doorkeeper 4.4.3 → 5.0.3

data/spec/models/doorkeeper/application_spec.rb

@@ -1,302 +1,374 @@
-require 'spec_helper_integration'
+# frozen_string_literal: true
 
-module Doorkeeper
-  describe Application do
-    let(:require_owner) { Doorkeeper.configuration.instance_variable_set('@confirm_application_owner', true) }
-    let(:unset_require_owner) { Doorkeeper.configuration.instance_variable_set('@confirm_application_owner', false) }
-    let(:new_application) { FactoryBot.build(:application) }
+require "spec_helper"
 
-    let(:uid) { SecureRandom.hex(8) }
-    let(:secret) { SecureRandom.hex(8) }
+describe Doorkeeper::Application do
+  let(:require_owner) { Doorkeeper.configuration.instance_variable_set("@confirm_application_owner", true) }
+  let(:unset_require_owner) { Doorkeeper.configuration.instance_variable_set("@confirm_application_owner", false) }
+  let(:new_application) { FactoryBot.build(:application) }
 
-    context 'application_owner is enabled' do
-      before do
-        Doorkeeper.configure do
-          orm DOORKEEPER_ORM
-          enable_application_owner
-        end
-      end
+  let(:uid) { SecureRandom.hex(8) }
+  let(:secret) { SecureRandom.hex(8) }
 
-      context 'application owner is not required' do
-        before(:each) do
-          unset_require_owner
-        end
+  it "is invalid without a name" do
+    new_application.name = nil
+    expect(new_application).not_to be_valid
+  end
 
-        it 'is valid given valid attributes' do
-          expect(new_application).to be_valid
-        end
-      end
+  it "is invalid without determining confidentiality" do
+    new_application.confidential = nil
+    expect(new_application).not_to be_valid
+  end
 
-      context 'application owner is required' do
-        before(:each) do
-          require_owner
-          @owner = FactoryBot.build_stubbed(:doorkeeper_testing_user)
-        end
+  it "generates uid on create" do
+    expect(new_application.uid).to be_nil
+    new_application.save
+    expect(new_application.uid).not_to be_nil
+  end
 
-        it 'is invalid without an owner' do
-          expect(new_application).not_to be_valid
-        end
+  it "generates uid on create if an empty string" do
+    new_application.uid = ""
+    new_application.save
+    expect(new_application.uid).not_to be_blank
+  end
 
-        it 'is valid with an owner' do
-          new_application.owner = @owner
-          expect(new_application).to be_valid
-        end
+  it "generates uid on create unless one is set" do
+    new_application.uid = uid
+    new_application.save
+    expect(new_application.uid).to eq(uid)
+  end
+
+  it "is invalid without uid" do
+    new_application.save
+    new_application.uid = nil
+    expect(new_application).not_to be_valid
+  end
+
+  it "checks uniqueness of uid" do
+    app1 = FactoryBot.create(:application)
+    app2 = FactoryBot.create(:application)
+    app2.uid = app1.uid
+    expect(app2).not_to be_valid
+  end
+
+  it "expects database to throw an error when uids are the same" do
+    app1 = FactoryBot.create(:application)
+    app2 = FactoryBot.create(:application)
+    app2.uid = app1.uid
+    expect { app2.save!(validate: false) }.to raise_error(uniqueness_error)
+  end
+
+  it "generate secret on create" do
+    expect(new_application.secret).to be_nil
+    new_application.save
+    expect(new_application.secret).not_to be_nil
+  end
+
+  it "generate secret on create if is blank string" do
+    new_application.secret = ""
+    new_application.save
+    expect(new_application.secret).not_to be_blank
+  end
+
+  it "generate secret on create unless one is set" do
+    new_application.secret = secret
+    new_application.save
+    expect(new_application.secret).to eq(secret)
+  end
+
+  it "is invalid without secret" do
+    new_application.save
+    new_application.secret = nil
+    expect(new_application).not_to be_valid
+  end
+
+  context "application_owner is enabled" do
+    before do
+      Doorkeeper.configure do
+        orm DOORKEEPER_ORM
+        enable_application_owner
       end
     end
 
-    it 'is invalid without a name' do
-      new_application.name = nil
-      expect(new_application).not_to be_valid
-    end
+    context "application owner is not required" do
+      before(:each) do
+        unset_require_owner
+      end
 
-    it 'is invalid without determining confidentiality' do
-      new_application.confidential = nil
-      expect(new_application).not_to be_valid
+      it "is valid given valid attributes" do
+        expect(new_application).to be_valid
+      end
     end
 
-    it 'generates uid on create' do
-      expect(new_application.uid).to be_nil
-      new_application.save
-      expect(new_application.uid).not_to be_nil
-    end
+    context "application owner is required" do
+      before do
+        require_owner
+        @owner = FactoryBot.build_stubbed(:doorkeeper_testing_user)
+      end
 
-    it 'generates uid on create if an empty string' do
-      new_application.uid = ''
-      new_application.save
-      expect(new_application.uid).not_to be_blank
-    end
+      it "is invalid without an owner" do
+        expect(new_application).not_to be_valid
+      end
 
-    it 'generates uid on create unless one is set' do
-      new_application.uid = uid
-      new_application.save
-      expect(new_application.uid).to eq(uid)
+      it "is valid with an owner" do
+        new_application.owner = @owner
+        expect(new_application).to be_valid
+      end
     end
+  end
 
-    it 'is invalid without uid' do
+  context "redirect URI" do
+    it "is invalid without redirect_uri" do
       new_application.save
-      new_application.uid = nil
+      new_application.redirect_uri = nil
       expect(new_application).not_to be_valid
     end
+  end
 
-    it 'is invalid without redirect_uri' do
+  describe "destroy related models on cascade" do
+    before(:each) do
       new_application.save
-      new_application.redirect_uri = nil
-      expect(new_application).not_to be_valid
     end
 
-    it 'checks uniqueness of uid' do
-      app1 = FactoryBot.create(:application)
-      app2 = FactoryBot.create(:application)
-      app2.uid = app1.uid
-      expect(app2).not_to be_valid
-    end
+    let(:resource_owner) { FactoryBot.create(:doorkeeper_testing_user) }
 
-    it 'expects database to throw an error when uids are the same' do
-      app1 = FactoryBot.create(:application)
-      app2 = FactoryBot.create(:application)
-      app2.uid = app1.uid
-      expect { app2.save!(validate: false) }.to raise_error(uniqueness_error)
-    end
+    it "should destroy its access grants" do
+      FactoryBot.create(
+        :access_grant,
+        application: new_application,
+        resource_owner_id: resource_owner.id,
+      )
 
-    it 'generate secret on create' do
-      expect(new_application.secret).to be_nil
-      new_application.save
-      expect(new_application.secret).not_to be_nil
+      expect { new_application.destroy }.to change { Doorkeeper::AccessGrant.count }.by(-1)
     end
 
-    it 'generate secret on create if is blank string' do
-      new_application.secret = ''
-      new_application.save
-      expect(new_application.secret).not_to be_blank
+    it "should destroy its access tokens" do
+      FactoryBot.create(:access_token, application: new_application)
+      FactoryBot.create(:access_token, application: new_application, revoked_at: Time.now.utc)
+      expect do
+        new_application.destroy
+      end.to change { Doorkeeper::AccessToken.count }.by(-2)
     end
+  end
 
-    it 'generate secret on create unless one is set' do
-      new_application.secret = secret
-      new_application.save
-      expect(new_application.secret).to eq(secret)
-    end
+  describe "#ordered_by" do
+    let(:applications) { FactoryBot.create_list(:application, 5) }
 
-    it 'is invalid without secret' do
-      new_application.save
-      new_application.secret = nil
-      expect(new_application).not_to be_valid
+    context "when a direction is not specified" do
+      it "calls order with a default order of asc" do
+        names = applications.map(&:name).sort
+        expect(described_class.ordered_by(:name).map(&:name)).to eq(names)
+      end
     end
 
-    describe 'destroy related models on cascade' do
-      before(:each) do
-        new_application.save
+    context "when a direction is specified" do
+      it "calls order with specified direction" do
+        names = applications.map(&:name).sort.reverse
+        expect(described_class.ordered_by(:name, :desc).map(&:name)).to eq(names)
       end
+    end
+  end
 
-      it 'should destroy its access grants' do
-        FactoryBot.create(:access_grant, application: new_application)
-        expect { new_application.destroy }.to change { Doorkeeper::AccessGrant.count }.by(-1)
+  describe "#redirect_uri=" do
+    context "when array of valid redirect_uris" do
+      it "should join by newline" do
+        new_application.redirect_uri = ["http://localhost/callback1", "http://localhost/callback2"]
+        expect(new_application.redirect_uri).to eq("http://localhost/callback1\nhttp://localhost/callback2")
       end
-
-      it 'should destroy its access tokens' do
-        FactoryBot.create(:access_token, application: new_application)
-        FactoryBot.create(:access_token, application: new_application, revoked_at: Time.now.utc)
-        expect do
-          new_application.destroy
-        end.to change { Doorkeeper::AccessToken.count }.by(-2)
+    end
+    context "when string of valid redirect_uris" do
+      it "should store as-is" do
+        new_application.redirect_uri = "http://localhost/callback1\nhttp://localhost/callback2"
+        expect(new_application.redirect_uri).to eq("http://localhost/callback1\nhttp://localhost/callback2")
       end
     end
+  end
 
-    describe :ordered_by do
-      let(:applications) { FactoryBot.create_list(:application, 5) }
+  describe "#authorized_for" do
+    let(:resource_owner) { FactoryBot.create(:doorkeeper_testing_user) }
+    let(:other_resource_owner) { FactoryBot.create(:doorkeeper_testing_user) }
 
-      context 'when a direction is not specified' do
-        it 'calls order with a default order of asc' do
-          names = applications.map(&:name).sort
-          expect(Application.ordered_by(:name).map(&:name)).to eq(names)
-        end
-      end
+    it "is empty if the application is not authorized for anyone" do
+      expect(described_class.authorized_for(resource_owner)).to be_empty
+    end
 
-      context 'when a direction is specified' do
-        it 'calls order with specified direction' do
-          names = applications.map(&:name).sort.reverse
-          expect(Application.ordered_by(:name, :desc).map(&:name)).to eq(names)
-        end
-      end
+    it "returns only application for a specific resource owner" do
+      FactoryBot.create(
+        :access_token,
+        resource_owner_id: other_resource_owner.id,
+      )
+      token = FactoryBot.create(
+        :access_token,
+        resource_owner_id: resource_owner.id,
+      )
+      expect(described_class.authorized_for(resource_owner)).to eq([token.application])
     end
 
-    describe "#redirect_uri=" do
-      context "when array of valid redirect_uris" do
-        it "should join by newline" do
-          new_application.redirect_uri = ['http://localhost/callback1', 'http://localhost/callback2']
-          expect(new_application.redirect_uri).to eq("http://localhost/callback1\nhttp://localhost/callback2")
-        end
-      end
-      context "when string of valid redirect_uris" do
-        it "should store as-is" do
-          new_application.redirect_uri = "http://localhost/callback1\nhttp://localhost/callback2"
-          expect(new_application.redirect_uri).to eq("http://localhost/callback1\nhttp://localhost/callback2")
-        end
-      end
+    it "excludes revoked tokens" do
+      FactoryBot.create(
+        :access_token,
+        resource_owner_id: resource_owner.id,
+        revoked_at: 2.days.ago,
+      )
+      expect(described_class.authorized_for(resource_owner)).to be_empty
     end
 
-    describe :authorized_for do
-      let(:resource_owner) { double(:resource_owner, id: 10) }
+    it "returns all applications that have been authorized" do
+      token1 = FactoryBot.create(
+        :access_token,
+        resource_owner_id: resource_owner.id,
+      )
+      token2 = FactoryBot.create(
+        :access_token,
+        resource_owner_id: resource_owner.id,
+      )
+      expect(described_class.authorized_for(resource_owner))
+        .to eq([token1.application, token2.application])
+    end
 
-      it 'is empty if the application is not authorized for anyone' do
-        expect(Application.authorized_for(resource_owner)).to be_empty
-      end
+    it "returns only one application even if it has been authorized twice" do
+      application = FactoryBot.create(:application)
+      FactoryBot.create(
+        :access_token,
+        resource_owner_id: resource_owner.id,
+        application: application,
+      )
+      FactoryBot.create(
+        :access_token,
+        resource_owner_id: resource_owner.id,
+        application: application,
+      )
+      expect(described_class.authorized_for(resource_owner)).to eq([application])
+    end
+  end
 
-      it 'returns only application for a specific resource owner' do
-        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id + 1)
-        token = FactoryBot.create(:access_token, resource_owner_id: resource_owner.id)
-        expect(Application.authorized_for(resource_owner)).to eq([token.application])
-      end
+  describe "#revoke_tokens_and_grants_for" do
+    it "revokes all access tokens and access grants" do
+      application_id = 42
+      resource_owner = double
+      expect(Doorkeeper::AccessToken)
+        .to receive(:revoke_all_for).with(application_id, resource_owner)
+      expect(Doorkeeper::AccessGrant)
+        .to receive(:revoke_all_for).with(application_id, resource_owner)
 
-      it 'excludes revoked tokens' do
-        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id, revoked_at: 2.days.ago)
-        expect(Application.authorized_for(resource_owner)).to be_empty
-      end
+      described_class.revoke_tokens_and_grants_for(application_id, resource_owner)
+    end
+  end
 
-      it 'returns all applications that have been authorized' do
-        token1 = FactoryBot.create(:access_token, resource_owner_id: resource_owner.id)
-        token2 = FactoryBot.create(:access_token, resource_owner_id: resource_owner.id)
-        expect(Application.authorized_for(resource_owner)).to eq([token1.application, token2.application])
+  describe "#by_uid_and_secret" do
+    context "when application is private/confidential" do
+      it "finds the application via uid/secret" do
+        app = FactoryBot.create :application
+        authenticated = described_class.by_uid_and_secret(app.uid, app.secret)
+        expect(authenticated).to eq(app)
       end
-
-      it 'returns only one application even if it has been authorized twice' do
-        application = FactoryBot.create(:application)
-        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id, application: application)
-        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id, application: application)
-        expect(Application.authorized_for(resource_owner)).to eq([application])
+      context "when secret is wrong" do
+        it "should not find the application" do
+          app = FactoryBot.create :application
+          authenticated = described_class.by_uid_and_secret(app.uid, "bad")
+          expect(authenticated).to eq(nil)
+        end
       end
     end
 
-    describe :by_uid_and_secret do
-      context "when application is private/confidential" do
-        it "finds the application via uid/secret" do
-          app = FactoryBot.create :application
-          authenticated = Application.by_uid_and_secret(app.uid, app.secret)
+    context "when application is public/non-confidential" do
+      context "when secret is blank" do
+        it "should find the application" do
+          app = FactoryBot.create :application, confidential: false
+          authenticated = described_class.by_uid_and_secret(app.uid, nil)
           expect(authenticated).to eq(app)
         end
-        context "when secret is wrong" do
-          it "should not find the application" do
-            app = FactoryBot.create :application
-            authenticated = Application.by_uid_and_secret(app.uid, 'bad')
-            expect(authenticated).to eq(nil)
-          end
-        end
       end
-
-      context "when application is public/non-confidential" do
-        context "when secret is blank" do
-          it "should find the application" do
-            app = FactoryBot.create :application, confidential: false
-            authenticated = Application.by_uid_and_secret(app.uid, nil)
-            expect(authenticated).to eq(app)
-          end
-        end
-        context "when secret is wrong" do
-          it "should not find the application" do
-            app = FactoryBot.create :application, confidential: false
-            authenticated = Application.by_uid_and_secret(app.uid, 'bad')
-            expect(authenticated).to eq(nil)
-          end
+      context "when secret is wrong" do
+        it "should not find the application" do
+          app = FactoryBot.create :application, confidential: false
+          authenticated = described_class.by_uid_and_secret(app.uid, "bad")
+          expect(authenticated).to eq(nil)
         end
       end
     end
+  end
 
-    describe :confidential? do
-      subject { FactoryBot.create(:application, confidential: confidential).confidential? }
+  describe "#confidential?" do
+    subject { FactoryBot.create(:application, confidential: confidential).confidential? }
 
-      context 'when application is private/confidential' do
-        let(:confidential) { true }
-        it { expect(subject).to eq(true) }
-      end
+    context "when application is private/confidential" do
+      let(:confidential) { true }
+      it { expect(subject).to eq(true) }
+    end
 
-      context 'when application is public/non-confidential' do
-        let(:confidential) { false }
-        it { expect(subject).to eq(false) }
-      end
+    context "when application is public/non-confidential" do
+      let(:confidential) { false }
+      it { expect(subject).to eq(false) }
     end
+  end
 
-    describe :confidential do
-      subject { FactoryBot.create(:application, confidential: confidential).confidential }
+  describe "#as_json" do
+    let(:app) { FactoryBot.create :application, secret: "123123123" }
 
-      context 'when application is private/confidential' do
-        let(:confidential) { true }
-        it { expect(subject).to eq(true) }
+    # AR specific feature
+    if DOORKEEPER_ORM == :active_record
+      it "correctly works with #to_json" do
+        ActiveRecord::Base.include_root_in_json = true
+        expect(app.to_json(include_root_in_json: true)).to match(/application.+?:\{/)
+        ActiveRecord::Base.include_root_in_json = false
       end
+    end
 
-      context 'when application is public/non-confidential' do
-        let(:confidential) { false }
-        it { expect(subject).to eq(false) }
+    context "when called without authorized resource owner" do
+      it "includes minimal set of attributes" do
+        expect(app.as_json).to match(
+          "id" => app.id,
+          "name" => app.name,
+          "created_at" => anything,
+        )
       end
 
-      context 'when the application does not support confidentiality' do
-        let(:confidential) { false }
+      it "includes application UID if it's public" do
+        app = FactoryBot.create :application, secret: "123123123", confidential: false
 
-        before { allow(Application).to receive(:supports_confidentiality?).and_return(false) }
+        expect(app.as_json).to match(
+          "id" => app.id,
+          "name" => app.name,
+          "created_at" => anything,
+          "uid" => app.uid,
+        )
+      end
 
-        it 'warns of the CVE' do
-          expect(ActiveSupport::Deprecation).to receive(:warn).with(
-            'You are susceptible to security bug ' \
-            'CVE-2018-1000211. Please follow instructions outlined in ' \
-            'Doorkeeper::CVE_2018_1000211_WARNING'
+      it "respects custom options" do
+        expect(app.as_json(except: :id)).not_to include("id")
+        expect(app.as_json(only: %i[name created_at secret]))
+          .to match(
+            "name" => app.name,
+            "created_at" => anything,
           )
-          Application.new.confidential
-        end
-
-        it { expect(subject).to eq(true) }
       end
     end
 
-    describe :supports_confidentiality? do
-      context 'when no column' do
-        it 'returns false' do
-          expect(Application).to receive(:column_names).and_return(%w[foo bar])
-          expect(Application.supports_confidentiality?).to eq(false)
+    context "when called with authorized resource owner" do
+      let(:owner) { FactoryBot.create(:doorkeeper_testing_user) }
+      let(:other_owner) { FactoryBot.create(:doorkeeper_testing_user) }
+      let(:app) { FactoryBot.create(:application, secret: "123123123", owner: owner) }
+
+      before do
+        Doorkeeper.configure do
+          orm DOORKEEPER_ORM
+          enable_application_owner confirmation: false
         end
       end
-      context 'when column' do
-        it 'returns true' do
-          expect(Application).to receive(:column_names).and_return(%w[foo bar confidential])
-          expect(Application.supports_confidentiality?).to eq(true)
-        end
+
+      it "includes all the attributes" do
+        expect(app.as_json(current_resource_owner: owner))
+          .to include(
+            "secret" => "123123123",
+            "redirect_uri" => app.redirect_uri,
+            "uid" => app.uid,
+          )
+      end
+
+      it "doesn't include unsafe attributes if current owner isn't the same as owner" do
+        expect(app.as_json(current_resource_owner: other_owner))
+          .not_to include("redirect_uri")
       end
     end
   end