doorkeeper 4.4.3 → 5.0.3

data/spec/lib/oauth/refresh_token_request_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module Doorkeeper::OAuth
   describe RefreshTokenRequest do
@@ -9,7 +9,7 @@ module Doorkeeper::OAuth
     let(:server) do
       double :server,
              access_token_expires_in: 2.minutes,
-             custom_access_token_expires_in: -> (_oauth_client) { nil }
+             custom_access_token_expires_in: ->(_context) { nil }
     end
 
     let(:refresh_token) do
@@ -24,20 +24,22 @@ module Doorkeeper::OAuth
     it 'issues a new token for the client' do
       expect { subject.authorize }.to change { client.reload.access_tokens.count }.by(1)
       # #sort_by used for MongoDB ORM extensions for valid ordering
-      expect(client.reload.access_tokens.sort_by(&:created_at).last.expires_in).to eq(120)
+      expect(client.reload.access_tokens.max_by(&:created_at).expires_in).to eq(120)
     end
 
     it 'issues a new token for the client with custom expires_in' do
       server = double :server,
                       access_token_expires_in: 2.minutes,
-                      custom_access_token_expires_in: ->(_oauth_client) { 1234 }
+                      custom_access_token_expires_in: lambda { |context|
+                        context.grant_type == Doorkeeper::OAuth::REFRESH_TOKEN ? 1234 : nil
+                      }
 
       allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(false)
 
       RefreshTokenRequest.new(server, refresh_token, credentials).authorize
 
       # #sort_by used for MongoDB ORM extensions for valid ordering
-      expect(client.reload.access_tokens.sort_by(&:created_at).last.expires_in).to eq(1234)
+      expect(client.reload.access_tokens.max_by(&:created_at).expires_in).to eq(1234)
     end
 
     it 'revokes the previous token' do
@@ -45,8 +47,12 @@ module Doorkeeper::OAuth
     end
 
     it "calls configured request callback methods" do
-      expect(Doorkeeper.configuration.before_successful_strategy_response).to receive(:call).with(subject).once
-      expect(Doorkeeper.configuration.after_successful_strategy_response).to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
+      expect(Doorkeeper.configuration.before_successful_strategy_response)
+        .to receive(:call).with(subject).once
+
+      expect(Doorkeeper.configuration.after_successful_strategy_response)
+        .to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
+
       subject.authorize
     end
 
@@ -85,7 +91,9 @@ module Doorkeeper::OAuth
       let(:server) do
         double :server,
                access_token_expires_in: 2.minutes,
-               custom_access_token_expires_in: ->(_oauth_client) { 1234 }
+               custom_access_token_expires_in: lambda { |context|
+                 context.grant_type == Doorkeeper::OAuth::REFRESH_TOKEN ? 1234 : nil
+               }
       end
 
       before do
@@ -105,7 +113,7 @@ module Doorkeeper::OAuth
         subject.authorize
         expect(
           # #sort_by used for MongoDB ORM extensions for valid ordering
-          client.access_tokens.sort_by(&:created_at).last.previous_refresh_token
+          client.access_tokens.max_by(&:created_at).previous_refresh_token
         ).to eq(refresh_token.refresh_token)
       end
     end
@@ -123,21 +131,21 @@ module Doorkeeper::OAuth
     context 'with scopes' do
       let(:refresh_token) do
         FactoryBot.create :access_token,
-                           use_refresh_token: true,
-                           scopes: 'public write'
+                          use_refresh_token: true,
+                          scopes: 'public write'
       end
       let(:parameters) { {} }
       subject { RefreshTokenRequest.new server, refresh_token, credentials, parameters }
 
       it 'transfers scopes from the old token to the new token' do
         subject.authorize
-        expect(Doorkeeper::AccessToken.last.scopes).to eq([:public, :write])
+        expect(Doorkeeper::AccessToken.last.scopes).to eq(%i[public write])
       end
 
       it 'reduces scopes to the provided scopes' do
         parameters[:scopes] = 'public'
         subject.authorize
-        expect(Doorkeeper::AccessToken.last.scopes).to eq([:public])
+        expect(Doorkeeper::AccessToken.last.scopes).to eq(%i[public])
       end
 
       it 'validates that scopes are included in the original access token' do
@@ -151,7 +159,7 @@ module Doorkeeper::OAuth
         parameters[:scopes] = 'public update'
         parameters[:scope] = 'public'
         subject.authorize
-        expect(Doorkeeper::AccessToken.last.scopes).to eq([:public])
+        expect(Doorkeeper::AccessToken.last.scopes).to eq(%i[public])
       end
 
       it 'uses params[:scope] in favor of scopes if present (invalid)' do

data/spec/lib/oauth/scopes_spec.rb

@@ -1,7 +1,4 @@
 require 'spec_helper'
-require 'active_support/core_ext/module/delegation'
-require 'active_support/core_ext/string'
-require 'doorkeeper/oauth/scopes'
 
 module Doorkeeper::OAuth
   describe Scopes do

data/spec/lib/oauth/token_request_spec.rb

@@ -1,10 +1,9 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module Doorkeeper::OAuth
   describe TokenRequest do
     let :application do
-      scopes = double(all: ['public'])
-      double(:application, id: 9990, scopes: scopes)
+      FactoryBot.create(:application, scopes: 'public')
     end
 
     let :pre_auth do
@@ -39,7 +38,7 @@ module Doorkeeper::OAuth
 
     it 'does not create token when not authorizable' do
       allow(pre_auth).to receive(:authorizable?).and_return(false)
-      expect { subject.authorize }.not_to change { Doorkeeper::AccessToken.count }
+      expect { subject.authorize }.not_to(change { Doorkeeper::AccessToken.count })
     end
 
     it 'returns a error response' do
@@ -51,8 +50,8 @@ module Doorkeeper::OAuth
       before do
         Doorkeeper.configure do
           orm DOORKEEPER_ORM
-          custom_access_token_expires_in do |_oauth_client|
-            1234
+          custom_access_token_expires_in do |context|
+            context.grant_type == Doorkeeper::OAuth::IMPLICIT ? 1234 : nil
           end
         end
       end
@@ -75,7 +74,7 @@ module Doorkeeper::OAuth
       it 'creates a new token if scopes do not match' do
         allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
         FactoryBot.create(:access_token, application_id: pre_auth.client.id,
-                           resource_owner_id: owner.id, scopes: '')
+                                         resource_owner_id: owner.id, scopes: '')
         expect do
           subject.authorize
         end.to change { Doorkeeper::AccessToken.count }.by(1)
@@ -87,9 +86,9 @@ module Doorkeeper::OAuth
         allow(application.scopes).to receive(:all?).and_return(true)
 
         FactoryBot.create(:access_token, application_id: pre_auth.client.id,
-                           resource_owner_id: owner.id, scopes: 'public')
+                                         resource_owner_id: owner.id, scopes: 'public')
 
-        expect { subject.authorize }.not_to change { Doorkeeper::AccessToken.count }
+        expect { subject.authorize }.not_to(change { Doorkeeper::AccessToken.count })
       end
     end
   end

data/spec/lib/oauth/token_response_spec.rb

@@ -1,5 +1,4 @@
 require 'spec_helper'
-require 'doorkeeper/oauth/token_response'
 
 module Doorkeeper::OAuth
   describe TokenResponse do

data/spec/lib/oauth/token_spec.rb

@@ -1,6 +1,4 @@
 require 'spec_helper'
-require 'active_support/core_ext/string'
-require 'doorkeeper/oauth/token'
 
 module Doorkeeper
   unless defined?(AccessToken)
@@ -14,7 +12,7 @@ module Doorkeeper
         let(:request) { double.as_null_object }
 
         let(:method) do
-          ->(request) { return 'token-value' }
+          ->(*) { 'token-value' }
         end
 
         it 'accepts anything that responds to #call' do
@@ -96,19 +94,47 @@ module Doorkeeper
       end
 
       describe :authenticate do
-        it 'calls the finder if token was returned' do
-          token = ->(_r) { 'token' }
-          expect(AccessToken).to receive(:by_token).with('token')
-          Token.authenticate double, token
+        context 'refresh tokens are disabled (default)' do
+          context 'refresh tokens are enabled' do
+            it 'does not revoke previous refresh_token if token was found' do
+              token = ->(_r) { 'token' }
+              expect(
+                AccessToken
+              ).to receive(:by_token).with('token').and_return(token)
+              expect(token).not_to receive(:revoke_previous_refresh_token!)
+              Token.authenticate double, token
+            end
+          end
+
+          it 'calls the finder if token was returned' do
+            token = ->(_r) { 'token' }
+            expect(AccessToken).to receive(:by_token).with('token')
+            Token.authenticate double, token
+          end
         end
 
-        it 'revokes previous refresh_token if token was found' do
-          token = ->(_r) { 'token' }
-          expect(
-            AccessToken
-          ).to receive(:by_token).with('token').and_return(token)
-          expect(token).to receive(:revoke_previous_refresh_token!)
-          Token.authenticate double, token
+        context 'refresh tokens are enabled' do
+          before do
+            Doorkeeper.configure do
+              orm DOORKEEPER_ORM
+              use_refresh_token
+            end
+          end
+
+          it 'revokes previous refresh_token if token was found' do
+            token = ->(_r) { 'token' }
+            expect(
+              AccessToken
+            ).to receive(:by_token).with('token').and_return(token)
+            expect(token).to receive(:revoke_previous_refresh_token!)
+            Token.authenticate double, token
+          end
+
+          it 'calls the finder if token was returned' do
+            token = ->(_r) { 'token' }
+            expect(AccessToken).to receive(:by_token).with('token')
+            Token.authenticate double, token
+          end
         end
       end
     end

data/spec/lib/request/strategy_spec.rb

@@ -1,5 +1,4 @@
 require 'spec_helper'
-require 'doorkeeper/request/strategy'
 
 module Doorkeeper
   module Request

data/spec/lib/server_spec.rb

@@ -22,9 +22,9 @@ describe Doorkeeper::Server do
 
     context 'when only Authorization Code strategy is enabled' do
       before do
-        allow(Doorkeeper.configuration).
-          to receive(:grant_flows).
-          and_return(['authorization_code'])
+        allow(Doorkeeper.configuration)
+          .to receive(:grant_flows)
+          .and_return(['authorization_code'])
       end
 
       it 'raises error when using the disabled Implicit strategy' do
@@ -46,10 +46,10 @@ describe Doorkeeper::Server do
       subject.authorization_request :code
     end
 
-    it 'builds the request with composit strategy name' do
-      allow(Doorkeeper.configuration).
-        to receive(:authorization_response_types).
-        and_return(['id_token token'])
+    it 'builds the request with composite strategy name' do
+      allow(Doorkeeper.configuration)
+        .to receive(:authorization_response_types)
+        .and_return(['id_token token'])
 
       stub_const 'Doorkeeper::Request::IdTokenToken', fake_class
       expect(fake_class).to receive(:new).with(subject)

data/spec/lib/stale_records_cleaner_spec.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Doorkeeper::StaleRecordsCleaner do
+  let(:cleaner) { described_class.new(model) }
+  let(:models_by_name) do
+    {
+      access_token: Doorkeeper::AccessToken,
+      access_grant: Doorkeeper::AccessGrant
+    }
+  end
+
+  context 'when ORM has no cleaner class' do
+    it 'raises an error' do
+      allow_any_instance_of(Doorkeeper::Config).to receive(:orm).and_return('hibernate')
+
+      expect do
+        described_class.for(Doorkeeper::AccessToken)
+      end.to raise_error(Doorkeeper::Errors::NoOrmCleaner, /has no cleaner/)
+    end
+  end
+
+  %i[access_token access_grant].each do |model_name|
+    context "(#{model_name})" do
+      let(:model) { models_by_name.fetch(model_name) }
+
+      describe '#clean_revoked' do
+        subject { cleaner.clean_revoked }
+
+        context 'with revoked record' do
+          before do
+            FactoryBot.create model_name, revoked_at: Time.current - 1.minute
+          end
+
+          it 'removes the record' do
+            expect { subject }.to change { model.count }.to(0)
+          end
+        end
+
+        context 'with record revoked in the future' do
+          before do
+            FactoryBot.create model_name, revoked_at: Time.current + 1.minute
+          end
+
+          it 'keeps the record' do
+            expect { subject }.not_to(change { model.count })
+          end
+        end
+
+        context 'with unrevoked record' do
+          before do
+            FactoryBot.create model_name, revoked_at: nil
+          end
+
+          it 'keeps the record' do
+            expect { subject }.not_to(change { model.count })
+          end
+        end
+      end
+
+      describe '#clean_expired' do
+        subject { cleaner.clean_expired(ttl) }
+        let(:ttl) { 500 }
+        let(:expiry_border) { ttl.seconds.ago }
+
+        context 'with record that is expired' do
+          before do
+            FactoryBot.create model_name, created_at: expiry_border - 1.minute
+          end
+
+          it 'removes the record' do
+            expect { subject }.to change { model.count }.to(0)
+          end
+        end
+
+        context 'with record that is not expired' do
+          before do
+            FactoryBot.create model_name, created_at: expiry_border + 1.minute
+          end
+
+          it 'keeps the record' do
+            expect { subject }.not_to(change { model.count })
+          end
+        end
+      end
+    end
+  end
+end

data/spec/models/doorkeeper/access_grant_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe Doorkeeper::AccessGrant do
   subject { FactoryBot.build(:access_grant) }
@@ -33,4 +33,47 @@ describe Doorkeeper::AccessGrant do
       expect(subject).not_to be_valid
     end
   end
+
+  describe '.revoke_all_for' do
+    let(:resource_owner) { double(id: 100) }
+    let(:application) { FactoryBot.create :application }
+    let(:default_attributes) do
+      {
+        application: application,
+        resource_owner_id: resource_owner.id
+      }
+    end
+
+    it 'revokes all tokens for given application and resource owner' do
+      FactoryBot.create :access_grant, default_attributes
+
+      described_class.revoke_all_for(application.id, resource_owner)
+
+      described_class.all.each do |token|
+        expect(token).to be_revoked
+      end
+    end
+
+    it 'matches application' do
+      access_grant_for_different_app = FactoryBot.create(
+        :access_grant,
+        default_attributes.merge(application: FactoryBot.create(:application))
+      )
+
+      described_class.revoke_all_for(application.id, resource_owner)
+
+      expect(access_grant_for_different_app.reload).not_to be_revoked
+    end
+
+    it 'matches resource owner' do
+      access_grant_for_different_owner = FactoryBot.create(
+        :access_grant,
+        default_attributes.merge(resource_owner_id: 90)
+      )
+
+      described_class.revoke_all_for application.id, resource_owner
+
+      expect(access_grant_for_different_owner.reload).not_to be_revoked
+    end
+  end
 end

data/spec/models/doorkeeper/access_token_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 module Doorkeeper
   describe AccessToken do
@@ -13,8 +13,7 @@ module Doorkeeper
     end
 
     module CustomGeneratorArgs
-      def self.generate
-      end
+      def self.generate; end
     end
 
     describe :generate_token do
@@ -42,7 +41,7 @@ module Doorkeeper
         end
 
         token = FactoryBot.create :access_token
-        expect(token.token).to match(%r{custom_generator_token_\d+})
+        expect(token.token).to match(/custom_generator_token_\d+/)
       end
 
       it 'allows the custom generator to access the application details' do
@@ -62,7 +61,7 @@ module Doorkeeper
         end
 
         token = FactoryBot.create :access_token
-        expect(token.token).to match(%r{custom_generator_token_Application \d+})
+        expect(token.token).to match(/custom_generator_token_Application \d+/)
       end
 
       it 'allows the custom generator to access the scopes' do
@@ -144,7 +143,7 @@ module Doorkeeper
         end
 
         module CustomGeneratorArgs
-          def self.generate(opts = {})
+          def self.generate(_opts = {})
             raise LoadError, 'custom behaviour'
           end
         end
@@ -214,11 +213,9 @@ module Doorkeeper
     end
 
     describe '#same_credential?' do
-
       context 'with default parameters' do
-
         let(:resource_owner_id) { 100 }
-        let(:application)    { FactoryBot.create :application }
+        let(:application) { FactoryBot.create :application }
         let(:default_attributes) do
           { application: application, resource_owner_id: resource_owner_id }
         end
@@ -233,7 +230,11 @@ module Doorkeeper
 
         context 'the second token has same owner and different app' do
           let(:other_application) { FactoryBot.create :application }
-          let(:access_token2) { FactoryBot.create :access_token, application: other_application, resource_owner_id: resource_owner_id }
+          let(:access_token2) do
+            FactoryBot.create :access_token,
+                              application: other_application,
+                              resource_owner_id: resource_owner_id
+          end
 
           it 'fail' do
             expect(access_token1.same_credential?(access_token2)).to be_falsey
@@ -241,9 +242,10 @@ module Doorkeeper
         end
 
         context 'the second token has different owner and different app' do
-
           let(:other_application) { FactoryBot.create :application }
-          let(:access_token2) { FactoryBot.create :access_token, application: other_application, resource_owner_id: 42 }
+          let(:access_token2) do
+            FactoryBot.create :access_token, application: other_application, resource_owner_id: 42
+          end
 
           it 'fail' do
             expect(access_token1.same_credential?(access_token2)).to be_falsey
@@ -251,7 +253,9 @@ module Doorkeeper
         end
 
         context 'the second token has different owner and same app' do
-          let(:access_token2) { FactoryBot.create :access_token, application: application, resource_owner_id: 42 }
+          let(:access_token2) do
+            FactoryBot.create :access_token, application: application, resource_owner_id: 42
+          end
 
           it 'fail' do
             expect(access_token1.same_credential?(access_token2)).to be_falsey
@@ -306,15 +310,25 @@ module Doorkeeper
       end
 
       it 'matches application' do
-        FactoryBot.create :access_token, default_attributes.merge(application: FactoryBot.create(:application))
+        access_token_for_different_app = FactoryBot.create(
+          :access_token,
+          default_attributes.merge(application: FactoryBot.create(:application))
+        )
+
         AccessToken.revoke_all_for application.id, resource_owner
-        expect(AccessToken.all).not_to be_empty
+
+        expect(access_token_for_different_app.reload).not_to be_revoked
       end
 
       it 'matches resource owner' do
-        FactoryBot.create :access_token, default_attributes.merge(resource_owner_id: 90)
+        access_token_for_different_owner = FactoryBot.create(
+          :access_token,
+          default_attributes.merge(resource_owner_id: 90)
+        )
+
         AccessToken.revoke_all_for application.id, resource_owner
-        expect(AccessToken.all).not_to be_empty
+
+        expect(access_token_for_different_owner.reload).not_to be_revoked
       end
     end
 
@@ -330,6 +344,10 @@ module Doorkeeper
         }
       end
 
+      before do
+        default_scopes_exist(*scopes.all)
+      end
+
       it 'returns only one token' do
         token = FactoryBot.create :access_token, default_attributes
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
@@ -355,37 +373,45 @@ module Doorkeeper
         expect(last_token).to be_nil
       end
 
-      it 'matches the application' do
+      it "excludes tokens with a different application" do
         FactoryBot.create :access_token, default_attributes.merge(application: FactoryBot.create(:application))
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to be_nil
       end
 
-      it 'matches the resource owner' do
+      it "excludes tokens with a different resource owner" do
         FactoryBot.create :access_token, default_attributes.merge(resource_owner_id: 2)
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to be_nil
       end
 
-      it 'matches token with fewer scopes' do
+      it "excludes tokens with fewer scopes" do
         FactoryBot.create :access_token, default_attributes.merge(scopes: 'public')
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to be_nil
       end
 
-      it 'matches token with different scopes' do
+      it 'excludes tokens with different scopes' do
         FactoryBot.create :access_token, default_attributes.merge(scopes: 'public email')
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to be_nil
       end
 
-      it 'matches token with more scopes' do
+      it 'excludes tokens with additional scopes' do
         FactoryBot.create :access_token, default_attributes.merge(scopes: 'public write email')
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to be_nil
       end
 
-      it 'matches application scopes' do
+      it 'excludes tokens with scopes that are not present in server scopes' do
+        FactoryBot.create :access_token, default_attributes.merge(
+          application: application, scopes: 'public read'
+        )
+        last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
+        expect(last_token).to be_nil
+      end
+
+      it 'excludes tokens with scopes that are not present in application scopes' do
         application = FactoryBot.create :application, scopes: "private read"
         FactoryBot.create :access_token, default_attributes.merge(
           application: application
@@ -394,25 +420,47 @@ module Doorkeeper
         expect(last_token).to be_nil
       end
 
-      it 'returns the last created token' do
+      it 'does not match token if empty scope requested and token/app scopes present' do
+        application = FactoryBot.create :application, scopes: "sample:scope"
+        app_params = {
+          application_id: application.id, scopes: "sample:scope",
+          resource_owner_id: 100
+        }
+        FactoryBot.create :access_token, app_params
+        empty_scopes = Doorkeeper::OAuth::Scopes.from_string("")
+        last_token = AccessToken.matching_token_for(application, 100, empty_scopes)
+        expect(last_token).to be_nil
+      end
+
+      it 'matches token if empty scope requested and no token scopes present' do
+        empty_scopes = Doorkeeper::OAuth::Scopes.from_string("")
+        token = FactoryBot.create :access_token, default_attributes.merge(scopes: empty_scopes)
+        last_token = AccessToken.matching_token_for(application, 100, empty_scopes)
+        expect(last_token).to eq(token)
+      end
+
+      it 'returns the last matching token' do
         FactoryBot.create :access_token, default_attributes.merge(created_at: 1.day.ago)
-        token = FactoryBot.create :access_token, default_attributes
+        matching_token = FactoryBot.create :access_token, default_attributes
+        FactoryBot.create :access_token, default_attributes.merge(scopes: 'public')
+
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
-        expect(last_token).to eq(token)
+        expect(last_token).to eq(matching_token)
       end
+    end
 
-      it 'returns as_json hash' do
-        token = FactoryBot.create :access_token, default_attributes
+    describe "#as_json" do
+      it "returns as_json hash" do
+        token = FactoryBot.create :access_token
         token_hash = {
           resource_owner_id:  token.resource_owner_id,
-          scopes:             token.scopes,
-          expires_in_seconds: token.expires_in_seconds,
+          scope:              token.scopes,
+          expires_in:         token.expires_in_seconds,
           application:        { uid: token.application.uid },
-          created_at:         token.created_at.to_i,
+          created_at:         token.created_at.to_i
         }
         expect(token.as_json).to eq token_hash
       end
     end
-
   end
 end