doorkeeper 4.4.3 → 5.5.2

data/spec/controllers/token_info_controller_spec.rb

@@ -1,56 +0,0 @@
-require 'spec_helper_integration'
-
-describe Doorkeeper::TokenInfoController do
-  describe 'when requesting token info with valid token' do
-    let(:doorkeeper_token) { FactoryBot.create(:access_token) }
-
-    before(:each) do
-      allow(controller).to receive(:doorkeeper_token) { doorkeeper_token }
-    end
-
-    describe 'successful request' do
-      it 'responds with tokeninfo' do
-        get :show
-
-        expect(response.body).to eq(doorkeeper_token.to_json)
-      end
-
-      it 'responds with a 200 status' do
-        get :show
-
-        expect(response.status).to eq 200
-      end
-    end
-
-    describe 'invalid token response' do
-      before(:each) do
-        allow(controller).to receive(:doorkeeper_token).and_return(nil)
-      end
-
-      it 'responds with 401 when doorkeeper_token is not valid' do
-        get :show
-
-        expect(response.status).to eq 401
-        expect(response.headers['WWW-Authenticate']).to match(/^Bearer/)
-      end
-
-      it 'responds with 401 when doorkeeper_token is invalid, expired or revoked' do
-        allow(controller).to receive(:doorkeeper_token).and_return(doorkeeper_token)
-        allow(doorkeeper_token).to receive(:accessible?).and_return(false)
-
-        get :show
-
-        expect(response.status).to eq 401
-        expect(response.headers['WWW-Authenticate']).to match(/^Bearer/)
-      end
-
-      it 'responds body message for error' do
-        get :show
-
-        expect(response.body).to eq(
-          Doorkeeper::OAuth::ErrorResponse.new(name: :invalid_request, status: :unauthorized).body.to_json
-        )
-      end
-    end
-  end
-end

data/spec/controllers/tokens_controller_spec.rb

@@ -1,274 +0,0 @@
-require 'spec_helper_integration'
-
-describe Doorkeeper::TokensController do
-  describe 'when authorization has succeeded' do
-    let(:token) { double(:token, authorize: true) }
-
-    before do
-      allow(controller).to receive(:token) { token }
-    end
-
-    it 'returns the authorization' do
-      skip 'verify need of these specs'
-
-      expect(token).to receive(:authorization)
-
-      post :create
-    end
-  end
-
-  describe 'when authorization has failed' do
-    it 'returns the error response' do
-      token = double(:token, authorize: false)
-      allow(controller).to receive(:token) { token }
-
-      post :create
-
-      expect(response.status).to eq 401
-      expect(response.headers['WWW-Authenticate']).to match(/Bearer/)
-    end
-  end
-
-  describe 'when there is a failure due to a custom error' do
-    it 'returns the error response with a custom message' do
-      # I18n looks for `doorkeeper.errors.messages.custom_message` in locale files
-      custom_message = "my_message"
-      allow(I18n).to receive(:translate).
-        with(
-          custom_message,
-          hash_including(scope: %i[doorkeeper errors messages]),
-        ).
-        and_return('Authorization custom message')
-
-      doorkeeper_error = Doorkeeper::Errors::DoorkeeperError.new(custom_message)
-
-      strategy = double(:strategy)
-      request = double(token_request: strategy)
-      allow(strategy).to receive(:authorize).and_raise(doorkeeper_error)
-      allow(controller).to receive(:server).and_return(request)
-
-      post :create
-
-      expected_response_body = {
-        "error"             => custom_message,
-        "error_description" => "Authorization custom message"
-      }
-      expect(response.status).to eq 401
-      expect(response.headers['WWW-Authenticate']).to match(/Bearer/)
-      expect(JSON.parse(response.body)).to eq expected_response_body
-    end
-  end
-
-  # http://tools.ietf.org/html/rfc7009#section-2.2
-  describe 'revoking tokens' do
-    let(:client) { FactoryBot.create(:application) }
-    let(:access_token) { FactoryBot.create(:access_token, application: client) }
-
-    before(:each) do
-      allow(controller).to receive(:token) { access_token }
-    end
-
-    context 'when associated app is public' do
-      let(:client) { FactoryBot.create(:application, confidential: false) }
-
-      it 'returns 200' do
-        post :revoke
-
-        expect(response.status).to eq 200
-      end
-
-      it 'revokes the access token' do
-        post :revoke
-
-        expect(access_token.reload).to have_attributes(revoked?: true)
-      end
-    end
-
-    context 'when associated app is confidential' do
-      let(:client) { FactoryBot.create(:application, confidential: true) }
-      let(:oauth_client) { Doorkeeper::OAuth::Client.new(client) }
-
-      before(:each) do
-        allow_any_instance_of(Doorkeeper::Server).to receive(:client) { oauth_client }
-      end
-
-      it 'returns 200' do
-        post :revoke
-
-        expect(response.status).to eq 200
-      end
-
-      it 'revokes the access token' do
-        post :revoke
-
-        expect(access_token.reload).to have_attributes(revoked?: true)
-      end
-
-      context 'when authorization fails' do
-        let(:some_other_client) { FactoryBot.create(:application, confidential: true) }
-        let(:oauth_client) { Doorkeeper::OAuth::Client.new(some_other_client) }
-
-        it 'returns 200' do
-          post :revoke
-
-          expect(response.status).to eq 200
-        end
-
-        it 'does not revoke the access token' do
-          post :revoke
-
-          expect(access_token.reload).to have_attributes(revoked?: false)
-        end
-      end
-    end
-  end
-
-  describe 'authorize response memoization' do
-    it "memoizes the result of the authorization" do
-      strategy = double(:strategy, authorize: true)
-      expect(strategy).to receive(:authorize).once
-      allow(controller).to receive(:strategy) { strategy }
-      allow(controller).to receive(:create) do
-        controller.send :authorize_response
-      end
-
-      post :create
-    end
-  end
-
-  describe 'when requested token introspection' do
-    context 'authorized using Bearer token' do
-      let(:client) { FactoryBot.create(:application) }
-      let(:access_token) { FactoryBot.create(:access_token, application: client) }
-
-      it 'responds with full token introspection' do
-        request.headers['Authorization'] = "Bearer #{access_token.token}"
-
-        post :introspect, token: access_token.token
-
-        should_have_json 'active', true
-        expect(json_response).to include('client_id', 'token_type', 'exp', 'iat')
-      end
-    end
-
-    context 'authorized using Client Authentication' do
-      let(:client) { FactoryBot.create(:application) }
-      let(:access_token) { FactoryBot.create(:access_token, application: client) }
-
-      it 'responds with full token introspection' do
-        request.headers['Authorization'] = basic_auth_header_for_client(client)
-
-        post :introspect, token: access_token.token
-
-        should_have_json 'active', true
-        expect(json_response).to include('client_id', 'token_type', 'exp', 'iat')
-        should_have_json 'client_id', client.uid
-      end
-    end
-
-    context 'public access token' do
-      let(:client) { FactoryBot.create(:application) }
-      let(:access_token) { FactoryBot.create(:access_token, application: nil) }
-
-      it 'responds with full token introspection' do
-        request.headers['Authorization'] = basic_auth_header_for_client(client)
-
-        post :introspect, token: access_token.token
-
-        should_have_json 'active', true
-        expect(json_response).to include('client_id', 'token_type', 'exp', 'iat')
-        should_have_json 'client_id', nil
-      end
-    end
-
-    context 'token was issued to a different client than is making this request' do
-      let(:client) { FactoryBot.create(:application) }
-      let(:different_client) { FactoryBot.create(:application) }
-      let(:access_token) { FactoryBot.create(:access_token, application: client) }
-
-      it 'responds with only active state' do
-        request.headers['Authorization'] = basic_auth_header_for_client(different_client)
-
-        post :introspect, token: access_token.token
-
-        expect(response).to be_successful
-
-        should_have_json 'active', false
-        expect(json_response).not_to include('client_id', 'token_type', 'exp', 'iat')
-      end
-    end
-
-    context 'using invalid credentials to authorize' do
-      let(:client) { double(uid: '123123', secret: '666999') }
-      let(:access_token) { FactoryBot.create(:access_token) }
-
-      it 'responds with invalid_client error' do
-        request.headers['Authorization'] = basic_auth_header_for_client(client)
-
-        post :introspect, token: access_token.token
-
-        expect(response).not_to be_successful
-        response_status_should_be 401
-
-        should_not_have_json 'active'
-        should_have_json 'error', 'invalid_client'
-      end
-    end
-
-    context 'using wrong token value' do
-      let(:client) { FactoryBot.create(:application) }
-      let(:access_token) { FactoryBot.create(:access_token, application: client) }
-
-      it 'responds with only active state' do
-        request.headers['Authorization'] = basic_auth_header_for_client(client)
-
-        post :introspect, token: SecureRandom.hex(16)
-
-        should_have_json 'active', false
-        expect(json_response).not_to include('client_id', 'token_type', 'exp', 'iat')
-      end
-    end
-
-    context 'when requested Access Token expired' do
-      let(:client) { FactoryBot.create(:application) }
-      let(:access_token) { FactoryBot.create(:access_token, application: client, created_at: 1.year.ago) }
-
-      it 'responds with only active state' do
-        request.headers['Authorization'] = basic_auth_header_for_client(client)
-
-        post :introspect, token: access_token.token
-
-        should_have_json 'active', false
-        expect(json_response).not_to include('client_id', 'token_type', 'exp', 'iat')
-      end
-    end
-
-    context 'when requested Access Token revoked' do
-      let(:client) { FactoryBot.create(:application) }
-      let(:access_token) { FactoryBot.create(:access_token, application: client, revoked_at: 1.year.ago) }
-
-      it 'responds with only active state' do
-        request.headers['Authorization'] = basic_auth_header_for_client(client)
-
-        post :introspect, token: access_token.token
-
-        should_have_json 'active', false
-        expect(json_response).not_to include('client_id', 'token_type', 'exp', 'iat')
-      end
-    end
-
-    context 'unauthorized (no bearer token or client credentials)' do
-      let(:access_token) { FactoryBot.create(:access_token) }
-
-      it 'responds with invalid_request error' do
-        post :introspect, token: access_token.token
-
-        expect(response).not_to be_successful
-        response_status_should_be 401
-
-        should_not_have_json 'active'
-        should_have_json 'error', 'invalid_request'
-      end
-    end
-  end
-end

data/spec/dummy/Rakefile

@@ -1,7 +0,0 @@
-#!/usr/bin/env rake
-# Add your own tasks in files placed in lib/tasks ending in .rake,
-# for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.
-
-require File.expand_path('../config/application', __FILE__)
-
-Dummy::Application.load_tasks

data/spec/dummy/app/controllers/application_controller.rb

@@ -1,3 +0,0 @@
-class ApplicationController < ActionController::Base
-  protect_from_forgery
-end

data/spec/dummy/app/controllers/custom_authorizations_controller.rb

@@ -1,7 +0,0 @@
-class CustomAuthorizationsController < ::ApplicationController
-  %w(index show new create edit update destroy).each do |action|
-    define_method action do
-      render nothing: true
-    end
-  end
-end

data/spec/dummy/app/controllers/full_protected_resources_controller.rb

@@ -1,12 +0,0 @@
-class FullProtectedResourcesController < ApplicationController
-  before_action -> { doorkeeper_authorize! :write, :admin }, only: :show
-  before_action :doorkeeper_authorize!, only: :index
-
-  def index
-    render plain: 'index'
-  end
-
-  def show
-    render plain: 'show'
-  end
-end

data/spec/dummy/app/controllers/home_controller.rb

@@ -1,17 +0,0 @@
-class HomeController < ApplicationController
-  def index
-  end
-
-  def sign_in
-    session[:user_id] = if Rails.env.development?
-                          User.first || User.create!(name: 'Joe', password: 'sekret')
-                        else
-                          User.first
-                        end
-    redirect_to '/'
-  end
-
-  def callback
-    render plain: 'ok'
-  end
-end

data/spec/dummy/app/controllers/metal_controller.rb

@@ -1,11 +0,0 @@
-class MetalController < ActionController::Metal
-  include AbstractController::Callbacks
-  include ActionController::Head
-  include Doorkeeper::Rails::Helpers
-
-  before_action :doorkeeper_authorize!
-
-  def index
-    self.response_body = { ok: true }.to_json
-  end
-end

data/spec/dummy/app/controllers/semi_protected_resources_controller.rb

@@ -1,11 +0,0 @@
-class SemiProtectedResourcesController < ApplicationController
-  before_action :doorkeeper_authorize!, only: :index
-
-  def index
-    render plain: 'protected index'
-  end
-
-  def show
-    render plain: 'non protected show'
-  end
-end

data/spec/dummy/app/helpers/application_helper.rb

@@ -1,5 +0,0 @@
-module ApplicationHelper
-  def current_user
-    @current_user ||= User.find_by_id(session[:user_id])
-  end
-end

data/spec/dummy/app/models/user.rb

@@ -1,5 +0,0 @@
-class User < ActiveRecord::Base
-  def self.authenticate!(name, password)
-    User.where(name: name, password: password).first
-  end
-end

data/spec/dummy/app/views/layouts/application.html.erb

@@ -1,14 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <title>Dummy</title>
-  <%= csrf_meta_tags %>
-</head>
-<body>
-
-<%= link_to "Sign in", '/sign_in' %>
-
-<%= yield %>
-
-</body>
-</html>

data/spec/dummy/config/application.rb

@@ -1,23 +0,0 @@
-require File.expand_path('../boot', __FILE__)
-
-require 'rails/all'
-
-Bundler.require(*Rails.groups)
-
-require 'yaml'
-
-orm = if DOORKEEPER_ORM =~ /mongoid/
-        Mongoid.load!(File.join(File.dirname(File.expand_path(__FILE__)), "#{DOORKEEPER_ORM}.yml"))
-        :mongoid
-      else
-        DOORKEEPER_ORM
-      end
-require "#{orm}/railtie"
-
-module Dummy
-  class Application < Rails::Application
-    # Settings in config/environments/* take precedence over those specified here.
-    # Application configuration should go into files in config/initializers
-    # -- all .rb files in that directory are automatically loaded.
-  end
-end