doorkeeper 5.0.0 → 5.1.0

data/spec/controllers/protected_resources_controller_spec.rb

@@ -1,12 +1,14 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module ControllerActions
   def index
-    render plain: 'index'
+    render plain: "index"
   end
 
   def show
-    render plain: 'show'
+    render plain: "show"
   end
 
   def doorkeeper_unauthorized_render_options(*); end
@@ -14,98 +16,98 @@ module ControllerActions
   def doorkeeper_forbidden_render_options(*); end
 end
 
-describe 'doorkeeper authorize filter' do
-  context 'accepts token code specified as' do
+describe "doorkeeper authorize filter" do
+  context "accepts token code specified as" do
     controller do
       before_action :doorkeeper_authorize!
 
       def index
-        render plain: 'index'
+        render plain: "index"
       end
     end
 
-    let(:token_string) { '1A2BC3' }
+    let(:token_string) { "1A2BC3" }
     let(:token) do
       double(Doorkeeper::AccessToken,
              acceptable?: true, previous_refresh_token: "",
              revoke_previous_refresh_token!: true)
     end
 
-    it 'access_token param' do
+    it "access_token param" do
       expect(Doorkeeper::AccessToken).to receive(:by_token).with(token_string).and_return(token)
       get :index, params: { access_token: token_string }
     end
 
-    it 'bearer_token param' do
+    it "bearer_token param" do
       expect(Doorkeeper::AccessToken).to receive(:by_token).with(token_string).and_return(token)
       get :index, params: { bearer_token: token_string }
     end
 
-    it 'Authorization header' do
+    it "Authorization header" do
       expect(Doorkeeper::AccessToken).to receive(:by_token).with(token_string).and_return(token)
-      request.env['HTTP_AUTHORIZATION'] = "Bearer #{token_string}"
+      request.env["HTTP_AUTHORIZATION"] = "Bearer #{token_string}"
       get :index
     end
 
-    it 'different kind of Authorization header' do
+    it "different kind of Authorization header" do
       expect(Doorkeeper::AccessToken).not_to receive(:by_token)
-      request.env['HTTP_AUTHORIZATION'] = "MAC #{token_string}"
+      request.env["HTTP_AUTHORIZATION"] = "MAC #{token_string}"
       get :index
     end
 
-    it 'does not change Authorization header value' do
+    it "does not change Authorization header value" do
       expect(Doorkeeper::AccessToken).to receive(:by_token).exactly(2).times.and_return(token)
-      request.env['HTTP_AUTHORIZATION'] = "Bearer #{token_string}"
+      request.env["HTTP_AUTHORIZATION"] = "Bearer #{token_string}"
       get :index
       controller.send(:remove_instance_variable, :@doorkeeper_token)
       get :index
     end
   end
 
-  context 'defined for all actions' do
+  context "defined for all actions" do
     controller do
       before_action :doorkeeper_authorize!
 
       include ControllerActions
     end
 
-    context 'with valid token', token: :valid do
-      it 'allows into index action' do
+    context "with valid token", token: :valid do
+      it "allows into index action" do
         get :index, params: { access_token: token_string }
         expect(response).to be_successful
       end
 
-      it 'allows into show action' do
-        get :show, params: { id: '4', access_token: token_string }
+      it "allows into show action" do
+        get :show, params: { id: "4", access_token: token_string }
         expect(response).to be_successful
       end
     end
 
-    context 'with invalid token', token: :invalid do
-      it 'does not allow into index action' do
+    context "with invalid token", token: :invalid do
+      it "does not allow into index action" do
         get :index, params: { access_token: token_string }
         expect(response.status).to eq 401
-        expect(response.header['WWW-Authenticate']).to match(/^Bearer/)
+        expect(response.header["WWW-Authenticate"]).to match(/^Bearer/)
       end
 
-      it 'does not allow into show action' do
-        get :show, params: { id: '4', access_token: token_string }
+      it "does not allow into show action" do
+        get :show, params: { id: "4", access_token: token_string }
         expect(response.status).to eq 401
-        expect(response.header['WWW-Authenticate']).to match(/^Bearer/)
+        expect(response.header["WWW-Authenticate"]).to match(/^Bearer/)
       end
     end
   end
 
-  context 'defined with scopes' do
+  context "defined with scopes" do
     controller do
       before_action -> { doorkeeper_authorize! :write }
 
       include ControllerActions
     end
 
-    let(:token_string) { '1A2DUWE' }
+    let(:token_string) { "1A2DUWE" }
 
-    it 'allows if the token has particular scopes' do
+    it "allows if the token has particular scopes" do
       token = double(Doorkeeper::AccessToken,
                      accessible?: true, scopes: %w[write public],
                      previous_refresh_token: "",
@@ -119,9 +121,9 @@ describe 'doorkeeper authorize filter' do
       expect(response).to be_successful
     end
 
-    it 'does not allow if the token does not include given scope' do
+    it "does not allow if the token does not include given scope" do
       token = double(Doorkeeper::AccessToken,
-                     accessible?: true, scopes: ['public'], revoked?: false,
+                     accessible?: true, scopes: ["public"], revoked?: false,
                      expired?: false, previous_refresh_token: "",
                      revoke_previous_refresh_token!: true)
       expect(
@@ -131,18 +133,18 @@ describe 'doorkeeper authorize filter' do
 
       get :index, params: { access_token: token_string }
       expect(response.status).to eq 403
-      expect(response.header).to_not include('WWW-Authenticate')
+      expect(response.header).to_not include("WWW-Authenticate")
     end
   end
 
-  context 'when custom unauthorized render options are configured' do
+  context "when custom unauthorized render options are configured" do
     controller do
       before_action :doorkeeper_authorize!
 
       include ControllerActions
     end
 
-    context 'with a JSON custom render', token: :invalid do
+    context "with a JSON custom render", token: :invalid do
       before do
         module ControllerActions
           remove_method :doorkeeper_unauthorized_render_options
@@ -157,29 +159,28 @@ describe 'doorkeeper authorize filter' do
         module ControllerActions
           remove_method :doorkeeper_unauthorized_render_options
 
-          def doorkeeper_unauthorized_render_options(error: nil)
-          end
+          def doorkeeper_unauthorized_render_options(error: nil); end
         end
       end
 
-      it 'it renders a custom JSON response', token: :invalid do
+      it "it renders a custom JSON response", token: :invalid do
         get :index, params: { access_token: token_string }
         expect(response.status).to eq 401
-        expect(response.content_type).to eq('application/json')
-        expect(response.header['WWW-Authenticate']).to match(/^Bearer/)
+        expect(response.content_type).to eq("application/json")
+        expect(response.header["WWW-Authenticate"]).to match(/^Bearer/)
 
         expect(json_response).not_to be_nil
-        expect(json_response['error_message']).to match('token is invalid')
+        expect(json_response["error_message"]).to match("token is invalid")
       end
     end
 
-    context 'with a text custom render', token: :invalid do
+    context "with a text custom render", token: :invalid do
       before do
         module ControllerActions
           remove_method :doorkeeper_unauthorized_render_options
 
           def doorkeeper_unauthorized_render_options(**)
-            { plain: 'Unauthorized' }
+            { plain: "Unauthorized" }
           end
         end
       end
@@ -192,17 +193,17 @@ describe 'doorkeeper authorize filter' do
         end
       end
 
-      it 'it renders a custom text response', token: :invalid do
+      it "it renders a custom text response", token: :invalid do
         get :index, params: { access_token: token_string }
         expect(response.status).to eq 401
-        expect(response.content_type).to eq('text/plain')
-        expect(response.header['WWW-Authenticate']).to match(/^Bearer/)
-        expect(response.body).to eq('Unauthorized')
+        expect(response.content_type).to eq("text/plain")
+        expect(response.header["WWW-Authenticate"]).to match(/^Bearer/)
+        expect(response.body).to eq("Unauthorized")
       end
     end
   end
 
-  context 'when custom forbidden render options are configured' do
+  context "when custom forbidden render options are configured" do
     before do
       expect(Doorkeeper::AccessToken).to receive(:by_token).with(token_string).and_return(token)
       expect(token).to receive(:acceptable?).with([:write]).and_return(false)
@@ -224,86 +225,129 @@ describe 'doorkeeper authorize filter' do
 
     let(:token) do
       double(Doorkeeper::AccessToken,
-             accessible?: true, scopes: ['public'], revoked?: false,
+             accessible?: true, scopes: ["public"], revoked?: false,
              expired?: false, previous_refresh_token: "",
              revoke_previous_refresh_token!: true)
     end
 
-    let(:token_string) { '1A2DUWE' }
+    let(:token_string) { "1A2DUWE" }
 
-    context 'with a JSON custom render' do
+    context "with a JSON custom render" do
       before do
         module ControllerActions
           remove_method :doorkeeper_forbidden_render_options
 
           def doorkeeper_forbidden_render_options(*)
-            { json: { error_message: 'Forbidden' } }
+            { json: { error_message: "Forbidden" } }
           end
         end
       end
 
-      it 'renders a custom JSON response' do
+      it "renders a custom JSON response" do
         get :index, params: { access_token: token_string }
-        expect(response.header).to_not include('WWW-Authenticate')
-        expect(response.content_type).to eq('application/json')
+        expect(response.header).to_not include("WWW-Authenticate")
+        expect(response.content_type).to eq("application/json")
         expect(response.status).to eq 403
 
         expect(json_response).not_to be_nil
-        expect(json_response['error_message']).to match('Forbidden')
+        expect(json_response["error_message"]).to match("Forbidden")
       end
     end
 
-    context 'with a status and JSON custom render' do
+    context "with a status and JSON custom render" do
       before do
         module ControllerActions
           remove_method :doorkeeper_forbidden_render_options
           def doorkeeper_forbidden_render_options(*)
-            { json: { error_message: 'Not Found' },
-              respond_not_found_when_forbidden: true }
+            { json: { error_message: "Not Found" },
+              respond_not_found_when_forbidden: true, }
           end
         end
       end
 
-      it 'overrides the default status code' do
+      it "overrides the default status code" do
         get :index, params: { access_token: token_string }
         expect(response.status).to eq 404
       end
     end
 
-    context 'with a text custom render' do
+    context "with a text custom render" do
       before do
         module ControllerActions
           remove_method :doorkeeper_forbidden_render_options
 
           def doorkeeper_forbidden_render_options(*)
-            { plain: 'Forbidden' }
+            { plain: "Forbidden" }
           end
         end
       end
 
-      it 'renders a custom status code and text response' do
+      it "renders a custom status code and text response" do
         get :index, params: { access_token: token_string }
-        expect(response.header).to_not include('WWW-Authenticate')
+        expect(response.header).to_not include("WWW-Authenticate")
         expect(response.status).to eq 403
-        expect(response.body).to eq('Forbidden')
+        expect(response.body).to eq("Forbidden")
       end
     end
 
-    context 'with a status and text custom render' do
+    context "with a status and text custom render" do
       before do
         module ControllerActions
           remove_method :doorkeeper_forbidden_render_options
 
           def doorkeeper_forbidden_render_options(*)
-            { respond_not_found_when_forbidden: true, plain: 'Not Found' }
+            { respond_not_found_when_forbidden: true, plain: "Not Found" }
           end
         end
       end
 
-      it 'overrides the default status code' do
+      it "overrides the default status code" do
         get :index, params: { access_token: token_string }
         expect(response.status).to eq 404
       end
     end
   end
+
+  context "when handle_auth_errors option is set to :raise" do
+    subject { get :index, params: { access_token: token_string } }
+
+    before do
+      config_is_set(:handle_auth_errors, :raise)
+    end
+
+    controller do
+      before_action :doorkeeper_authorize!
+      include ControllerActions
+    end
+
+    context "when token is unknown" do
+      it "raises Doorkeeper::Errors::TokenUnknown exception", token: :invalid do
+        expect { subject }.to raise_error(Doorkeeper::Errors::TokenUnknown)
+      end
+    end
+
+    context "when token is expired" do
+      it "raises Doorkeeper::Errors::TokenExpired exception", token: :expired do
+        expect { subject }.to raise_error(Doorkeeper::Errors::TokenExpired)
+      end
+    end
+
+    context "when token is revoked" do
+      it "raises Doorkeeper::Errors::TokenRevoked exception", token: :revoked do
+        expect { subject }.to raise_error(Doorkeeper::Errors::TokenRevoked)
+      end
+    end
+
+    context "when token is forbidden" do
+      it "raises Doorkeeper::Errors::TokenForbidden exception", token: :forbidden do
+        expect { subject }.to raise_error(Doorkeeper::Errors::TokenForbidden)
+      end
+    end
+
+    context "when token is valid" do
+      it "allows into index action", token: :valid do
+        expect(response).to be_successful
+      end
+    end
+  end
 end

data/spec/controllers/token_info_controller_spec.rb

@@ -1,46 +1,48 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 describe Doorkeeper::TokenInfoController do
-  describe 'when requesting token info with valid token' do
+  describe "when requesting token info with valid token" do
     let(:doorkeeper_token) { FactoryBot.create(:access_token) }
 
-    describe 'successful request' do
-      it 'responds with token info' do
+    describe "successful request" do
+      it "responds with token info" do
         get :show, params: { access_token: doorkeeper_token.token }
 
         expect(response.body).to eq(doorkeeper_token.to_json)
       end
 
-      it 'responds with a 200 status' do
+      it "responds with a 200 status" do
         get :show, params: { access_token: doorkeeper_token.token }
 
         expect(response.status).to eq 200
       end
     end
 
-    describe 'invalid token response' do
-      it 'responds with 401 when doorkeeper_token is not valid' do
+    describe "invalid token response" do
+      it "responds with 401 when doorkeeper_token is not valid" do
         get :show
 
         expect(response.status).to eq 401
-        expect(response.headers['WWW-Authenticate']).to match(/^Bearer/)
+        expect(response.headers["WWW-Authenticate"]).to match(/^Bearer/)
       end
 
-      it 'responds with 401 when doorkeeper_token is invalid, expired or revoked' do
+      it "responds with 401 when doorkeeper_token is invalid, expired or revoked" do
         allow(controller).to receive(:doorkeeper_token).and_return(doorkeeper_token)
         allow(doorkeeper_token).to receive(:accessible?).and_return(false)
 
         get :show
 
         expect(response.status).to eq 401
-        expect(response.headers['WWW-Authenticate']).to match(/^Bearer/)
+        expect(response.headers["WWW-Authenticate"]).to match(/^Bearer/)
       end
 
-      it 'responds body message for error' do
+      it "responds body message for error" do
         get :show
 
         expect(response.body).to eq(
-          Doorkeeper::OAuth::ErrorResponse.new(name: :invalid_request, status: :unauthorized).body.to_json
+          Doorkeeper::OAuth::InvalidTokenResponse.new.body.to_json
         )
       end
     end