doorkeeper 4.4.3 → 5.5.2

data/spec/lib/oauth/helpers/uri_checker_spec.rb

@@ -1,218 +0,0 @@
-require 'spec_helper'
-require 'uri'
-require 'doorkeeper/oauth/helpers/uri_checker'
-
-module Doorkeeper::OAuth::Helpers
-  describe URIChecker do
-    describe '.valid?' do
-      it 'is valid for native uris' do
-        uri = 'urn:ietf:wg:oauth:2.0:oob'
-        expect(URIChecker.valid?(uri)).to be_truthy
-      end
-
-      it 'is valid for valid uris' do
-        uri = 'http://app.co'
-        expect(URIChecker.valid?(uri)).to be_truthy
-      end
-
-      it 'is valid if include path param' do
-        uri = 'http://app.co/path'
-        expect(URIChecker.valid?(uri)).to be_truthy
-      end
-
-      it 'is valid if include query param' do
-        uri = 'http://app.co/?query=1'
-        expect(URIChecker.valid?(uri)).to be_truthy
-      end
-
-      it 'is invalid if uri includes fragment' do
-        uri = 'http://app.co/test#fragment'
-        expect(URIChecker.valid?(uri)).to be_falsey
-      end
-
-      it 'is invalid if scheme is missing' do
-        uri = 'app.co'
-        expect(URIChecker.valid?(uri)).to be_falsey
-      end
-
-      it 'is invalid if is a relative uri' do
-        uri = '/abc/123'
-        expect(URIChecker.valid?(uri)).to be_falsey
-      end
-
-      it 'is invalid if is not a url' do
-        uri = 'http://'
-        expect(URIChecker.valid?(uri)).to be_falsey
-      end
-
-      it 'is invalid if is not an uri' do
-        uri = '   '
-        expect(URIChecker.valid?(uri)).to be_falsey
-      end
-    end
-
-    describe '.matches?' do
-      it 'is true if both url matches' do
-        uri = client_uri = 'http://app.co/aaa'
-        expect(URIChecker.matches?(uri, client_uri)).to be_truthy
-      end
-
-      it 'ignores query parameter on comparsion' do
-        uri = 'http://app.co/?query=hello'
-        client_uri = 'http://app.co'
-        expect(URIChecker.matches?(uri, client_uri)).to be_truthy
-      end
-
-      it 'doesn\'t allow non-matching domains through' do
-        uri = 'http://app.abc/?query=hello'
-        client_uri = 'http://app.co'
-        expect(URIChecker.matches?(uri, client_uri)).to be_falsey
-      end
-
-      it 'doesn\'t allow non-matching domains that don\'t start at the beginning' do
-        uri = 'http://app.co/?query=hello'
-        client_uri = 'http://example.com?app.co=test'
-        expect(URIChecker.matches?(uri, client_uri)).to be_falsey
-      end
-
-      context "client registered query params" do
-        it "doesn't allow query being absent" do
-          uri = 'http://app.co'
-          client_uri = 'http://app.co/?vendorId=AJ4L7XXW9'
-          expect(URIChecker.matches?(uri, client_uri)).to be_falsey
-        end
-
-        it "is false if query values differ but key same" do
-          uri = 'http://app.co/?vendorId=pancakes'
-          client_uri = 'http://app.co/?vendorId=waffles'
-          expect(URIChecker.matches?(uri, client_uri)).to be_falsey
-        end
-
-        it "is false if query values same but key differs" do
-          uri = 'http://app.co/?foo=pancakes'
-          client_uri = 'http://app.co/?bar=pancakes'
-          expect(URIChecker.matches?(uri, client_uri)).to be_falsey
-        end
-
-        it "is false if query present and match, but unknown queries present" do
-          uri = 'http://app.co/?vendorId=pancakes&unknown=query'
-          client_uri = 'http://app.co/?vendorId=waffles'
-          expect(URIChecker.matches?(uri, client_uri)).to be_falsey
-        end
-
-        it "is true if queries are present and matche" do
-          uri = 'http://app.co/?vendorId=AJ4L7XXW9&foo=bar'
-          client_uri = 'http://app.co/?vendorId=AJ4L7XXW9&foo=bar'
-          expect(URIChecker.matches?(uri, client_uri)).to be_truthy
-        end
-
-        it "is true if queries are present, match and in different order" do
-          uri = 'http://app.co/?bing=bang&foo=bar'
-          client_uri = 'http://app.co/?foo=bar&bing=bang'
-          expect(URIChecker.matches?(uri, client_uri)).to be_truthy
-        end
-      end
-    end
-
-    describe '.valid_for_authorization?' do
-      it 'is true if valid and matches' do
-        uri = client_uri = 'http://app.co/aaa'
-        expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_truthy
-      end
-
-      it 'is false if valid and mismatches' do
-        uri = 'http://app.co/aaa'
-        client_uri = 'http://app.co/bbb'
-        expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_falsey
-      end
-
-      it 'is true if valid and included in array' do
-        uri = 'http://app.co/aaa'
-        client_uri = "http://example.com/bbb\nhttp://app.co/aaa"
-        expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_truthy
-      end
-
-      it 'is false if valid and not included in array' do
-        uri = 'http://app.co/aaa'
-        client_uri = "http://example.com/bbb\nhttp://app.co/cc"
-        expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_falsey
-      end
-
-      it 'is true if valid and matches' do
-        uri = client_uri = 'http://app.co/aaa'
-        expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be true
-      end
-
-      it 'is false if invalid' do
-        uri = 'http://app.co/aaa?pankcakes=abc'
-        client_uri = 'http://app.co/aaa?waffles=abc'
-        expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be false
-      end
-
-      it 'calls .matches?' do
-        uri = 'http://app.co/aaa?pankcakes=abc'
-        client_uri = 'http://app.co/aaa?waffles=abc'
-        expect(URIChecker).to receive(:matches?).with(uri, client_uri).once
-        URIChecker.valid_for_authorization?(uri, client_uri)
-      end
-
-      it 'calls .valid?' do
-        uri = 'http://app.co/aaa?pankcakes=abc'
-        client_uri = 'http://app.co/aaa?waffles=abc'
-        expect(URIChecker).to receive(:valid?).with(uri).once
-        URIChecker.valid_for_authorization?(uri, client_uri)
-      end
-    end
-
-    describe '.query_matches?' do
-      it 'is true if no queries' do
-        expect(URIChecker.query_matches?('', '')).to be_truthy
-        expect(URIChecker.query_matches?(nil, nil)).to be_truthy
-      end
-
-      it 'is true if same query' do
-        expect(URIChecker.query_matches?('foo', 'foo')).to be_truthy
-      end
-
-      it 'is false if different query' do
-        expect(URIChecker.query_matches?('foo', 'bar')).to be_falsey
-      end
-
-      it 'is true if same queries' do
-        expect(URIChecker.query_matches?('foo&bar', 'foo&bar')).to be_truthy
-      end
-
-      it 'is true if same queries, different order' do
-        expect(URIChecker.query_matches?('foo&bar', 'bar&foo')).to be_truthy
-      end
-
-      it 'is false if one different query' do
-        expect(URIChecker.query_matches?('foo&bang', 'foo&bing')).to be_falsey
-      end
-
-      it 'is true if same query with same value' do
-        expect(URIChecker.query_matches?('foo=bar', 'foo=bar')).to be_truthy
-      end
-
-      it 'is true if same queries with same values' do
-        expect(URIChecker.query_matches?('foo=bar&bing=bang', 'foo=bar&bing=bang')).to be_truthy
-      end
-
-      it 'is true if same queries with same values, different order' do
-        expect(URIChecker.query_matches?('foo=bar&bing=bang', 'bing=bang&foo=bar')).to be_truthy
-      end
-
-      it 'is false if same query with different value' do
-        expect(URIChecker.query_matches?('foo=bar', 'foo=bang')).to be_falsey
-      end
-
-      it 'is false if some queries missing' do
-        expect(URIChecker.query_matches?('foo=bar', 'foo=bar&bing=bang')).to be_falsey
-      end
-
-      it 'is false if some queries different value' do
-        expect(URIChecker.query_matches?('foo=bar&bing=bang', 'foo=bar&bing=banana')).to be_falsey
-      end
-    end
-  end
-end

data/spec/lib/oauth/invalid_token_response_spec.rb

@@ -1,56 +0,0 @@
-require 'spec_helper'
-require 'active_model'
-require 'doorkeeper'
-require 'doorkeeper/oauth/invalid_token_response'
-
-module Doorkeeper::OAuth
-  describe InvalidTokenResponse do
-    describe "#name" do
-      it  { expect(subject.name).to eq(:invalid_token) }
-    end
-
-    describe "#status" do
-      it { expect(subject.status).to eq(:unauthorized) }
-    end
-
-    describe :from_access_token do
-      let(:response) { InvalidTokenResponse.from_access_token(access_token) }
-
-      context "revoked" do
-        let(:access_token) { double(revoked?: true, expired?: true) }
-
-        it "sets a description" do
-          expect(response.description).to include("revoked")
-        end
-
-        it "sets the reason" do
-          expect(response.reason).to eq(:revoked)
-        end
-      end
-
-      context "expired" do
-        let(:access_token) { double(revoked?: false, expired?: true) }
-
-        it "sets a description" do
-          expect(response.description).to include("expired")
-        end
-
-        it "sets the reason" do
-          expect(response.reason).to eq(:expired)
-        end
-      end
-
-      context "unknown" do
-        let(:access_token) { double(revoked?: false, expired?: false) }
-
-        it "sets a description" do
-          expect(response.description).to include("invalid")
-        end
-
-        it "sets the reason" do
-          expect(response.reason).to eq(:unknown)
-        end
-      end
-    end
-  end
-end

data/spec/lib/oauth/password_access_token_request_spec.rb

@@ -1,96 +0,0 @@
-require 'spec_helper_integration'
-
-module Doorkeeper::OAuth
-  describe PasswordAccessTokenRequest do
-    let(:server) do
-      double(
-        :server,
-        default_scopes: Doorkeeper::OAuth::Scopes.new,
-        access_token_expires_in: 2.hours,
-        refresh_token_enabled?: false,
-        custom_access_token_expires_in: ->(_app) { nil }
-      )
-    end
-    let(:client) { FactoryBot.create(:application) }
-    let(:owner)  { double :owner, id: 99 }
-
-    subject do
-      PasswordAccessTokenRequest.new(server, client, owner)
-    end
-
-    it 'issues a new token for the client' do
-      expect do
-        subject.authorize
-      end.to change { client.reload.access_tokens.count }.by(1)
-    end
-
-    it 'issues a new token without a client' do
-      expect do
-        subject.client = nil
-        subject.authorize
-      end.to change { Doorkeeper::AccessToken.count }.by(1)
-    end
-
-    it 'does not issue a new token with an invalid client' do
-      expect do
-        subject.client = nil
-        subject.parameters = { client_id: 'bad_id' }
-        subject.authorize
-      end.to_not change { Doorkeeper::AccessToken.count }
-
-      expect(subject.error).to eq(:invalid_client)
-    end
-
-    it 'requires the owner' do
-      subject.resource_owner = nil
-      subject.validate
-      expect(subject.error).to eq(:invalid_grant)
-    end
-
-    it 'optionally accepts the client' do
-      subject.client = nil
-      expect(subject).to be_valid
-    end
-
-    it 'creates token even when there is already one (default)' do
-      FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
-      expect do
-        subject.authorize
-      end.to change { Doorkeeper::AccessToken.count }.by(1)
-    end
-
-    it 'skips token creation if there is already one' do
-      allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-      FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
-      expect do
-        subject.authorize
-      end.to_not change { Doorkeeper::AccessToken.count }
-    end
-
-    it "calls configured request callback methods" do
-      expect(Doorkeeper.configuration.before_successful_strategy_response).to receive(:call).with(subject).once
-      expect(Doorkeeper.configuration.after_successful_strategy_response).to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
-      subject.authorize
-    end
-
-    describe 'with scopes' do
-      subject do
-        PasswordAccessTokenRequest.new(server, client, owner, scope: 'public')
-      end
-
-      it 'validates the current scope' do
-        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('another'))
-        subject.validate
-        expect(subject.error).to eq(:invalid_scope)
-      end
-
-      it 'creates the token with scopes' do
-        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('public'))
-        expect do
-          subject.authorize
-        end.to change { Doorkeeper::AccessToken.count }.by(1)
-        expect(Doorkeeper::AccessToken.last.scopes).to include('public')
-      end
-    end
-  end
-end

data/spec/lib/oauth/pre_authorization_spec.rb

@@ -1,160 +0,0 @@
-require 'spec_helper_integration'
-
-module Doorkeeper::OAuth
-  describe PreAuthorization do
-    let(:server) {
-      server = Doorkeeper.configuration
-      allow(server).to receive(:default_scopes).and_return(Scopes.new)
-      allow(server).to receive(:scopes).and_return(Scopes.from_string('public profile'))
-      server
-    }
-
-    let(:application) do
-      application = double :application
-      allow(application).to receive(:scopes).and_return(Scopes.from_string(''))
-      application
-    end
-
-    let(:client) do
-      double :client, redirect_uri: 'http://tst.com/auth', application: application
-    end
-
-    let :attributes do
-      {
-        response_type: 'code',
-        redirect_uri: 'http://tst.com/auth',
-        state: 'save-this'
-      }
-    end
-
-    subject do
-      PreAuthorization.new(server, client, attributes)
-    end
-
-    it 'is authorizable when request is valid' do
-      expect(subject).to be_authorizable
-    end
-
-    it 'accepts code as response type' do
-      subject.response_type = 'code'
-      expect(subject).to be_authorizable
-    end
-
-    it 'accepts token as response type' do
-      allow(server).to receive(:grant_flows).and_return(['implicit'])
-      subject.response_type = 'token'
-      expect(subject).to be_authorizable
-    end
-
-    context 'when using default grant flows' do
-      it 'accepts "code" as response type' do
-        subject.response_type = 'code'
-        expect(subject).to be_authorizable
-      end
-
-      it 'accepts "token" as response type' do
-        allow(server).to receive(:grant_flows).and_return(['implicit'])
-        subject.response_type = 'token'
-        expect(subject).to be_authorizable
-      end
-    end
-
-    context 'when authorization code grant flow is disabled' do
-      before do
-        allow(server).to receive(:grant_flows).and_return(['implicit'])
-      end
-
-      it 'does not accept "code" as response type' do
-        subject.response_type = 'code'
-        expect(subject).not_to be_authorizable
-      end
-    end
-
-    context 'when implicit grant flow is disabled' do
-      before do
-        allow(server).to receive(:grant_flows).and_return(['authorization_code'])
-      end
-
-      it 'does not accept "token" as response type' do
-        subject.response_type = 'token'
-        expect(subject).not_to be_authorizable
-      end
-    end
-
-    context 'client application does not restrict valid scopes' do
-      it 'accepts valid scopes' do
-        subject.scope = 'public'
-        expect(subject).to be_authorizable
-      end
-
-      it 'rejects (globally) non-valid scopes' do
-        subject.scope = 'invalid'
-        expect(subject).not_to be_authorizable
-      end
-    end
-
-    context 'client application restricts valid scopes' do
-      let(:application) do
-        application = double :application
-        allow(application).to receive(:scopes).and_return(Scopes.from_string('public nonsense'))
-        application
-      end
-
-      it 'accepts valid scopes' do
-        subject.scope = 'public'
-        expect(subject).to be_authorizable
-      end
-
-      it 'rejects (globally) non-valid scopes' do
-        subject.scope = 'invalid'
-        expect(subject).not_to be_authorizable
-      end
-
-      it 'rejects (application level) non-valid scopes' do
-        subject.scope = 'profile'
-        expect(subject).to_not be_authorizable
-      end
-    end
-
-    it 'uses default scopes when none is required' do
-      allow(server).to receive(:default_scopes).and_return(Scopes.from_string('default'))
-      subject.scope = nil
-      expect(subject.scope).to eq('default')
-      expect(subject.scopes).to eq(Scopes.from_string('default'))
-    end
-
-    context 'with native redirect uri' do
-      let(:native_redirect_uri) { 'urn:ietf:wg:oauth:2.0:oob' }
-
-      it 'accepts redirect_uri when it matches with the client' do
-        subject.redirect_uri = native_redirect_uri
-        allow(subject.client).to receive(:redirect_uri) { native_redirect_uri }
-        expect(subject).to be_authorizable
-      end
-
-      it 'invalidates redirect_uri when it does\'n match with the client' do
-        subject.redirect_uri = native_redirect_uri
-        expect(subject).not_to be_authorizable
-      end
-    end
-
-    it 'stores the state' do
-      expect(subject.state).to eq('save-this')
-    end
-
-    it 'rejects if response type is not allowed' do
-      subject.response_type = 'whops'
-      expect(subject).not_to be_authorizable
-    end
-
-    it 'requires an existing client' do
-      subject.client = nil
-      expect(subject).not_to be_authorizable
-    end
-
-    it 'requires a redirect uri' do
-      subject.redirect_uri = nil
-      expect(subject).not_to be_authorizable
-    end
-  end
-end