doorkeeper 4.4.3 → 5.0.0

data/spec/controllers/protected_resources_controller_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module ControllerActions
   def index
@@ -33,12 +33,12 @@ describe 'doorkeeper authorize filter' do
 
     it 'access_token param' do
       expect(Doorkeeper::AccessToken).to receive(:by_token).with(token_string).and_return(token)
-      get :index, access_token: token_string
+      get :index, params: { access_token: token_string }
     end
 
     it 'bearer_token param' do
       expect(Doorkeeper::AccessToken).to receive(:by_token).with(token_string).and_return(token)
-      get :index, bearer_token: token_string
+      get :index, params: { bearer_token: token_string }
     end
 
     it 'Authorization header' do
@@ -57,7 +57,7 @@ describe 'doorkeeper authorize filter' do
       expect(Doorkeeper::AccessToken).to receive(:by_token).exactly(2).times.and_return(token)
       request.env['HTTP_AUTHORIZATION'] = "Bearer #{token_string}"
       get :index
-      controller.send(:remove_instance_variable, :@_doorkeeper_token)
+      controller.send(:remove_instance_variable, :@doorkeeper_token)
       get :index
     end
   end
@@ -71,25 +71,25 @@ describe 'doorkeeper authorize filter' do
 
     context 'with valid token', token: :valid do
       it 'allows into index action' do
-        get :index, access_token: token_string
+        get :index, params: { access_token: token_string }
         expect(response).to be_successful
       end
 
       it 'allows into show action' do
-        get :show, id: '4', access_token: token_string
+        get :show, params: { id: '4', access_token: token_string }
         expect(response).to be_successful
       end
     end
 
     context 'with invalid token', token: :invalid do
       it 'does not allow into index action' do
-        get :index, access_token: token_string
+        get :index, params: { access_token: token_string }
         expect(response.status).to eq 401
         expect(response.header['WWW-Authenticate']).to match(/^Bearer/)
       end
 
       it 'does not allow into show action' do
-        get :show, id: '4', access_token: token_string
+        get :show, params: { id: '4', access_token: token_string }
         expect(response.status).to eq 401
         expect(response.header['WWW-Authenticate']).to match(/^Bearer/)
       end
@@ -115,7 +115,7 @@ describe 'doorkeeper authorize filter' do
         Doorkeeper::AccessToken
       ).to receive(:by_token).with(token_string).and_return(token)
 
-      get :index, access_token: token_string
+      get :index, params: { access_token: token_string }
       expect(response).to be_successful
     end
 
@@ -129,7 +129,7 @@ describe 'doorkeeper authorize filter' do
       ).to receive(:by_token).with(token_string).and_return(token)
       expect(token).to receive(:acceptable?).with([:write]).and_return(false)
 
-      get :index, access_token: token_string
+      get :index, params: { access_token: token_string }
       expect(response.status).to eq 403
       expect(response.header).to_not include('WWW-Authenticate')
     end
@@ -163,7 +163,7 @@ describe 'doorkeeper authorize filter' do
       end
 
       it 'it renders a custom JSON response', token: :invalid do
-        get :index, access_token: token_string
+        get :index, params: { access_token: token_string }
         expect(response.status).to eq 401
         expect(response.content_type).to eq('application/json')
         expect(response.header['WWW-Authenticate']).to match(/^Bearer/)
@@ -193,7 +193,7 @@ describe 'doorkeeper authorize filter' do
       end
 
       it 'it renders a custom text response', token: :invalid do
-        get :index, access_token: token_string
+        get :index, params: { access_token: token_string }
         expect(response.status).to eq 401
         expect(response.content_type).to eq('text/plain')
         expect(response.header['WWW-Authenticate']).to match(/^Bearer/)
@@ -243,7 +243,7 @@ describe 'doorkeeper authorize filter' do
       end
 
       it 'renders a custom JSON response' do
-        get :index, access_token: token_string
+        get :index, params: { access_token: token_string }
         expect(response.header).to_not include('WWW-Authenticate')
         expect(response.content_type).to eq('application/json')
         expect(response.status).to eq 403
@@ -265,7 +265,7 @@ describe 'doorkeeper authorize filter' do
       end
 
       it 'overrides the default status code' do
-        get :index, access_token: token_string
+        get :index, params: { access_token: token_string }
         expect(response.status).to eq 404
       end
     end
@@ -282,7 +282,7 @@ describe 'doorkeeper authorize filter' do
       end
 
       it 'renders a custom status code and text response' do
-        get :index, access_token: token_string
+        get :index, params: { access_token: token_string }
         expect(response.header).to_not include('WWW-Authenticate')
         expect(response.status).to eq 403
         expect(response.body).to eq('Forbidden')
@@ -301,7 +301,7 @@ describe 'doorkeeper authorize filter' do
       end
 
       it 'overrides the default status code' do
-        get :index, access_token: token_string
+        get :index, params: { access_token: token_string }
         expect(response.status).to eq 404
       end
     end

data/spec/controllers/token_info_controller_spec.rb

@@ -1,32 +1,24 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe Doorkeeper::TokenInfoController do
   describe 'when requesting token info with valid token' do
     let(:doorkeeper_token) { FactoryBot.create(:access_token) }
 
-    before(:each) do
-      allow(controller).to receive(:doorkeeper_token) { doorkeeper_token }
-    end
-
     describe 'successful request' do
-      it 'responds with tokeninfo' do
-        get :show
+      it 'responds with token info' do
+        get :show, params: { access_token: doorkeeper_token.token }
 
         expect(response.body).to eq(doorkeeper_token.to_json)
       end
 
       it 'responds with a 200 status' do
-        get :show
+        get :show, params: { access_token: doorkeeper_token.token }
 
         expect(response.status).to eq 200
       end
     end
 
     describe 'invalid token response' do
-      before(:each) do
-        allow(controller).to receive(:doorkeeper_token).and_return(nil)
-      end
-
       it 'responds with 401 when doorkeeper_token is not valid' do
         get :show
 

data/spec/controllers/tokens_controller_spec.rb

@@ -1,12 +1,9 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe Doorkeeper::TokensController do
   describe 'when authorization has succeeded' do
     let(:token) { double(:token, authorize: true) }
 
-    before do
-      allow(controller).to receive(:token) { token }
-    end
 
     it 'returns the authorization' do
       skip 'verify need of these specs'
@@ -36,7 +33,7 @@ describe Doorkeeper::TokensController do
       allow(I18n).to receive(:translate).
         with(
           custom_message,
-          hash_including(scope: %i[doorkeeper errors messages]),
+          hash_including(scope: %i[doorkeeper errors messages])
         ).
         and_return('Authorization custom message')
 
@@ -129,7 +126,8 @@ describe Doorkeeper::TokensController do
       expect(strategy).to receive(:authorize).once
       allow(controller).to receive(:strategy) { strategy }
       allow(controller).to receive(:create) do
-        controller.send :authorize_response
+        2.times { controller.send :authorize_response }
+        controller.render json: {}, status: :ok
       end
 
       post :create
@@ -144,7 +142,7 @@ describe Doorkeeper::TokensController do
       it 'responds with full token introspection' do
         request.headers['Authorization'] = "Bearer #{access_token.token}"
 
-        post :introspect, token: access_token.token
+        post :introspect, params: { token: access_token.token }
 
         should_have_json 'active', true
         expect(json_response).to include('client_id', 'token_type', 'exp', 'iat')
@@ -158,7 +156,7 @@ describe Doorkeeper::TokensController do
       it 'responds with full token introspection' do
         request.headers['Authorization'] = basic_auth_header_for_client(client)
 
-        post :introspect, token: access_token.token
+        post :introspect, params: { token: access_token.token }
 
         should_have_json 'active', true
         expect(json_response).to include('client_id', 'token_type', 'exp', 'iat')
@@ -173,7 +171,7 @@ describe Doorkeeper::TokensController do
       it 'responds with full token introspection' do
         request.headers['Authorization'] = basic_auth_header_for_client(client)
 
-        post :introspect, token: access_token.token
+        post :introspect, params: { token: access_token.token }
 
         should_have_json 'active', true
         expect(json_response).to include('client_id', 'token_type', 'exp', 'iat')
@@ -189,7 +187,7 @@ describe Doorkeeper::TokensController do
       it 'responds with only active state' do
         request.headers['Authorization'] = basic_auth_header_for_client(different_client)
 
-        post :introspect, token: access_token.token
+        post :introspect, params: { token: access_token.token }
 
         expect(response).to be_successful
 
@@ -205,7 +203,7 @@ describe Doorkeeper::TokensController do
       it 'responds with invalid_client error' do
         request.headers['Authorization'] = basic_auth_header_for_client(client)
 
-        post :introspect, token: access_token.token
+        post :introspect, params: { token: access_token.token }
 
         expect(response).not_to be_successful
         response_status_should_be 401
@@ -222,7 +220,7 @@ describe Doorkeeper::TokensController do
       it 'responds with only active state' do
         request.headers['Authorization'] = basic_auth_header_for_client(client)
 
-        post :introspect, token: SecureRandom.hex(16)
+        post :introspect, params: { token: SecureRandom.hex(16) }
 
         should_have_json 'active', false
         expect(json_response).not_to include('client_id', 'token_type', 'exp', 'iat')
@@ -236,7 +234,7 @@ describe Doorkeeper::TokensController do
       it 'responds with only active state' do
         request.headers['Authorization'] = basic_auth_header_for_client(client)
 
-        post :introspect, token: access_token.token
+        post :introspect, params: { token: access_token.token }
 
         should_have_json 'active', false
         expect(json_response).not_to include('client_id', 'token_type', 'exp', 'iat')
@@ -250,7 +248,7 @@ describe Doorkeeper::TokensController do
       it 'responds with only active state' do
         request.headers['Authorization'] = basic_auth_header_for_client(client)
 
-        post :introspect, token: access_token.token
+        post :introspect, params: { token: access_token.token }
 
         should_have_json 'active', false
         expect(json_response).not_to include('client_id', 'token_type', 'exp', 'iat')
@@ -261,7 +259,7 @@ describe Doorkeeper::TokensController do
       let(:access_token) { FactoryBot.create(:access_token) }
 
       it 'responds with invalid_request error' do
-        post :introspect, token: access_token.token
+        post :introspect, params: { token: access_token.token }
 
         expect(response).not_to be_successful
         response_status_should_be 401

data/spec/dummy/app/assets/config/manifest.js

@@ -0,0 +1,2 @@
+// JS and CSS bundles
+//

data/spec/dummy/config/environments/test.rb

@@ -7,6 +7,10 @@ Dummy::Application.configure do
   # and recreated between test runs.  Don't rely on the data there!
   config.cache_classes = true
 
+  config.assets.enabled = true
+  config.assets.version = '1.0'
+  config.assets.digest = false
+
   # Do not eager load code on boot. This avoids loading your whole application
   # just for the purpose of running a single test. If you are using a tool that
   # preloads Rails for running tests, you may have to set it to true.
@@ -36,9 +40,4 @@ Dummy::Application.configure do
   config.active_support.deprecation = :stderr
 
   config.eager_load = true
-
-  if DOORKEEPER_ORM == :active_record
-    config.active_record.table_name_prefix = TABLE_NAME_PREFIX.to_s
-    config.active_record.table_name_suffix = TABLE_NAME_SUFFIX.to_s
-  end
 end

data/spec/dummy/config/initializers/doorkeeper.rb

@@ -8,7 +8,11 @@ Doorkeeper.configure do
     User.where(id: session[:user_id]).first || redirect_to(root_url, alert: 'Needs sign in.')
   end
 
-  # If you want to restrict access to the web interface for adding oauth authorized applications, you need to declare the block below.
+  # If you didn't skip applications controller from Doorkeeper routes in your application routes.rb
+  # file then you need to declare this block in order to restrict access to the web interface for
+  # adding oauth authorized applications. In other case it will return 403 Forbidden response
+  # every time somebody will try to access the admin web interface.
+  #
   # admin_authenticator do
   #   # Put your admin authentication logic here.
   #   # Example implementation:
@@ -29,10 +33,11 @@ Doorkeeper.configure do
   # Issue access tokens with refresh token (disabled by default)
   use_refresh_token
 
-  # Opt out of breaking api change to the native authorization code flow. Opting out sets the authorization
-  # code response route for native redirect uris to oauth/authorize/<code>. The default is oauth/authorize/native?code=<code>.
-  # Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/1143
-  # opt_out_native_route_change
+  # Forbids creating/updating applications with arbitrary scopes that are
+  # not in configuration, i.e. `default_scopes` or `optional_scopes`.
+  # (disabled by default)
+  #
+  # enforce_configured_scopes
 
   # Provide support for an owner to be assigned to each registered application (disabled by default)
   # Optional parameter confirmation: true (default false) if you want to enforce ownership of

data/spec/dummy/config/initializers/new_framework_defaults.rb

@@ -3,4 +3,8 @@
 # made on earlier versions of Rails are not affected when upgrading.
 if Rails::VERSION::MAJOR >= 5
   Rails.application.config.active_record.belongs_to_required_by_default = true
+
+  if Rails::VERSION::MINOR >= 2
+    Rails.application.config.active_record.sqlite3.represent_boolean_as_integer = true
+  end
 end

data/spec/dummy/config/routes.rb

@@ -1,52 +1,13 @@
 Rails.application.routes.draw do
   use_doorkeeper
-  use_doorkeeper scope: 'scope'
 
-  scope 'inner_space' do
-    use_doorkeeper scope: 'scope' do
-      controllers authorizations: 'custom_authorizations',
-                  tokens: 'custom_authorizations',
-                  applications: 'custom_authorizations',
-                  token_info: 'custom_authorizations'
-
-      as authorizations: 'custom_auth',
-         tokens: 'custom_token',
-         token_info: 'custom_token_info'
-    end
-  end
-
-  scope 'space' do
-    use_doorkeeper do
-      controllers authorizations: 'custom_authorizations',
-                  tokens: 'custom_authorizations',
-                  applications: 'custom_authorizations',
-                  token_info: 'custom_authorizations'
-
-      as authorizations: 'custom_auth',
-         tokens: 'custom_token',
-         token_info: 'custom_token_info'
-    end
-  end
-
-  scope 'outer_space' do
-    use_doorkeeper do
-      controllers authorizations: 'custom_authorizations',
-                  tokens: 'custom_authorizations',
-                  token_info: 'custom_authorizations'
-
-      as authorizations: 'custom_auth',
-         tokens: 'custom_token',
-         token_info: 'custom_token_info'
-
-      skip_controllers :tokens, :applications, :token_info
-    end
-  end
+  resources :semi_protected_resources
+  resources :full_protected_resources
 
   get 'metal.json' => 'metal#index'
 
   get '/callback', to: 'home#callback'
   get '/sign_in',  to: 'home#sign_in'
-  resources :semi_protected_resources
-  resources :full_protected_resources
+
   root to: 'home#index'
 end

data/spec/dummy/db/migrate/20170822064514_enable_pkce.rb

@@ -0,0 +1,6 @@
+class EnablePkce < ActiveRecord::Migration[4.2]
+  def change
+    add_column :oauth_access_grants, :code_challenge, :string, null: true
+    add_column :oauth_access_grants, :code_challenge_method, :string, null: true
+  end
+end

data/spec/dummy/db/migrate/{20180210183654_add_confidential_to_application.rb → 20180210183654_add_confidential_to_applications.rb}

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-class AddConfidentialToApplication < ActiveRecord::Migration[5.1]
+class AddConfidentialToApplications < ActiveRecord::Migration[5.1]
   def change
     add_column(
       :oauth_applications,

data/spec/dummy/db/schema.rb

@@ -1,4 +1,3 @@
-# encoding: UTF-8
 # This file is auto-generated from the current state of the database. Instead
 # of editing this file, please use the migrations feature of Active Record to
 # incrementally modify your database, and then regenerate this schema definition.
@@ -14,55 +13,56 @@
 ActiveRecord::Schema.define(version: 20180210183654) do
 
   create_table "oauth_access_grants", force: :cascade do |t|
-    t.integer  "resource_owner_id", null: false
-    t.integer  "application_id",    null: false
-    t.string   "token",             null: false
-    t.integer  "expires_in",        null: false
-    t.text     "redirect_uri",      null: false
-    t.datetime "created_at",        null: false
+    t.integer "resource_owner_id", null: false
+    t.integer "application_id", null: false
+    t.string "token", null: false
+    t.integer "expires_in", null: false
+    t.text "redirect_uri", null: false
+    t.datetime "created_at", null: false
     t.datetime "revoked_at"
-    t.string   "scopes"
+    t.string "scopes"
+    unless ENV['WITHOUT_PKCE']
+      t.string   "code_challenge"
+      t.string   "code_challenge_method"
+    end
+    t.index ["token"], name: "index_oauth_access_grants_on_token", unique: true
   end
 
-  add_index "oauth_access_grants", ["token"], name: "index_oauth_access_grants_on_token", unique: true
-
   create_table "oauth_access_tokens", force: :cascade do |t|
-    t.integer  "resource_owner_id"
-    t.integer  "application_id"
-    t.string   "token",                               null: false
-    t.string   "refresh_token"
-    t.integer  "expires_in"
+    t.integer "resource_owner_id"
+    t.integer "application_id"
+    t.string "token", null: false
+    t.string "refresh_token"
+    t.integer "expires_in"
     t.datetime "revoked_at"
-    t.datetime "created_at",                          null: false
-    t.string   "scopes"
-    t.string   "previous_refresh_token", default: "", null: false
+    t.datetime "created_at", null: false
+    t.string "scopes"
+    t.string "previous_refresh_token", default: "", null: false
+    t.index ["refresh_token"], name: "index_oauth_access_tokens_on_refresh_token", unique: true
+    t.index ["resource_owner_id"], name: "index_oauth_access_tokens_on_resource_owner_id"
+    t.index ["token"], name: "index_oauth_access_tokens_on_token", unique: true
   end
 
-  add_index "oauth_access_tokens", ["refresh_token"], name: "index_oauth_access_tokens_on_refresh_token", unique: true
-  add_index "oauth_access_tokens", ["resource_owner_id"], name: "index_oauth_access_tokens_on_resource_owner_id"
-  add_index "oauth_access_tokens", ["token"], name: "index_oauth_access_tokens_on_token", unique: true
-
   create_table "oauth_applications", force: :cascade do |t|
-    t.string   "name",                      null: false
-    t.string   "uid",                       null: false
-    t.string   "secret",                    null: false
-    t.text     "redirect_uri",              null: false
-    t.string   "scopes",       default: "", null: false
-    t.datetime "created_at"
-    t.datetime "updated_at"
-    t.integer  "owner_id"
-    t.string   "owner_type"
+    t.string "name", null: false
+    t.string "uid", null: false
+    t.string "secret", null: false
+    t.text "redirect_uri", null: false
+    t.string "scopes", default: "", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.integer "owner_id"
+    t.string "owner_type"
     t.boolean "confidential", default: true, null: false
+    t.index ["owner_id", "owner_type"], name: "index_oauth_applications_on_owner_id_and_owner_type"
+    t.index ["uid"], name: "index_oauth_applications_on_uid", unique: true
   end
 
-  add_index "oauth_applications", ["owner_id", "owner_type"], name: "index_oauth_applications_on_owner_id_and_owner_type"
-  add_index "oauth_applications", ["uid"], name: "index_oauth_applications_on_uid", unique: true
-
   create_table "users", force: :cascade do |t|
-    t.string   "name"
+    t.string "name"
     t.datetime "created_at"
     t.datetime "updated_at"
-    t.string   "password"
+    t.string "password"
   end
 
 end

data/spec/generators/application_owner_generator_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 require 'generators/doorkeeper/application_owner_generator'
 
 describe 'Doorkeeper::ApplicationOwnerGenerator' do

data/spec/generators/confidential_applications_generator_spec.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'generators/doorkeeper/confidential_applications_generator'
+
+describe 'Doorkeeper::ConfidentialApplicationsGenerator' do
+  include GeneratorSpec::TestCase
+
+  tests Doorkeeper::ConfidentialApplicationsGenerator
+  destination ::File.expand_path('../tmp/dummy', __FILE__)
+
+  describe 'after running the generator' do
+    before :each do
+      prepare_destination
+    end
+
+    context 'pre Rails 5.0.0' do
+      it 'creates a migration with no version specifier' do
+        stub_const("ActiveRecord::VERSION::MAJOR", 4)
+        stub_const("ActiveRecord::VERSION::MINOR", 2)
+
+        run_generator
+
+        assert_migration 'db/migrate/add_confidential_to_applications.rb' do |migration|
+          assert migration.include?("ActiveRecord::Migration\n")
+          assert migration.include?(':confidential')
+        end
+      end
+    end
+
+    context 'post Rails 5.0.0' do
+      it 'creates a migration with a version specifier' do
+        stub_const("ActiveRecord::VERSION::MAJOR", 5)
+        stub_const("ActiveRecord::VERSION::MINOR", 0)
+
+        run_generator
+
+        assert_migration 'db/migrate/add_confidential_to_applications.rb' do |migration|
+          assert migration.include?("ActiveRecord::Migration[5.0]\n")
+          assert migration.include?(':confidential')
+        end
+      end
+    end
+  end
+end

data/spec/generators/install_generator_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 require 'generators/doorkeeper/install_generator'
 
 describe 'Doorkeeper::InstallGenerator' do

data/spec/generators/migration_generator_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 require 'generators/doorkeeper/migration_generator'
 
 describe 'Doorkeeper::MigrationGenerator' do

data/spec/generators/pkce_generator_spec.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'generators/doorkeeper/pkce_generator'
+
+describe 'Doorkeeper::PkceGenerator' do
+  include GeneratorSpec::TestCase
+
+  tests Doorkeeper::PkceGenerator
+  destination ::File.expand_path('../tmp/dummy', __FILE__)
+
+  describe 'after running the generator' do
+    before :each do
+      prepare_destination
+    end
+
+    context 'pre Rails 5.0.0' do
+      it 'creates a migration with no version specifier' do
+        stub_const("ActiveRecord::VERSION::MAJOR", 4)
+        stub_const("ActiveRecord::VERSION::MINOR", 2)
+
+        run_generator
+
+        assert_migration 'db/migrate/enable_pkce.rb' do |migration|
+          assert migration.include?("ActiveRecord::Migration\n")
+        end
+      end
+    end
+
+    context 'post Rails 5.0.0' do
+      it 'creates a migration with a version specifier' do
+        stub_const("ActiveRecord::VERSION::MAJOR", 5)
+        stub_const("ActiveRecord::VERSION::MINOR", 0)
+
+        run_generator
+
+        assert_migration 'db/migrate/enable_pkce.rb' do |migration|
+          assert migration.include?("ActiveRecord::Migration[5.0]\n")
+        end
+      end
+    end
+  end
+end

data/spec/generators/previous_refresh_token_generator_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 require 'generators/doorkeeper/previous_refresh_token_generator'
 
 describe 'Doorkeeper::PreviousRefreshTokenGenerator' do

data/spec/generators/views_generator_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 require 'generators/doorkeeper/views_generator'
 
 describe Doorkeeper::Generators::ViewsGenerator do

data/spec/grape/grape_integration_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 require 'grape'
 require 'rack/test'
 require 'doorkeeper/grape/helpers'

data/spec/helpers/doorkeeper/dashboard_helper_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe Doorkeeper::DashboardHelper do
   describe '#doorkeeper_errors_for' do