doorkeeper 4.4.3 → 5.0.3

data/spec/lib/oauth/base_request_spec.rb

@@ -1,16 +1,16 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module Doorkeeper::OAuth
   describe BaseRequest do
     let(:access_token) do
       double :access_token,
-        token:              "some-token",
-        expires_in:         "3600",
-        expires_in_seconds: "300",
-        scopes_string:      "two scopes",
-        refresh_token:      "some-refresh-token",
-        token_type:         "bearer",
-        created_at:         0
+             token:              "some-token",
+             expires_in:         "3600",
+             expires_in_seconds: "300",
+             scopes_string:      "two scopes",
+             refresh_token:      "some-refresh-token",
+             token_type:         "bearer",
+             created_at:         0
     end
 
     let(:client) { double :client, id: '1' }
@@ -19,9 +19,9 @@ module Doorkeeper::OAuth
 
     let(:server) do
       double :server,
-        access_token_expires_in: 100,
-        custom_access_token_expires_in: ->(_) { nil },
-        refresh_token_enabled?: false
+             access_token_expires_in: 100,
+             custom_access_token_expires_in: ->(_context) { nil },
+             refresh_token_enabled?: false
     end
 
     subject do
@@ -105,6 +105,44 @@ module Doorkeeper::OAuth
 
         expect(result).to be_an_instance_of(Doorkeeper::AccessToken)
       end
+
+      it "respects custom_access_token_expires_in" do
+        server = double(:server,
+                        access_token_expires_in: 100,
+                        custom_access_token_expires_in: ->(context) { context.scopes == "public" ? 500 : nil },
+                        refresh_token_enabled?: false)
+        result = subject.find_or_create_access_token(
+          client,
+          "1",
+          "public",
+          server
+        )
+        expect(result.expires_in).to eql(500)
+      end
+
+      it "respects use_refresh_token with a block" do
+        server = double(:server,
+                        access_token_expires_in: 100,
+                        custom_access_token_expires_in: ->(_context) { nil },
+                        refresh_token_enabled?: lambda { |context|
+                          context.scopes == "public"
+                        })
+        result = subject.find_or_create_access_token(
+          client,
+          "1",
+          "public",
+          server
+        )
+        expect(result.refresh_token).to_not be_nil
+
+        result = subject.find_or_create_access_token(
+          client,
+          "1",
+          "private",
+          server
+        )
+        expect(result.refresh_token).to be_nil
+      end
     end
 
     describe "#scopes" do

data/spec/lib/oauth/base_response_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module Doorkeeper::OAuth
   describe BaseResponse do

data/spec/lib/oauth/client/credentials_spec.rb

@@ -1,6 +1,4 @@
 require 'spec_helper'
-require 'active_support/core_ext/string'
-require 'doorkeeper/oauth/client'
 
 class Doorkeeper::OAuth::Client
   describe Credentials do
@@ -18,7 +16,7 @@ class Doorkeeper::OAuth::Client
       let(:request) { double.as_null_object }
 
       let(:method) do
-        ->(_request) { return 'uid', 'secret' }
+        ->(_request) { %w[uid secret] }
       end
 
       it 'accepts anything that responds to #call' do
@@ -79,7 +77,7 @@ class Doorkeeper::OAuth::Client
       end
 
       it 'is blank if Authorization is not Basic' do
-        request     = double authorization: "#{credentials}"
+        request     = double authorization: credentials.to_s
         uid, secret = Credentials.from_basic(request)
 
         expect(uid).to    be_blank

data/spec/lib/oauth/client_credentials/creator_spec.rb

@@ -1,10 +1,14 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 class Doorkeeper::OAuth::ClientCredentialsRequest
   describe Creator do
     let(:client) { FactoryBot.create :application }
     let(:scopes) { Doorkeeper::OAuth::Scopes.from_string('public') }
 
+    before do
+      default_scopes_exist :public
+    end
+
     it 'creates a new token' do
       expect do
         subject.call(client, scopes)

data/spec/lib/oauth/client_credentials/issuer_spec.rb

@@ -1,6 +1,4 @@
 require 'spec_helper'
-require 'active_support/all'
-require 'doorkeeper/oauth/client_credentials/issuer'
 
 class Doorkeeper::OAuth::ClientCredentialsRequest
   describe Issuer do
@@ -9,7 +7,7 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
       double(
         :server,
         access_token_expires_in: 100,
-        custom_access_token_expires_in: ->(_app) { nil }
+        custom_access_token_expires_in: ->(_context) { nil }
       )
     end
     let(:validation) { double :validation, valid?: true }
@@ -63,23 +61,42 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
       end
 
       context 'with custom expirations' do
-        let(:custom_ttl) { 1233 }
+        let(:custom_ttl_grant) { 1234 }
+        let(:custom_ttl_scope) { 1235 }
+        let(:custom_scope) { 'special' }
         let(:server) do
           double(
             :server,
-            custom_access_token_expires_in: ->(_app) { custom_ttl }
+            custom_access_token_expires_in: lambda { |context|
+              # scopes is normally an object but is a string in this test
+              if context.scopes == custom_scope
+                custom_ttl_scope
+              elsif context.grant_type == Doorkeeper::OAuth::CLIENT_CREDENTIALS
+                custom_ttl_grant
+              end
+            }
           )
         end
 
-        it 'creates with correct token parameters' do
+        it 'respects grant based rules' do
           expect(creator).to receive(:call).with(
             client,
             scopes,
-            expires_in: custom_ttl,
+            expires_in: custom_ttl_grant,
             use_refresh_token: false
           )
           subject.create client, scopes, creator
         end
+
+        it 'respects scope based rules' do
+          expect(creator).to receive(:call).with(
+            client,
+            custom_scope,
+            expires_in: custom_ttl_scope,
+            use_refresh_token: false
+          )
+          subject.create client, custom_scope, creator
+        end
       end
     end
   end

data/spec/lib/oauth/client_credentials/validation_spec.rb

@@ -1,6 +1,4 @@
 require 'spec_helper'
-require 'active_support/all'
-require 'doorkeeper/oauth/client_credentials/validation'
 
 class Doorkeeper::OAuth::ClientCredentialsRequest
   describe Validation do
@@ -25,7 +23,8 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
         server_scopes = Doorkeeper::OAuth::Scopes.from_string 'email'
         allow(server).to receive(:scopes).and_return(server_scopes)
         allow(request).to receive(:scopes).and_return(
-          Doorkeeper::OAuth::Scopes.from_string 'invalid')
+          Doorkeeper::OAuth::Scopes.from_string('invalid')
+        )
         expect(subject).not_to be_valid
       end
 
@@ -45,7 +44,8 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
           allow(application).to receive(:scopes).and_return(application_scopes)
           allow(server).to receive(:scopes).and_return(server_scopes)
           allow(request).to receive(:scopes).and_return(
-            Doorkeeper::OAuth::Scopes.from_string 'email')
+            Doorkeeper::OAuth::Scopes.from_string('email')
+          )
           expect(subject).not_to be_valid
         end
       end

data/spec/lib/oauth/client_credentials_integration_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module Doorkeeper::OAuth
   describe ClientCredentialsRequest do
@@ -20,7 +20,7 @@ module Doorkeeper::OAuth
         request = ClientCredentialsRequest.new(server, nil, {})
         expect do
           request.authorize
-        end.to_not change { Doorkeeper::AccessToken.count }
+        end.to_not(change { Doorkeeper::AccessToken.count })
       end
     end
   end

data/spec/lib/oauth/client_credentials_request_spec.rb

@@ -1,18 +1,16 @@
 require 'spec_helper'
-require 'active_support/all'
-require 'active_model'
-require 'doorkeeper/oauth/client_credentials_request'
 
 module Doorkeeper::OAuth
   describe ClientCredentialsRequest do
     let(:server) do
       double(
         default_scopes: nil,
-        custom_access_token_expires_in: ->(_app) { nil }
+        access_token_expires_in: 2.hours,
+        custom_access_token_expires_in: ->(_context) { nil }
       )
     end
 
-    let(:application)   { double :application, scopes: Scopes.from_string('') }
+    let(:application)   { FactoryBot.create(:application, scopes: '') }
     let(:client)        { double :client, application: application }
     let(:token_creator) { double :issuer, create: true, token: double }
 

data/spec/lib/oauth/client_spec.rb

@@ -1,7 +1,4 @@
 require 'spec_helper'
-require 'active_support/core_ext/module/delegation'
-require 'active_support/core_ext/string'
-require 'doorkeeper/oauth/client'
 
 module Doorkeeper::OAuth
   describe Client do

data/spec/lib/oauth/code_request_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module Doorkeeper::OAuth
   describe CodeRequest do
@@ -10,7 +10,9 @@ module Doorkeeper::OAuth
         scopes: nil,
         state: nil,
         error: nil,
-        authorizable?: true
+        authorizable?: true,
+        code_challenge: nil,
+        code_challenge_method: nil
       )
     end
 
@@ -32,7 +34,7 @@ module Doorkeeper::OAuth
 
     it 'does not create grant when not authorizable' do
       allow(pre_auth).to receive(:authorizable?).and_return(false)
-      expect { subject.authorize }.not_to change { Doorkeeper::AccessGrant.count }
+      expect { subject.authorize }.not_to(change { Doorkeeper::AccessGrant.count })
     end
 
     it 'returns a error response' do

data/spec/lib/oauth/code_response_spec.rb

@@ -11,7 +11,7 @@ module Doorkeeper
               client: double(:application, id: 1),
               redirect_uri: 'http://tst.com/cb',
               state: nil,
-              scopes: Scopes.from_string('public'),
+              scopes: Scopes.from_string('public')
             )
           end
 

data/spec/lib/oauth/error_response_spec.rb

@@ -1,7 +1,4 @@
 require 'spec_helper'
-require 'active_model'
-require 'doorkeeper/oauth/error'
-require 'doorkeeper/oauth/error_response'
 
 module Doorkeeper::OAuth
   describe ErrorResponse do

data/spec/lib/oauth/error_spec.rb

@@ -1,6 +1,4 @@
 require 'spec_helper'
-require 'active_support/i18n'
-require 'doorkeeper/oauth/error'
 
 module Doorkeeper::OAuth
   describe Error do

data/spec/lib/oauth/forbidden_token_response_spec.rb

@@ -1,12 +1,9 @@
 require 'spec_helper'
-require 'active_model'
-require 'doorkeeper'
-require 'doorkeeper/oauth/forbidden_token_response'
 
 module Doorkeeper::OAuth
   describe ForbiddenTokenResponse do
     describe '#name' do
-      it  { expect(subject.name).to eq(:invalid_scope) }
+      it { expect(subject.name).to eq(:invalid_scope) }
     end
 
     describe '#status' do

data/spec/lib/oauth/helpers/scope_checker_spec.rb

@@ -1,7 +1,4 @@
 require 'spec_helper'
-require 'active_support/core_ext/string'
-require 'doorkeeper/oauth/helpers/scope_checker'
-require 'doorkeeper/oauth/scopes'
 
 module Doorkeeper::OAuth::Helpers
   describe ScopeChecker, '.valid?' do
@@ -46,18 +43,18 @@ module Doorkeeper::OAuth::Helpers
 
       it 'is valid if scope is included in the application scope list' do
         expect(ScopeChecker.valid?(
-          'app123',
-          server_scopes,
-          application_scopes
-        )).to be_truthy
+                 'app123',
+                 server_scopes,
+                 application_scopes
+               )).to be_truthy
       end
 
       it 'is invalid if any scope is not included in the application' do
         expect(ScopeChecker.valid?(
-          'svr',
-          server_scopes,
-          application_scopes
-        )).to be_falsey
+                 'svr',
+                 server_scopes,
+                 application_scopes
+               )).to be_falsey
       end
     end
   end

data/spec/lib/oauth/helpers/unique_token_spec.rb

@@ -1,5 +1,4 @@
 require 'spec_helper'
-require 'doorkeeper/oauth/helpers/unique_token'
 
 module Doorkeeper::OAuth::Helpers
   describe UniqueToken do

data/spec/lib/oauth/helpers/uri_checker_spec.rb

@@ -1,15 +1,8 @@
 require 'spec_helper'
-require 'uri'
-require 'doorkeeper/oauth/helpers/uri_checker'
 
 module Doorkeeper::OAuth::Helpers
   describe URIChecker do
     describe '.valid?' do
-      it 'is valid for native uris' do
-        uri = 'urn:ietf:wg:oauth:2.0:oob'
-        expect(URIChecker.valid?(uri)).to be_truthy
-      end
-
       it 'is valid for valid uris' do
         uri = 'http://app.co'
         expect(URIChecker.valid?(uri)).to be_truthy
@@ -49,6 +42,11 @@ module Doorkeeper::OAuth::Helpers
         uri = '   '
         expect(URIChecker.valid?(uri)).to be_falsey
       end
+
+      it 'is valid for native uris' do
+        uri = 'urn:ietf:wg:oauth:2.0:oob'
+        expect(URIChecker.valid?(uri)).to be_truthy
+      end
     end
 
     describe '.matches?' do
@@ -118,6 +116,22 @@ module Doorkeeper::OAuth::Helpers
       it 'is true if valid and matches' do
         uri = client_uri = 'http://app.co/aaa'
         expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_truthy
+
+        uri = client_uri = 'http://app.co/aaa?b=c'
+        expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_truthy
+      end
+
+      it 'is true if uri includes blank query' do
+        uri = client_uri = 'http://app.co/aaa?'
+        expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_truthy
+
+        uri = 'http://app.co/aaa?'
+        client_uri = 'http://app.co/aaa'
+        expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_truthy
+
+        uri = 'http://app.co/aaa'
+        client_uri = 'http://app.co/aaa?'
+        expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_truthy
       end
 
       it 'is false if valid and mismatches' do
@@ -138,12 +152,7 @@ module Doorkeeper::OAuth::Helpers
         expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_falsey
       end
 
-      it 'is true if valid and matches' do
-        uri = client_uri = 'http://app.co/aaa'
-        expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be true
-      end
-
-      it 'is false if invalid' do
+      it 'is false if queries does not match' do
         uri = 'http://app.co/aaa?pankcakes=abc'
         client_uri = 'http://app.co/aaa?waffles=abc'
         expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be false

data/spec/lib/oauth/invalid_token_response_spec.rb

@@ -1,12 +1,9 @@
 require 'spec_helper'
-require 'active_model'
-require 'doorkeeper'
-require 'doorkeeper/oauth/invalid_token_response'
 
 module Doorkeeper::OAuth
   describe InvalidTokenResponse do
     describe "#name" do
-      it  { expect(subject.name).to eq(:invalid_token) }
+      it { expect(subject.name).to eq(:invalid_token) }
     end
 
     describe "#status" do

data/spec/lib/oauth/password_access_token_request_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module Doorkeeper::OAuth
   describe PasswordAccessTokenRequest do
@@ -8,7 +8,9 @@ module Doorkeeper::OAuth
         default_scopes: Doorkeeper::OAuth::Scopes.new,
         access_token_expires_in: 2.hours,
         refresh_token_enabled?: false,
-        custom_access_token_expires_in: ->(_app) { nil }
+        custom_access_token_expires_in: lambda { |context|
+          context.grant_type == Doorkeeper::OAuth::PASSWORD ? 1234 : nil
+        }
       )
     end
     let(:client) { FactoryBot.create(:application) }
@@ -22,6 +24,8 @@ module Doorkeeper::OAuth
       expect do
         subject.authorize
       end.to change { client.reload.access_tokens.count }.by(1)
+
+      expect(client.reload.access_tokens.max_by(&:created_at).expires_in).to eq(1234)
     end
 
     it 'issues a new token without a client' do
@@ -36,7 +40,7 @@ module Doorkeeper::OAuth
         subject.client = nil
         subject.parameters = { client_id: 'bad_id' }
         subject.authorize
-      end.to_not change { Doorkeeper::AccessToken.count }
+      end.not_to(change { Doorkeeper::AccessToken.count })
 
       expect(subject.error).to eq(:invalid_client)
     end
@@ -54,6 +58,7 @@ module Doorkeeper::OAuth
 
     it 'creates token even when there is already one (default)' do
       FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
+
       expect do
         subject.authorize
       end.to change { Doorkeeper::AccessToken.count }.by(1)
@@ -62,14 +67,19 @@ module Doorkeeper::OAuth
     it 'skips token creation if there is already one' do
       allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
       FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
+
       expect do
         subject.authorize
-      end.to_not change { Doorkeeper::AccessToken.count }
+      end.not_to(change { Doorkeeper::AccessToken.count })
     end
 
     it "calls configured request callback methods" do
-      expect(Doorkeeper.configuration.before_successful_strategy_response).to receive(:call).with(subject).once
-      expect(Doorkeeper.configuration.after_successful_strategy_response).to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
+      expect(Doorkeeper.configuration.before_successful_strategy_response)
+        .to receive(:call).with(subject).once
+
+      expect(Doorkeeper.configuration.after_successful_strategy_response)
+        .to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
+
       subject.authorize
     end
 
@@ -89,8 +99,45 @@ module Doorkeeper::OAuth
         expect do
           subject.authorize
         end.to change { Doorkeeper::AccessToken.count }.by(1)
+
         expect(Doorkeeper::AccessToken.last.scopes).to include('public')
       end
     end
+
+    describe 'with custom expiry' do
+      let(:server) do
+        double(
+          :server,
+          default_scopes: Doorkeeper::OAuth::Scopes.new,
+          access_token_expires_in: 2.hours,
+          refresh_token_enabled?: false,
+          custom_access_token_expires_in: lambda { |context|
+            context.scopes.exists?('public') ? 222 : nil
+          }
+        )
+      end
+
+      it 'checks scopes' do
+        subject = PasswordAccessTokenRequest.new(server, client, owner, scope: 'public')
+        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('public'))
+
+        expect do
+          subject.authorize
+        end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+        expect(Doorkeeper::AccessToken.last.expires_in).to eq(222)
+      end
+
+      it 'falls back to the default otherwise' do
+        subject = PasswordAccessTokenRequest.new(server, client, owner, scope: 'private')
+        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('private'))
+
+        expect do
+          subject.authorize
+        end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+        expect(Doorkeeper::AccessToken.last.expires_in).to eq(2.hours)
+      end
+    end
   end
 end

data/spec/lib/oauth/pre_authorization_spec.rb

@@ -1,13 +1,13 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module Doorkeeper::OAuth
   describe PreAuthorization do
-    let(:server) {
+    let(:server) do
       server = Doorkeeper.configuration
       allow(server).to receive(:default_scopes).and_return(Scopes.new)
       allow(server).to receive(:scopes).and_return(Scopes.from_string('public profile'))
       server
-    }
+    end
 
     let(:application) do
       application = double :application
@@ -133,11 +133,16 @@ module Doorkeeper::OAuth
       end
 
       it 'invalidates redirect_uri when it does\'n match with the client' do
-        subject.redirect_uri = native_redirect_uri
+        subject.redirect_uri = 'urn:ietf:wg:oauth:2.0:oob'
         expect(subject).not_to be_authorizable
       end
     end
 
+    it 'matches the redirect uri against client\'s one' do
+      subject.redirect_uri = 'http://nothesame.com'
+      expect(subject).not_to be_authorizable
+    end
+
     it 'stores the state' do
       expect(subject.state).to eq('save-this')
     end
@@ -156,5 +161,29 @@ module Doorkeeper::OAuth
       subject.redirect_uri = nil
       expect(subject).not_to be_authorizable
     end
+
+    describe "as_json" do
+      let(:client_id) { "client_uid_123" }
+      let(:client_name) { "Acme Co." }
+
+      before do
+        allow(client).to receive(:uid).and_return client_id
+        allow(client).to receive(:name).and_return client_name
+      end
+
+      let(:json) { subject.as_json({}) }
+
+      it { is_expected.to respond_to :as_json }
+
+      it "returns correct values" do
+        expect(json[:client_id]).to eq client_id
+        expect(json[:redirect_uri]).to eq subject.redirect_uri
+        expect(json[:state]).to eq subject.state
+        expect(json[:response_type]).to eq subject.response_type
+        expect(json[:scope]).to eq subject.scope
+        expect(json[:client_name]).to eq client_name
+        expect(json[:status]).to eq I18n.t('doorkeeper.pre_authorization.status')
+      end
+    end
   end
 end