doorkeeper 4.4.3 → 5.0.0

data/spec/requests/flows/authorization_code_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 feature 'Authorization Code Flow' do
   background do
@@ -39,6 +39,7 @@ feature 'Authorization Code Flow' do
     click_on 'Authorize'
     url_should_have_param('code', Doorkeeper::AccessGrant.first.token)
     url_should_have_param('state', 'return-me')
+    url_should_not_have_param('code_challenge_method')
   end
 
   scenario 'resource owner requests an access token with authorization code' do
@@ -57,6 +58,201 @@ feature 'Authorization Code Flow' do
     should_have_json_within 'expires_in', Doorkeeper::AccessToken.first.expires_in, 1
   end
 
+  scenario 'resource owner requests an access token with authorization code but without secret' do
+    visit authorization_endpoint_url(client: @client)
+    click_on 'Authorize'
+
+    authorization_code = Doorkeeper::AccessGrant.first.token
+    page.driver.post token_endpoint_url(code: authorization_code, client_id: @client.uid,
+                                        redirect_uri: @client.redirect_uri)
+
+    expect(Doorkeeper::AccessToken).not_to exist
+
+    should_have_json 'error', 'invalid_client'
+  end
+
+  context 'with PKCE' do
+    context 'plain' do
+      let(:code_challenge) { 'a45a9fea-0676-477e-95b1-a40f72ac3cfb' }
+      let(:code_verifier) { 'a45a9fea-0676-477e-95b1-a40f72ac3cfb' }
+
+      scenario 'resource owner authorizes the client with code_challenge parameter set' do
+        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge, code_challenge_method: 'plain')
+        click_on 'Authorize'
+
+        url_should_have_param('code', Doorkeeper::AccessGrant.first.token)
+        url_should_not_have_param('code_challenge_method')
+        url_should_not_have_param('code_challenge')
+      end
+
+      scenario 'mobile app requests an access token with authorization code but not pkce token' do
+        visit authorization_endpoint_url(client: @client)
+        click_on 'Authorize'
+
+        authorization_code = current_params['code']
+        create_access_token authorization_code, @client, code_verifier
+
+        should_have_json 'error', 'invalid_grant'
+      end
+
+      scenario 'mobile app requests an access token with authorization code and plain code challenge method' do
+        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge, code_challenge_method: 'plain')
+        click_on 'Authorize'
+
+        authorization_code = current_params['code']
+        create_access_token authorization_code, @client, code_verifier
+
+        access_token_should_exist_for(@client, @resource_owner)
+
+        should_not_have_json 'error'
+
+        should_have_json 'access_token', Doorkeeper::AccessToken.first.token
+        should_have_json 'token_type', 'Bearer'
+        should_have_json_within 'expires_in', Doorkeeper::AccessToken.first.expires_in, 1
+      end
+
+      scenario 'mobile app requests an access token with authorization code and code_challenge' do
+        visit authorization_endpoint_url(client: @client,
+                                         code_challenge: code_verifier,
+                                         code_challenge_method: 'plain')
+        click_on 'Authorize'
+
+        authorization_code = current_params['code']
+        create_access_token authorization_code, @client, code_verifier: nil
+
+        should_not_have_json 'access_token'
+        should_have_json 'error', 'invalid_grant'
+      end
+    end
+
+    context 's256' do
+      let(:code_challenge) { 'Oz733NtQ0rJP8b04fgZMJMwprn6Iw8sMCT_9bR1q4tA' }
+      let(:code_verifier) { 'a45a9fea-0676-477e-95b1-a40f72ac3cfb' }
+
+      scenario 'resource owner authorizes the client with code_challenge parameter set' do
+        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge, code_challenge_method: 'S256')
+        click_on 'Authorize'
+
+        url_should_have_param('code', Doorkeeper::AccessGrant.first.token)
+        url_should_not_have_param('code_challenge_method')
+        url_should_not_have_param('code_challenge')
+      end
+
+      scenario 'mobile app requests an access token with authorization code and S256 code challenge method' do
+        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge, code_challenge_method: 'S256')
+        click_on 'Authorize'
+
+        authorization_code = current_params['code']
+        create_access_token authorization_code, @client, code_verifier
+
+        access_token_should_exist_for(@client, @resource_owner)
+
+        should_not_have_json 'error'
+
+        should_have_json 'access_token', Doorkeeper::AccessToken.first.token
+        should_have_json 'token_type', 'Bearer'
+        should_have_json_within 'expires_in', Doorkeeper::AccessToken.first.expires_in, 1
+      end
+
+      scenario 'mobile app requests an access token with authorization code and without code_verifier' do
+        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge, code_challenge_method: 'S256')
+        click_on 'Authorize'
+        authorization_code = current_params['code']
+        create_access_token authorization_code, @client
+        should_have_json 'error', 'invalid_request'
+        should_not_have_json 'access_token'
+      end
+
+      scenario 'mobile app requests an access token with authorization code and without secret' do
+        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge, code_challenge_method: 'S256')
+        click_on 'Authorize'
+
+        authorization_code = current_params['code']
+        page.driver.post token_endpoint_url(code: authorization_code, client_id: @client.uid,
+                                            redirect_uri: @client.redirect_uri, code_verifier: code_verifier)
+        should_have_json 'error', 'invalid_client'
+        should_not_have_json 'access_token'
+      end
+
+      scenario 'mobile app requests an access token with authorization code and without secret but is marked as not confidential' do
+        @client.update_attribute :confidential, false
+        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge, code_challenge_method: 'S256')
+        click_on 'Authorize'
+
+        authorization_code = current_params['code']
+        page.driver.post token_endpoint_url(code: authorization_code, client_id: @client.uid,
+                                            redirect_uri: @client.redirect_uri, code_verifier: code_verifier)
+        should_not_have_json 'error'
+
+        should_have_json 'access_token', Doorkeeper::AccessToken.first.token
+        should_have_json 'token_type', 'Bearer'
+        should_have_json_within 'expires_in', Doorkeeper::AccessToken.first.expires_in, 1
+      end
+
+      scenario 'mobile app requests an access token with authorization code but no code verifier' do
+        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge, code_challenge_method: 'S256')
+        click_on 'Authorize'
+
+        authorization_code = current_params['code']
+        create_access_token authorization_code, @client
+
+        should_not_have_json 'access_token'
+        should_have_json 'error', 'invalid_request'
+      end
+
+      scenario 'mobile app requests an access token with authorization code with wrong verifier' do
+        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge, code_challenge_method: 'S256')
+        click_on 'Authorize'
+
+        authorization_code = current_params['code']
+        create_access_token authorization_code, @client, 'incorrect-code-verifier'
+
+        should_not_have_json 'access_token'
+        should_have_json 'error', 'invalid_grant'
+      end
+
+      scenario 'code_challenge_mehthod in token request is totally ignored' do
+        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge, code_challenge_method: 'S256')
+        click_on 'Authorize'
+
+        authorization_code = current_params['code']
+        page.driver.post token_endpoint_url(code: authorization_code, client: @client, code_verifier: code_challenge,
+                                            code_challenge_method: 'plain')
+
+        should_not_have_json 'access_token'
+        should_have_json 'error', 'invalid_grant'
+      end
+
+      scenario 'expects to set code_challenge_method explicitely without fallback' do
+        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge)
+        expect(page).to have_content('The code challenge method must be plain or S256.')
+      end
+    end
+  end
+
+  context 'when application scopes are present and no scope is passed' do
+    background do
+      @client.update_attributes(scopes: 'public write read')
+    end
+
+    scenario 'access grant has no scope' do
+      default_scopes_exist :admin
+      visit authorization_endpoint_url(client: @client)
+      click_on 'Authorize'
+      access_grant_should_exist_for(@client, @resource_owner)
+      grant = Doorkeeper::AccessGrant.first
+      expect(grant.scopes).to be_empty
+    end
+
+    scenario 'access grant have scopes which are common in application scopees and default scopes' do
+      default_scopes_exist :public, :write
+      visit authorization_endpoint_url(client: @client)
+      click_on 'Authorize'
+      access_grant_should_exist_for(@client, @resource_owner)
+      access_grant_should_have_scopes :public, :write
+    end
+  end
+
   context 'with scopes' do
     background do
       default_scopes_exist :public

data/spec/requests/flows/client_credentials_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe 'Client Credentials Request' do
   let(:client) { FactoryBot.create :application }
@@ -8,7 +8,7 @@ describe 'Client Credentials Request' do
       headers = authorization client.uid, client.secret
       params  = { grant_type: 'client_credentials' }
 
-      post '/oauth/token', params, headers
+      post '/oauth/token', params: params, headers: headers
 
       should_have_json 'access_token', Doorkeeper::AccessToken.first.token
       should_have_json_within 'expires_in', Doorkeeper.configuration.access_token_expires_in, 1
@@ -29,7 +29,7 @@ describe 'Client Credentials Request' do
         headers = authorization client.uid, client.secret
         params  = { grant_type: 'client_credentials', scope: 'write' }
 
-        post '/oauth/token', params, headers
+        post '/oauth/token', params: params, headers: headers
 
         should_have_json 'access_token', Doorkeeper::AccessToken.first.token
         should_have_json 'scope', 'write'
@@ -40,7 +40,7 @@ describe 'Client Credentials Request' do
           headers = authorization client.uid, client.secret
           params  = { grant_type: 'client_credentials', scope: 'public' }
 
-          post '/oauth/token', params, headers
+          post '/oauth/token', params: params, headers: headers
 
           should_have_json 'access_token', Doorkeeper::AccessToken.first.token
           should_have_json 'scope', 'public'
@@ -52,7 +52,7 @@ describe 'Client Credentials Request' do
           headers = authorization client.uid, client.secret
           params  = { grant_type: 'client_credentials', scope: 'random' }
 
-          post '/oauth/token', params, headers
+          post '/oauth/token', params: params, headers: headers
 
           should_have_json 'error', 'invalid_scope'
           should_have_json 'error_description', translated_error_message(:invalid_scope)
@@ -64,12 +64,52 @@ describe 'Client Credentials Request' do
     end
   end
 
+  context 'when application scopes contain some of the default scopes and no scope is passed' do
+    before do
+      client.update_attributes(scopes: 'read write public')
+    end
+
+    it 'issues new token with one default scope that are present in application scopes' do
+      default_scopes_exist :public
+
+      headers = authorization client.uid, client.secret
+      params  = { grant_type: 'client_credentials' }
+
+      expect do
+        post '/oauth/token', params: params, headers: headers
+      end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+      token = Doorkeeper::AccessToken.first
+
+      expect(token.application_id).to eq client.id
+      should_have_json 'access_token', token.token
+      should_have_json 'scope', 'public'
+    end
+
+    it 'issues new token with multiple default scopes that are present in application scopes' do
+      default_scopes_exist :public, :read, :update
+
+      headers = authorization client.uid, client.secret
+      params  = { grant_type: 'client_credentials' }
+
+      expect do
+        post '/oauth/token', params: params, headers: headers
+      end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+      token = Doorkeeper::AccessToken.first
+
+      expect(token.application_id).to eq client.id
+      should_have_json 'access_token', token.token
+      should_have_json 'scope', 'public read'
+    end
+  end
+
   context 'an invalid request' do
     it 'does not authorize the client and returns the error' do
       headers = {}
       params  = { grant_type: 'client_credentials' }
 
-      post '/oauth/token', params, headers
+      post '/oauth/token', params: params, headers: headers
 
       should_have_json 'error', 'invalid_client'
       should_have_json 'error_description', translated_error_message(:invalid_client)

data/spec/requests/flows/implicit_grant_errors_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 feature 'Implicit Grant Flow Errors' do
   background do

data/spec/requests/flows/implicit_grant_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 feature 'Implicit Grant Flow (feature spec)' do
   background do
@@ -17,6 +17,29 @@ feature 'Implicit Grant Flow (feature spec)' do
 
     i_should_be_on_client_callback @client
   end
+
+  context 'when application scopes are present and no scope is passed' do
+    background do
+      @client.update_attributes(scopes: 'public write read')
+    end
+
+    scenario 'access token has no scopes' do
+      default_scopes_exist :admin
+      visit authorization_endpoint_url(client: @client, response_type: 'token')
+      click_on 'Authorize'
+      access_token_should_exist_for @client, @resource_owner
+      token = Doorkeeper::AccessToken.first
+      expect(token.scopes).to be_empty
+    end
+
+    scenario 'access token has scopes which are common in application scopees and default scopes' do
+      default_scopes_exist :public, :write
+      visit authorization_endpoint_url(client: @client, response_type: 'token')
+      click_on 'Authorize'
+      access_token_should_exist_for @client, @resource_owner
+      access_token_should_have_scopes :public, :write
+    end
+  end
 end
 
 describe 'Implicit Grant Flow (request spec)' do
@@ -34,11 +57,13 @@ describe 'Implicit Grant Flow (request spec)' do
       token = client_is_authorized(@client, @resource_owner)
 
       post "/oauth/authorize",
-           client_id: @client.uid,
-           state: '',
-           redirect_uri: @client.redirect_uri,
-           response_type: 'token',
-           commit: 'Authorize'
+           params: {
+             client_id: @client.uid,
+             state: '',
+             redirect_uri: @client.redirect_uri,
+             response_type: 'token',
+             commit: 'Authorize'
+           }
 
       expect(response.location).not_to include(token.token)
     end
@@ -49,11 +74,13 @@ describe 'Implicit Grant Flow (request spec)' do
       token = client_is_authorized(@client, @resource_owner)
 
       post "/oauth/authorize",
-           client_id: @client.uid,
-           state: '',
-           redirect_uri: @client.redirect_uri,
-           response_type: 'token',
-           commit: 'Authorize'
+           params: {
+             client_id: @client.uid,
+             state: '',
+             redirect_uri: @client.redirect_uri,
+             response_type: 'token',
+             commit: 'Authorize'
+           }
 
       expect(response.location).to include(token.token)
     end

data/spec/requests/flows/password_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe 'Resource Owner Password Credentials Flow not set up' do
   before do
@@ -7,7 +7,7 @@ describe 'Resource Owner Password Credentials Flow not set up' do
   end
 
   context 'with valid user credentials' do
-    it 'doesn\'t issue new token' do
+    it 'does not issue new token' do
       expect do
         post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
       end.to_not(change { Doorkeeper::AccessToken.count })
@@ -140,6 +140,60 @@ describe 'Resource Owner Password Credentials Flow' do
     end
   end
 
+  context 'when application scopes are present and differs from configured default scopes and no scope is passed' do
+    before do
+      default_scopes_exist :public
+      @client.update_attributes(scopes: 'abc')
+    end
+
+    it 'issues new token without any scope' do
+      expect do
+      post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
+      end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+      token = Doorkeeper::AccessToken.first
+
+      expect(token.application_id).to eq @client.id
+      expect(token.scopes).to be_empty
+      should_have_json 'access_token', token.token
+      should_not_have_json 'scope'
+    end
+  end
+
+  context 'when application scopes contain some of the default scopes and no scope is passed' do
+    before do
+      @client.update_attributes(scopes: 'read write public')
+    end
+
+    it 'issues new token with one default scope that are present in application scopes' do
+      default_scopes_exist :public, :admin
+
+      expect do
+        post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
+      end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+      token = Doorkeeper::AccessToken.first
+
+      expect(token.application_id).to eq @client.id
+      should_have_json 'access_token', token.token
+      should_have_json 'scope', 'public'
+    end
+
+    it 'issues new token with multiple default scopes that are present in application scopes' do
+      default_scopes_exist :public, :read, :update
+
+      expect do
+        post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
+      end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+      token = Doorkeeper::AccessToken.first
+
+      expect(token.application_id).to eq @client.id
+      should_have_json 'access_token', token.token
+      should_have_json 'scope', 'public read'
+    end
+  end
+
   context 'with invalid scopes' do
     subject do
       post password_token_endpoint_url(client: @client,

data/spec/requests/flows/refresh_token_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe 'Refresh Token Flow' do
   before do
@@ -14,7 +14,7 @@ describe 'Refresh Token Flow' do
       authorization_code_exists application: @client
     end
 
-    it 'client gets the refresh token and refreshses it' do
+    it 'client gets the refresh token and refreshes it' do
       post token_endpoint_url(code: @authorization.token, client: @client)
 
       token = Doorkeeper::AccessToken.first

data/spec/requests/flows/revoke_token_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe 'Revoke Token Flow' do
   before do
@@ -24,7 +24,7 @@ describe 'Revoke Token Flow' do
       end
 
       it 'should revoke the access token provided' do
-        post revocation_token_endpoint_url, { token: access_token.token }, headers
+        post revocation_token_endpoint_url, params: { token: access_token.token }, headers: headers
 
         access_token.reload
 
@@ -33,7 +33,7 @@ describe 'Revoke Token Flow' do
       end
 
       it 'should revoke the refresh token provided' do
-        post revocation_token_endpoint_url, { token: access_token.refresh_token }, headers
+        post revocation_token_endpoint_url, params: { token: access_token.refresh_token }, headers: headers
 
         access_token.reload
 
@@ -44,7 +44,7 @@ describe 'Revoke Token Flow' do
       context 'with invalid token to revoke' do
         it 'should not revoke any tokens and respond successfully' do
           num_prev_revoked_tokens = Doorkeeper::AccessToken.where(revoked_at: nil).count
-          post revocation_token_endpoint_url, { token: 'I_AM_AN_INVALID_TOKEN' }, headers
+          post revocation_token_endpoint_url, params: { token: 'I_AM_AN_INVALID_TOKEN' }, headers: headers
 
           # The authorization server responds with HTTP status code 200 even if
           # token is invalid
@@ -60,7 +60,7 @@ describe 'Revoke Token Flow' do
           { 'HTTP_AUTHORIZATION' => "Basic #{credentials}" }
         end
         it 'should not revoke any tokens and respond successfully' do
-          post revocation_token_endpoint_url, { token: access_token.token }, headers
+          post revocation_token_endpoint_url, params: { token: access_token.token }, headers: headers
 
           access_token.reload
 
@@ -71,7 +71,7 @@ describe 'Revoke Token Flow' do
 
       context 'with no credentials and a valid token' do
         it 'should not revoke any tokens and respond successfully' do
-          post revocation_token_endpoint_url, { token: access_token.token }
+          post revocation_token_endpoint_url, params: { token: access_token.token }
 
           access_token.reload
 
@@ -90,7 +90,7 @@ describe 'Revoke Token Flow' do
         end
 
         it 'should not revoke the token as its unauthorized' do
-          post revocation_token_endpoint_url, { token: access_token.token }, headers
+          post revocation_token_endpoint_url, params: { token: access_token.token }, headers: headers
 
           access_token.reload
 
@@ -109,7 +109,7 @@ describe 'Revoke Token Flow' do
       end
 
       it 'should revoke the access token provided' do
-        post revocation_token_endpoint_url, { token: access_token.token }
+        post revocation_token_endpoint_url, params: { token: access_token.token }
 
         access_token.reload
 
@@ -118,7 +118,7 @@ describe 'Revoke Token Flow' do
       end
 
       it 'should revoke the refresh token provided' do
-        post revocation_token_endpoint_url, { token: access_token.refresh_token }
+        post revocation_token_endpoint_url, params: { token: access_token.refresh_token }
 
         access_token.reload
 
@@ -135,7 +135,7 @@ describe 'Revoke Token Flow' do
         end
 
         it 'should not revoke the access token provided' do
-          post revocation_token_endpoint_url, { token: access_token.token }
+          post revocation_token_endpoint_url, params: { token: access_token.token }
 
           access_token.reload
 
@@ -144,7 +144,7 @@ describe 'Revoke Token Flow' do
         end
 
         it 'should not revoke the refresh token provided' do
-          post revocation_token_endpoint_url, { token: access_token.token }
+          post revocation_token_endpoint_url, params: { token: access_token.token }
 
           access_token.reload
 

data/spec/requests/flows/skip_authorization_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 feature 'Skip authorization form' do
   background do
@@ -15,13 +15,24 @@ feature 'Skip authorization form' do
     end
 
     scenario 'skips the authorization and return a new grant code' do
-      client_is_authorized(@client, @resource_owner, scopes: 'public')
-      visit authorization_endpoint_url(client: @client)
+      client_is_authorized(@client, @resource_owner, scopes: "public")
+      visit authorization_endpoint_url(client: @client, scope: "public")
+
+      i_should_not_see "Authorize"
+      client_should_be_authorized @client
+      i_should_be_on_client_callback @client
+      url_should_have_param "code", Doorkeeper::AccessGrant.first.token
+    end
+
+    scenario "skips the authorization if other scopes are not requested" do
+      client_exists scopes: "public read write"
+      client_is_authorized(@client, @resource_owner, scopes: "public")
+      visit authorization_endpoint_url(client: @client, scope: "public")
 
-      i_should_not_see 'Authorize'
+      i_should_not_see "Authorize"
       client_should_be_authorized @client
       i_should_be_on_client_callback @client
-      url_should_have_param 'code', Doorkeeper::AccessGrant.first.token
+      url_should_have_param "code", Doorkeeper::AccessGrant.first.token
     end
 
     scenario 'does not skip authorization when scopes differ (new request has fewer scopes)' do
@@ -43,12 +54,6 @@ feature 'Skip authorization form' do
       access_grant_should_have_scopes :public
     end
 
-    scenario 'doesn not skip authorization when scopes are greater' do
-      client_is_authorized(@client, @resource_owner, scopes: 'public')
-      visit authorization_endpoint_url(client: @client, scope: 'public write')
-      i_should_see 'Authorize'
-    end
-
     scenario 'creates grant with new scope when scopes are greater' do
       client_is_authorized(@client, @resource_owner, scopes: 'public')
       visit authorization_endpoint_url(client: @client, scope: 'public write')

data/spec/requests/protected_resources/metal_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe 'ActionController::Metal API' do
   before do

data/spec/requests/protected_resources/private_api_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 feature 'Private API' do
   background do