doorkeeper 4.4.3 → 5.0.0

data/spec/models/doorkeeper/access_token_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module Doorkeeper
   describe AccessToken do
@@ -144,7 +144,7 @@ module Doorkeeper
         end
 
         module CustomGeneratorArgs
-          def self.generate(opts = {})
+          def self.generate(_opts = {})
             raise LoadError, 'custom behaviour'
           end
         end
@@ -218,7 +218,7 @@ module Doorkeeper
       context 'with default parameters' do
 
         let(:resource_owner_id) { 100 }
-        let(:application)    { FactoryBot.create :application }
+        let(:application) { FactoryBot.create :application }
         let(:default_attributes) do
           { application: application, resource_owner_id: resource_owner_id }
         end
@@ -306,15 +306,25 @@ module Doorkeeper
       end
 
       it 'matches application' do
-        FactoryBot.create :access_token, default_attributes.merge(application: FactoryBot.create(:application))
+        access_token_for_different_app = FactoryBot.create(
+          :access_token,
+          default_attributes.merge(application: FactoryBot.create(:application))
+        )
+
         AccessToken.revoke_all_for application.id, resource_owner
-        expect(AccessToken.all).not_to be_empty
+
+        expect(access_token_for_different_app.reload).not_to be_revoked
       end
 
       it 'matches resource owner' do
-        FactoryBot.create :access_token, default_attributes.merge(resource_owner_id: 90)
+        access_token_for_different_owner = FactoryBot.create(
+          :access_token,
+          default_attributes.merge(resource_owner_id: 90)
+        )
+
         AccessToken.revoke_all_for application.id, resource_owner
-        expect(AccessToken.all).not_to be_empty
+
+        expect(access_token_for_different_owner.reload).not_to be_revoked
       end
     end
 
@@ -330,6 +340,10 @@ module Doorkeeper
         }
       end
 
+      before do
+        default_scopes_exist(*scopes.all)
+      end
+
       it 'returns only one token' do
         token = FactoryBot.create :access_token, default_attributes
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
@@ -355,37 +369,45 @@ module Doorkeeper
         expect(last_token).to be_nil
       end
 
-      it 'matches the application' do
+      it "excludes tokens with a different application" do
         FactoryBot.create :access_token, default_attributes.merge(application: FactoryBot.create(:application))
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to be_nil
       end
 
-      it 'matches the resource owner' do
+      it "excludes tokens with a different resource owner" do
         FactoryBot.create :access_token, default_attributes.merge(resource_owner_id: 2)
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to be_nil
       end
 
-      it 'matches token with fewer scopes' do
+      it "excludes tokens with fewer scopes" do
         FactoryBot.create :access_token, default_attributes.merge(scopes: 'public')
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to be_nil
       end
 
-      it 'matches token with different scopes' do
+      it 'excludes tokens with different scopes' do
         FactoryBot.create :access_token, default_attributes.merge(scopes: 'public email')
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to be_nil
       end
 
-      it 'matches token with more scopes' do
+      it 'excludes tokens with additional scopes' do
         FactoryBot.create :access_token, default_attributes.merge(scopes: 'public write email')
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to be_nil
       end
 
-      it 'matches application scopes' do
+      it 'excludes tokens with scopes that are not present in server scopes' do
+        FactoryBot.create :access_token, default_attributes.merge(
+          application: application, scopes: 'public read'
+        )
+        last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
+        expect(last_token).to be_nil
+      end
+
+      it 'excludes tokens with scopes that are not present in application scopes' do
         application = FactoryBot.create :application, scopes: "private read"
         FactoryBot.create :access_token, default_attributes.merge(
           application: application
@@ -394,25 +416,47 @@ module Doorkeeper
         expect(last_token).to be_nil
       end
 
-      it 'returns the last created token' do
+      it 'does not match token if empty scope requested and token/app scopes present' do
+        application = FactoryBot.create :application, scopes: "sample:scope"
+        app_params = {
+          application_id: application.id, scopes: "sample:scope",
+          resource_owner_id: 100
+        }
+        FactoryBot.create :access_token, app_params
+        empty_scopes = Doorkeeper::OAuth::Scopes.from_string("")
+        last_token = AccessToken.matching_token_for(application, 100, empty_scopes)
+        expect(last_token).to be_nil
+      end
+
+      it 'matches token if empty scope requested and no token scopes present' do
+        empty_scopes = Doorkeeper::OAuth::Scopes.from_string("")
+        token = FactoryBot.create :access_token, default_attributes.merge(scopes: empty_scopes)
+        last_token = AccessToken.matching_token_for(application, 100, empty_scopes)
+        expect(last_token).to eq(token)
+      end
+
+      it 'returns the last matching token' do
         FactoryBot.create :access_token, default_attributes.merge(created_at: 1.day.ago)
-        token = FactoryBot.create :access_token, default_attributes
+        matching_token = FactoryBot.create :access_token, default_attributes
+        FactoryBot.create :access_token, default_attributes.merge(scopes: 'public')
+
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
-        expect(last_token).to eq(token)
+        expect(last_token).to eq(matching_token)
       end
+    end
 
-      it 'returns as_json hash' do
-        token = FactoryBot.create :access_token, default_attributes
+    describe "#as_json" do
+      it "returns as_json hash" do
+        token = FactoryBot.create :access_token
         token_hash = {
           resource_owner_id:  token.resource_owner_id,
-          scopes:             token.scopes,
-          expires_in_seconds: token.expires_in_seconds,
+          scope:              token.scopes,
+          expires_in:         token.expires_in_seconds,
           application:        { uid: token.application.uid },
-          created_at:         token.created_at.to_i,
+          created_at:         token.created_at.to_i
         }
         expect(token.as_json).to eq token_hash
       end
     end
-
   end
 end

data/spec/models/doorkeeper/application_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module Doorkeeper
   describe Application do
@@ -206,6 +206,19 @@ module Doorkeeper
       end
     end
 
+    describe :revoke_tokens_and_grants_for do
+      it 'revokes all access tokens and access grants' do
+        application_id = 42
+        resource_owner = double
+        expect(Doorkeeper::AccessToken).
+          to receive(:revoke_all_for).with(application_id, resource_owner)
+        expect(Doorkeeper::AccessGrant).
+          to receive(:revoke_all_for).with(application_id, resource_owner)
+
+        Application.revoke_tokens_and_grants_for(application_id, resource_owner)
+      end
+    end
+
     describe :by_uid_and_secret do
       context "when application is private/confidential" do
         it "finds the application via uid/secret" do
@@ -253,51 +266,5 @@ module Doorkeeper
         it { expect(subject).to eq(false) }
       end
     end
-
-    describe :confidential do
-      subject { FactoryBot.create(:application, confidential: confidential).confidential }
-
-      context 'when application is private/confidential' do
-        let(:confidential) { true }
-        it { expect(subject).to eq(true) }
-      end
-
-      context 'when application is public/non-confidential' do
-        let(:confidential) { false }
-        it { expect(subject).to eq(false) }
-      end
-
-      context 'when the application does not support confidentiality' do
-        let(:confidential) { false }
-
-        before { allow(Application).to receive(:supports_confidentiality?).and_return(false) }
-
-        it 'warns of the CVE' do
-          expect(ActiveSupport::Deprecation).to receive(:warn).with(
-            'You are susceptible to security bug ' \
-            'CVE-2018-1000211. Please follow instructions outlined in ' \
-            'Doorkeeper::CVE_2018_1000211_WARNING'
-          )
-          Application.new.confidential
-        end
-
-        it { expect(subject).to eq(true) }
-      end
-    end
-
-    describe :supports_confidentiality? do
-      context 'when no column' do
-        it 'returns false' do
-          expect(Application).to receive(:column_names).and_return(%w[foo bar])
-          expect(Application.supports_confidentiality?).to eq(false)
-        end
-      end
-      context 'when column' do
-        it 'returns true' do
-          expect(Application).to receive(:column_names).and_return(%w[foo bar confidential])
-          expect(Application.supports_confidentiality?).to eq(true)
-        end
-      end
-    end
   end
 end

data/spec/requests/applications/applications_request_spec.rb

@@ -1,8 +1,9 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 feature 'Adding applications' do
   context 'in application form' do
     background do
+      i_am_logged_in
       visit '/oauth/applications/new'
     end
 
@@ -20,29 +21,123 @@ feature 'Adding applications' do
       click_button 'Submit'
       i_should_see 'Whoops! Check your form for possible errors'
     end
+
+    scenario "adding app ignoring bad scope" do
+      config_is_set("enforce_configured_scopes", false)
+
+      fill_in "doorkeeper_application[name]", with: "My Application"
+      fill_in "doorkeeper_application[redirect_uri]",
+              with: "https://example.com"
+      fill_in "doorkeeper_application[scopes]", with: "blahblah"
+
+      click_button "Submit"
+      i_should_see "Application created"
+      i_should_see "My Application"
+    end
+
+    scenario "adding app validating bad scope" do
+      config_is_set("enforce_configured_scopes", true)
+
+      fill_in "doorkeeper_application[name]", with: "My Application"
+      fill_in "doorkeeper_application[redirect_uri]",
+              with: "https://example.com"
+      fill_in "doorkeeper_application[scopes]", with: "blahblah"
+
+      click_button "Submit"
+      i_should_see "Whoops! Check your form for possible errors"
+    end
+
+    scenario "adding app validating scope, blank scope is accepted" do
+      config_is_set("enforce_configured_scopes", true)
+
+      fill_in "doorkeeper_application[name]", with: "My Application"
+      fill_in "doorkeeper_application[redirect_uri]",
+              with: "https://example.com"
+      fill_in "doorkeeper_application[scopes]", with: ""
+
+      click_button "Submit"
+      i_should_see "Application created"
+      i_should_see "My Application"
+    end
+
+    scenario "adding app validating scope, multiple scopes configured" do
+      config_is_set("enforce_configured_scopes", true)
+      scopes = Doorkeeper::OAuth::Scopes.from_array(%w(read write admin))
+      config_is_set("optional_scopes", scopes)
+
+      fill_in "doorkeeper_application[name]", with: "My Application"
+      fill_in "doorkeeper_application[redirect_uri]",
+              with: "https://example.com"
+      fill_in "doorkeeper_application[scopes]", with: "read write"
+
+      click_button "Submit"
+      i_should_see "Application created"
+      i_should_see "My Application"
+    end
+
+    scenario "adding app validating scope, bad scope with multiple scopes configured" do
+      config_is_set("enforce_configured_scopes", true)
+      scopes = Doorkeeper::OAuth::Scopes.from_array(%w(read write admin))
+      config_is_set("optional_scopes", scopes)
+
+      fill_in "doorkeeper_application[name]", with: "My Application"
+      fill_in "doorkeeper_application[redirect_uri]",
+              with: "https://example.com"
+      fill_in "doorkeeper_application[scopes]", with: "read blah"
+
+      click_button "Submit"
+      i_should_see "Whoops! Check your form for possible errors"
+      i_should_see Regexp.new(
+        I18n.t('activerecord.errors.models.doorkeeper/application.attributes.scopes.not_match_configured'),
+        true
+      )
+    end
   end
 end
 
 feature 'Listing applications' do
   background do
+    i_am_logged_in
+
     FactoryBot.create :application, name: 'Oauth Dude'
     FactoryBot.create :application, name: 'Awesome App'
   end
 
   scenario 'application list' do
     visit '/oauth/applications'
+
     i_should_see 'Awesome App'
     i_should_see 'Oauth Dude'
   end
 end
 
+feature 'Renders assets' do
+  scenario 'admin stylesheets' do
+    visit '/assets/doorkeeper/admin/application.css'
+
+    i_should_see 'Bootstrap'
+    i_should_see '.doorkeeper-admin'
+  end
+
+  scenario 'application stylesheets' do
+    visit '/assets/doorkeeper/application.css'
+
+    i_should_see 'Bootstrap'
+    i_should_see '#oauth-permissions'
+    i_should_see '#container'
+  end
+end
+
 feature 'Show application' do
   given :app do
+    i_am_logged_in
+
     FactoryBot.create :application, name: 'Just another oauth app'
   end
 
   scenario 'visiting application page' do
     visit "/oauth/applications/#{app.id}"
+
     i_should_see 'Just another oauth app'
   end
 end
@@ -53,12 +148,15 @@ feature 'Edit application' do
   end
 
   background do
+    i_am_logged_in
+
     visit "/oauth/applications/#{app.id}/edit"
   end
 
   scenario 'updating a valid app' do
     fill_in 'doorkeeper_application[name]', with: 'Serious app'
     click_button 'Submit'
+
     i_should_see 'Application updated'
     i_should_see 'Serious app'
     i_should_not_see 'OMG my app'
@@ -67,21 +165,27 @@ feature 'Edit application' do
   scenario 'updating an invalid app' do
     fill_in 'doorkeeper_application[name]', with: ''
     click_button 'Submit'
+
     i_should_see 'Whoops! Check your form for possible errors'
   end
 end
 
 feature 'Remove application' do
   background do
+    i_am_logged_in
+
     @app = FactoryBot.create :application
   end
 
   scenario 'deleting an application from list' do
     visit '/oauth/applications'
+
     i_should_see @app.name
+
     within(:css, "tr#application_#{@app.id}") do
       click_button 'Destroy'
     end
+
     i_should_see 'Application deleted'
     i_should_not_see @app.name
   end
@@ -89,6 +193,35 @@ feature 'Remove application' do
   scenario 'deleting an application from show' do
     visit "/oauth/applications/#{@app.id}"
     click_button 'Destroy'
+
     i_should_see 'Application deleted'
   end
 end
+
+context 'when admin authenticator block is default' do
+  let(:app) { FactoryBot.create :application, name: 'app' }
+
+  feature 'application list' do
+    scenario 'fails with forbidden' do
+      visit '/oauth/applications'
+
+      should_have_status 403
+    end
+  end
+
+  feature 'adding an app' do
+    scenario 'fails with forbidden' do
+      visit '/oauth/applications/new'
+
+      should_have_status 403
+    end
+  end
+
+  feature 'editing an app' do
+    scenario 'fails with forbidden' do
+      visit "/oauth/applications/#{app.id}/edit"
+
+      should_have_status 403
+    end
+  end
+end

data/spec/requests/applications/authorized_applications_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 feature 'Authorized applications' do
   background do

data/spec/requests/endpoints/authorization_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 feature 'Authorization endpoint' do
   background do

data/spec/requests/endpoints/token_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe 'Token endpoint' do
   before do
@@ -21,10 +21,12 @@ describe 'Token endpoint' do
   end
 
   it 'accepts client credentials with basic auth header' do
-    post token_endpoint_url(
-      code: @authorization.token,
-      redirect_uri: @client.redirect_uri
-    ), {}, 'HTTP_AUTHORIZATION' => basic_auth_header_for_client(@client)
+    post token_endpoint_url,
+         params: {
+           code: @authorization.token,
+           redirect_uri: @client.redirect_uri
+         },
+         headers: { 'HTTP_AUTHORIZATION' => basic_auth_header_for_client(@client) }
 
     should_have_json 'access_token', Doorkeeper::AccessToken.first.token
   end

data/spec/requests/flows/authorization_code_errors_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 feature 'Authorization Code Flow Errors' do
   let(:client_params) { {} }