 'includes :refresh_token' do
-        expect(subject['refresh_token']).to be_nil
-      end
-    end
-  end
-end

data/spec/lib/oauth/token_spec.rb

@@ -1,116 +0,0 @@
-require 'spec_helper'
-require 'active_support/core_ext/string'
-require 'doorkeeper/oauth/token'
-
-module Doorkeeper
-  unless defined?(AccessToken)
-    class AccessToken
-    end
-  end
-
-  module OAuth
-    describe Token do
-      describe :from_request do
-        let(:request) { double.as_null_object }
-
-        let(:method) do
-          ->(request) { return 'token-value' }
-        end
-
-        it 'accepts anything that responds to #call' do
-          expect(method).to receive(:call).with(request)
-          Token.from_request request, method
-        end
-
-        it 'delegates methods received as symbols to Token class' do
-          expect(Token).to receive(:from_params).with(request)
-          Token.from_request request, :from_params
-        end
-
-        it 'stops at the first credentials found' do
-          not_called_method = double
-          expect(not_called_method).not_to receive(:call)
-          Token.from_request request, ->(_r) {}, method, not_called_method
-        end
-
-        it 'returns the credential from extractor method' do
-          credentials = Token.from_request request, method
-          expect(credentials).to eq('token-value')
-        end
-      end
-
-      describe :from_access_token_param do
-        it 'returns token from access_token parameter' do
-          request = double parameters: { access_token: 'some-token' }
-          token   = Token.from_access_token_param(request)
-          expect(token).to eq('some-token')
-        end
-      end
-
-      describe :from_bearer_param do
-        it 'returns token from bearer_token parameter' do
-          request = double parameters: { bearer_token: 'some-token' }
-          token   = Token.from_bearer_param(request)
-          expect(token).to eq('some-token')
-        end
-      end
-
-      describe :from_bearer_authorization do
-        it 'returns token from capitalized authorization bearer' do
-          request = double authorization: 'Bearer SomeToken'
-          token   = Token.from_bearer_authorization(request)
-          expect(token).to eq('SomeToken')
-        end
-
-        it 'returns token from lowercased authorization bearer' do
-          request = double authorization: 'bearer SomeToken'
-          token   = Token.from_bearer_authorization(request)
-          expect(token).to eq('SomeToken')
-        end
-
-        it 'does not return token if authorization is not bearer' do
-          request = double authorization: 'MAC SomeToken'
-          token   = Token.from_bearer_authorization(request)
-          expect(token).to be_blank
-        end
-      end
-
-      describe :from_basic_authorization do
-        it 'returns token from capitalized authorization basic' do
-          request = double authorization: "Basic #{Base64.encode64 'SomeToken:'}"
-          token   = Token.from_basic_authorization(request)
-          expect(token).to eq('SomeToken')
-        end
-
-        it 'returns token from lowercased authorization basic' do
-          request = double authorization: "basic #{Base64.encode64 'SomeToken:'}"
-          token   = Token.from_basic_authorization(request)
-          expect(token).to eq('SomeToken')
-        end
-
-        it 'does not return token if authorization is not basic' do
-          request = double authorization: "MAC #{Base64.encode64 'SomeToken:'}"
-          token   = Token.from_basic_authorization(request)
-          expect(token).to be_blank
-        end
-      end
-
-      describe :authenticate do
-        it 'calls the finder if token was returned' do
-          token = ->(_r) { 'token' }
-          expect(AccessToken).to receive(:by_token).with('token')
-          Token.authenticate double, token
-        end
-
-        it 'revokes previous refresh_token if token was found' do
-          token = ->(_r) { 'token' }
-          expect(
-            AccessToken
-          ).to receive(:by_token).with('token').and_return(token)
-          expect(token).to receive(:revoke_previous_refresh_token!)
-          Token.authenticate double, token
-        end
-      end
-    end
-  end
-end

data/spec/lib/request/strategy_spec.rb

@@ -1,53 +0,0 @@
-require 'spec_helper'
-require 'doorkeeper/request/strategy'
-
-module Doorkeeper
-  module Request
-    describe Strategy do
-      let(:server) { double }
-      subject(:strategy) { Strategy.new(server) }
-
-      describe :initialize do
-        it "sets the server attribute" do
-          expect(strategy.server).to eq server
-        end
-      end
-
-      describe :request do
-        it "requires an implementation" do
-          expect { strategy.request }.to raise_exception NotImplementedError
-        end
-      end
-
-      describe "a sample Strategy subclass" do
-        let(:fake_request) { double }
-
-        let(:strategy_class) do
-          subclass = Class.new(Strategy) do
-            class << self
-              attr_accessor :fake_request
-            end
-
-            def request
-              self.class.fake_request
-            end
-          end
-
-          subclass.fake_request = fake_request
-          subclass
-        end
-
-        subject(:strategy) { strategy_class.new(server) }
-
-        it "provides a request implementation" do
-          expect(strategy.request).to eq fake_request
-        end
-
-        it "authorizes the request" do
-          expect(fake_request).to receive :authorize
-          strategy.authorize
-        end
-      end
-    end
-  end
-end