doorkeeper 5.0.0 → 5.1.0

data/spec/lib/oauth/client/credentials_spec.rb

@@ -1,62 +1,64 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 class Doorkeeper::OAuth::Client
   describe Credentials do
-    let(:client_id) { 'some-uid' }
-    let(:client_secret) { 'some-secret' }
+    let(:client_id) { "some-uid" }
+    let(:client_secret) { "some-secret" }
 
-    it 'is blank when the uid in credentials is blank' do
+    it "is blank when the uid in credentials is blank" do
       expect(Credentials.new(nil, nil)).to be_blank
-      expect(Credentials.new(nil, 'something')).to be_blank
-      expect(Credentials.new('something', nil)).to be_present
-      expect(Credentials.new('something', 'something')).to be_present
+      expect(Credentials.new(nil, "something")).to be_blank
+      expect(Credentials.new("something", nil)).to be_present
+      expect(Credentials.new("something", "something")).to be_present
     end
 
     describe :from_request do
       let(:request) { double.as_null_object }
 
       let(:method) do
-        ->(_request) { ['uid', 'secret'] }
+        ->(_request) { %w[uid secret] }
       end
 
-      it 'accepts anything that responds to #call' do
+      it "accepts anything that responds to #call" do
         expect(method).to receive(:call).with(request)
         Credentials.from_request request, method
       end
 
-      it 'delegates methods received as symbols to Credentials class' do
+      it "delegates methods received as symbols to Credentials class" do
         expect(Credentials).to receive(:from_params).with(request)
         Credentials.from_request request, :from_params
       end
 
-      it 'stops at the first credentials found' do
+      it "stops at the first credentials found" do
         not_called_method = double
         expect(not_called_method).not_to receive(:call)
         Credentials.from_request request, ->(_) {}, method, not_called_method
       end
 
-      it 'returns new Credentials' do
+      it "returns new Credentials" do
         credentials = Credentials.from_request request, method
         expect(credentials).to be_a(Credentials)
       end
 
-      it 'returns uid and secret from extractor method' do
+      it "returns uid and secret from extractor method" do
         credentials = Credentials.from_request request, method
-        expect(credentials.uid).to    eq('uid')
-        expect(credentials.secret).to eq('secret')
+        expect(credentials.uid).to    eq("uid")
+        expect(credentials.secret).to eq("secret")
       end
     end
 
     describe :from_params do
-      it 'returns credentials from parameters when Authorization header is not available' do
+      it "returns credentials from parameters when Authorization header is not available" do
         request     = double parameters: { client_id: client_id, client_secret: client_secret }
         uid, secret = Credentials.from_params(request)
 
-        expect(uid).to    eq('some-uid')
-        expect(secret).to eq('some-secret')
+        expect(uid).to    eq("some-uid")
+        expect(secret).to eq("some-secret")
       end
 
-      it 'is blank when there are no credentials' do
+      it "is blank when there are no credentials" do
         request     = double parameters: {}
         uid, secret = Credentials.from_params(request)
 
@@ -68,16 +70,16 @@ class Doorkeeper::OAuth::Client
     describe :from_basic do
       let(:credentials) { Base64.encode64("#{client_id}:#{client_secret}") }
 
-      it 'decodes the credentials' do
+      it "decodes the credentials" do
         request     = double authorization: "Basic #{credentials}"
         uid, secret = Credentials.from_basic(request)
 
-        expect(uid).to    eq('some-uid')
-        expect(secret).to eq('some-secret')
+        expect(uid).to    eq("some-uid")
+        expect(secret).to eq("some-secret")
       end
 
-      it 'is blank if Authorization is not Basic' do
-        request     = double authorization: "#{credentials}"
+      it "is blank if Authorization is not Basic" do
+        request     = double authorization: credentials.to_s
         uid, secret = Credentials.from_basic(request)
 
         expect(uid).to    be_blank

data/spec/lib/oauth/client_credentials/creator_spec.rb

@@ -1,29 +1,75 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 class Doorkeeper::OAuth::ClientCredentialsRequest
   describe Creator do
     let(:client) { FactoryBot.create :application }
-    let(:scopes) { Doorkeeper::OAuth::Scopes.from_string('public') }
+    let(:scopes) { Doorkeeper::OAuth::Scopes.from_string("public") }
 
     before do
       default_scopes_exist :public
     end
 
-    it 'creates a new token' do
+    it "creates a new token" do
       expect do
         subject.call(client, scopes)
       end.to change { Doorkeeper::AccessToken.count }.by(1)
     end
 
     context "when reuse_access_token is true" do
-      it "returns the existing valid token" do
-        allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-        existing_token = subject.call(client, scopes)
+      context "when expiration is disabled" do
+        it "returns the existing valid token" do
+          allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
+          existing_token = subject.call(client, scopes)
 
-        result = subject.call(client, scopes)
+          result = subject.call(client, scopes)
+
+          expect(Doorkeeper::AccessToken.count).to eq(1)
+          expect(result).to eq(existing_token)
+        end
+      end
+
+      context "when existing token has not crossed token_reuse_limit" do
+        it "returns the existing valid token" do
+          allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
+          allow(Doorkeeper.configuration).to receive(:token_reuse_limit).and_return(50)
+          existing_token = subject.call(client, scopes, expires_in: 1000)
+
+          allow_any_instance_of(Doorkeeper::AccessToken).to receive(:expires_in_seconds).and_return(600)
+          result = subject.call(client, scopes, expires_in: 1000)
+
+          expect(Doorkeeper::AccessToken.count).to eq(1)
+          expect(result).to eq(existing_token)
+        end
+      end
+
+      context "when existing token has crossed token_reuse_limit" do
+        it "returns a new token" do
+          allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
+          allow(Doorkeeper.configuration).to receive(:token_reuse_limit).and_return(50)
+          existing_token = subject.call(client, scopes, expires_in: 1000)
+
+          allow_any_instance_of(Doorkeeper::AccessToken).to receive(:expires_in_seconds).and_return(400)
+          result = subject.call(client, scopes, expires_in: 1000)
+
+          expect(Doorkeeper::AccessToken.count).to eq(2)
+          expect(result).not_to eq(existing_token)
+        end
+      end
+
+      context "when existing token has been expired" do
+        it "returns a new token" do
+          allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
+          allow(Doorkeeper.configuration).to receive(:token_reuse_limit).and_return(50)
+          existing_token = subject.call(client, scopes, expires_in: 1000)
+
+          allow_any_instance_of(Doorkeeper::AccessToken).to receive(:expired?).and_return(true)
+          result = subject.call(client, scopes, expires_in: 1000)
 
-        expect(Doorkeeper::AccessToken.count).to eq(1)
-        expect(result).to eq(existing_token)
+          expect(Doorkeeper::AccessToken.count).to eq(2)
+          expect(result).not_to eq(existing_token)
+        end
       end
     end
 
@@ -39,7 +85,7 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
       end
     end
 
-    it 'returns false if creation fails' do
+    it "returns false if creation fails" do
       expect(Doorkeeper::AccessToken).to receive(:find_or_create_for).and_return(false)
       created = subject.call(client, scopes)
       expect(created).to be_falsey

data/spec/lib/oauth/client_credentials/issuer_spec.rb

@@ -1,31 +1,36 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 class Doorkeeper::OAuth::ClientCredentialsRequest
   describe Issuer do
-    let(:creator) { double :acces_token_creator }
+    let(:creator) { double :access_token_creator }
     let(:server) do
       double(
         :server,
-        access_token_expires_in: 100,
-        custom_access_token_expires_in: ->(_context) { nil }
+        access_token_expires_in: 100
       )
     end
     let(:validation) { double :validation, valid?: true }
 
+    before do
+      allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(false)
+    end
+
     subject { Issuer.new(server, validation) }
 
     describe :create do
-      let(:client) { double :client, id: 'some-id' }
-      let(:scopes) { 'some scope' }
+      let(:client) { double :client, id: "some-id" }
+      let(:scopes) { "some scope" }
 
-      it 'creates and sets the token' do
-        expect(creator).to receive(:call).and_return('token')
+      it "creates and sets the token" do
+        expect(creator).to receive(:call).and_return("token")
         subject.create client, scopes, creator
 
-        expect(subject.token).to eq('token')
+        expect(subject.token).to eq("token")
       end
 
-      it 'creates with correct token parameters' do
+      it "creates with correct token parameters" do
         expect(creator).to receive(:call).with(
           client,
           scopes,
@@ -36,34 +41,34 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
         subject.create client, scopes, creator
       end
 
-      it 'has error set to :server_error if creator fails' do
+      it "has error set to :server_error if creator fails" do
         expect(creator).to receive(:call).and_return(false)
         subject.create client, scopes, creator
 
         expect(subject.error).to eq(:server_error)
       end
 
-      context 'when validation fails' do
+      context "when validation fails" do
         before do
           allow(validation).to receive(:valid?).and_return(false)
           allow(validation).to receive(:error).and_return(:validation_error)
           expect(creator).not_to receive(:create)
         end
 
-        it 'has error set from validation' do
+        it "has error set from validation" do
           subject.create client, scopes, creator
           expect(subject.error).to eq(:validation_error)
         end
 
-        it 'returns false' do
+        it "returns false" do
           expect(subject.create(client, scopes, creator)).to be_falsey
         end
       end
 
-      context 'with custom expirations' do
+      context "with custom expirations" do
         let(:custom_ttl_grant) { 1234 }
         let(:custom_ttl_scope) { 1235 }
-        let(:custom_scope) { 'special' }
+        let(:custom_scope) { "special" }
         let(:server) do
           double(
             :server,
@@ -73,14 +78,16 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
                 custom_ttl_scope
               elsif context.grant_type == Doorkeeper::OAuth::CLIENT_CREDENTIALS
                 custom_ttl_grant
-              else
-                nil
               end
             }
           )
         end
 
-        it 'respects grant based rules' do
+        before do
+          allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
+        end
+
+        it "respects grant based rules" do
           expect(creator).to receive(:call).with(
             client,
             scopes,
@@ -90,7 +97,7 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
           subject.create client, scopes, creator
         end
 
-        it 'respects scope based rules' do
+        it "respects scope based rules" do
           expect(creator).to receive(:call).with(
             client,
             custom_scope,

data/spec/lib/oauth/client_credentials/validation_spec.rb

@@ -1,4 +1,6 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 class Doorkeeper::OAuth::ClientCredentialsRequest
   describe Validation do
@@ -9,41 +11,45 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
 
     subject { Validation.new(server, request) }
 
-    it 'is valid with valid request' do
+    it "is valid with valid request" do
       expect(subject).to be_valid
     end
 
-    it 'is invalid when client is not present' do
+    it "is invalid when client is not present" do
       allow(request).to receive(:client).and_return(nil)
       expect(subject).not_to be_valid
     end
 
-    context 'with scopes' do
-      it 'is invalid when scopes are not included in the server' do
-        server_scopes = Doorkeeper::OAuth::Scopes.from_string 'email'
+    context "with scopes" do
+      it "is invalid when scopes are not included in the server" do
+        server_scopes = Doorkeeper::OAuth::Scopes.from_string "email"
+        allow(request).to receive(:grant_type).and_return(Doorkeeper::OAuth::CLIENT_CREDENTIALS)
         allow(server).to receive(:scopes).and_return(server_scopes)
         allow(request).to receive(:scopes).and_return(
-          Doorkeeper::OAuth::Scopes.from_string 'invalid')
+          Doorkeeper::OAuth::Scopes.from_string("invalid")
+        )
         expect(subject).not_to be_valid
       end
 
-      context 'with application scopes' do
-        it 'is valid when scopes are included in the application' do
-          application_scopes = Doorkeeper::OAuth::Scopes.from_string 'app'
-          server_scopes = Doorkeeper::OAuth::Scopes.from_string 'email app'
+      context "with application scopes" do
+        it "is valid when scopes are included in the application" do
+          application_scopes = Doorkeeper::OAuth::Scopes.from_string "app"
+          server_scopes = Doorkeeper::OAuth::Scopes.from_string "email app"
           allow(application).to receive(:scopes).and_return(application_scopes)
           allow(server).to receive(:scopes).and_return(server_scopes)
+          allow(request).to receive(:grant_type).and_return(Doorkeeper::OAuth::CLIENT_CREDENTIALS)
           allow(request).to receive(:scopes).and_return(application_scopes)
           expect(subject).to be_valid
         end
 
-        it 'is invalid when scopes are not included in the application' do
-          application_scopes = Doorkeeper::OAuth::Scopes.from_string 'app'
-          server_scopes = Doorkeeper::OAuth::Scopes.from_string 'email app'
+        it "is invalid when scopes are not included in the application" do
+          application_scopes = Doorkeeper::OAuth::Scopes.from_string "app"
+          server_scopes = Doorkeeper::OAuth::Scopes.from_string "email app"
           allow(application).to receive(:scopes).and_return(application_scopes)
+          allow(request).to receive(:grant_type).and_return(Doorkeeper::OAuth::CLIENT_CREDENTIALS)
           allow(server).to receive(:scopes).and_return(server_scopes)
           allow(request).to receive(:scopes).and_return(
-            Doorkeeper::OAuth::Scopes.from_string('email')
+            Doorkeeper::OAuth::Scopes.from_string("email")
           )
           expect(subject).not_to be_valid
         end

data/spec/lib/oauth/client_credentials_integration_spec.rb

@@ -1,13 +1,15 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth
   describe ClientCredentialsRequest do
     let(:server) { Doorkeeper.configuration }
 
-    context 'with a valid request' do
+    context "with a valid request" do
       let(:client) { FactoryBot.create :application }
 
-      it 'issues an access token' do
+      it "issues an access token" do
         request = ClientCredentialsRequest.new(server, client, {})
         expect do
           request.authorize
@@ -15,12 +17,12 @@ module Doorkeeper::OAuth
       end
     end
 
-    describe 'with an invalid request' do
-      it 'does not issue an access token' do
+    describe "with an invalid request" do
+      it "does not issue an access token" do
         request = ClientCredentialsRequest.new(server, nil, {})
         expect do
           request.authorize
-        end.to_not change { Doorkeeper::AccessToken.count }
+        end.to_not(change { Doorkeeper::AccessToken.count })
       end
     end
   end

data/spec/lib/oauth/client_credentials_request_spec.rb

@@ -1,4 +1,6 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth
   describe ClientCredentialsRequest do
@@ -10,71 +12,75 @@ module Doorkeeper::OAuth
       )
     end
 
-    let(:application)   { FactoryBot.create(:application, scopes: '') }
+    let(:application)   { FactoryBot.create(:application, scopes: "") }
     let(:client)        { double :client, application: application }
     let(:token_creator) { double :issuer, create: true, token: double }
 
+    before do
+      allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
+    end
+
     subject { ClientCredentialsRequest.new(server, client) }
 
     before do
       subject.issuer = token_creator
     end
 
-    it 'issues an access token for the current client' do
+    it "issues an access token for the current client" do
       expect(token_creator).to receive(:create).with(client, nil)
       subject.authorize
     end
 
-    it 'has successful response when issue was created' do
+    it "has successful response when issue was created" do
       subject.authorize
       expect(subject.response).to be_a(TokenResponse)
     end
 
-    context 'if issue was not created' do
+    context "if issue was not created" do
       before do
         subject.issuer = double create: false, error: :invalid
       end
 
-      it 'has an error response' do
+      it "has an error response" do
         subject.authorize
         expect(subject.response).to be_a(Doorkeeper::OAuth::ErrorResponse)
       end
 
-      it 'delegates the error to issuer' do
+      it "delegates the error to issuer" do
         subject.authorize
         expect(subject.error).to eq(:invalid)
       end
     end
 
-    context 'with scopes' do
-      let(:default_scopes) { Doorkeeper::OAuth::Scopes.from_string('public email') }
+    context "with scopes" do
+      let(:default_scopes) { Doorkeeper::OAuth::Scopes.from_string("public email") }
 
       before do
         allow(server).to receive(:default_scopes).and_return(default_scopes)
       end
 
-      it 'issues an access token with default scopes if none was requested' do
+      it "issues an access token with default scopes if none was requested" do
         expect(token_creator).to receive(:create).with(client, default_scopes)
         subject.authorize
       end
 
-      it 'issues an access token with requested scopes' do
-        subject = ClientCredentialsRequest.new(server, client, scope: 'email')
+      it "issues an access token with requested scopes" do
+        subject = ClientCredentialsRequest.new(server, client, scope: "email")
         subject.issuer = token_creator
-        expect(token_creator).to receive(:create).with(client, Doorkeeper::OAuth::Scopes.from_string('email'))
+        expect(token_creator).to receive(:create).with(client, Doorkeeper::OAuth::Scopes.from_string("email"))
         subject.authorize
       end
     end
 
-    context 'with restricted client' do
+    context "with restricted client" do
       let(:default_scopes) do
-        Doorkeeper::OAuth::Scopes.from_string('public email')
+        Doorkeeper::OAuth::Scopes.from_string("public email")
       end
       let(:server_scopes) do
-        Doorkeeper::OAuth::Scopes.from_string('public email phone')
+        Doorkeeper::OAuth::Scopes.from_string("public email phone")
       end
       let(:client_scopes) do
-        Doorkeeper::OAuth::Scopes.from_string('public phone')
+        Doorkeeper::OAuth::Scopes.from_string("public phone")
       end
 
       before do
@@ -85,18 +91,18 @@ module Doorkeeper::OAuth
         allow(client).to receive(:id).and_return(nil)
       end
 
-      it 'delegates the error to issuer if no scope was requested' do
+      it "delegates the error to issuer if no scope was requested" do
         subject = ClientCredentialsRequest.new(server, client)
         subject.authorize
         expect(subject.response).to be_a(Doorkeeper::OAuth::ErrorResponse)
         expect(subject.error).to eq(:invalid_scope)
       end
 
-      it 'issues an access token with requested scopes' do
-        subject = ClientCredentialsRequest.new(server, client, scope: 'phone')
+      it "issues an access token with requested scopes" do
+        subject = ClientCredentialsRequest.new(server, client, scope: "phone")
         subject.authorize
         expect(subject.response).to be_a(Doorkeeper::OAuth::TokenResponse)
-        expect(subject.response.token.scopes_string).to eq('phone')
+        expect(subject.response.token.scopes_string).to eq("phone")
       end
     end
   end

data/spec/lib/oauth/client_spec.rb

@@ -1,34 +1,36 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth
   describe Client do
     describe :find do
       let(:method) { double }
 
-      it 'finds the client via uid' do
+      it "finds the client via uid" do
         client = double
-        expect(method).to receive(:call).with('uid').and_return(client)
-        expect(Client.find('uid', method)).to be_a(Client)
+        expect(method).to receive(:call).with("uid").and_return(client)
+        expect(Client.find("uid", method)).to be_a(Client)
       end
 
-      it 'returns nil if client was not found' do
-        expect(method).to receive(:call).with('uid').and_return(nil)
-        expect(Client.find('uid', method)).to be_nil
+      it "returns nil if client was not found" do
+        expect(method).to receive(:call).with("uid").and_return(nil)
+        expect(Client.find("uid", method)).to be_nil
       end
     end
 
     describe :authenticate do
-      it 'returns the authenticated client via credentials' do
-        credentials = Client::Credentials.new('some-uid', 'some-secret')
+      it "returns the authenticated client via credentials" do
+        credentials = Client::Credentials.new("some-uid", "some-secret")
         authenticator = double
-        expect(authenticator).to receive(:call).with('some-uid', 'some-secret').and_return(double)
+        expect(authenticator).to receive(:call).with("some-uid", "some-secret").and_return(double)
         expect(Client.authenticate(credentials, authenticator)).to be_a(Client)
       end
 
-      it 'returns nil if client was not authenticated' do
-        credentials = Client::Credentials.new('some-uid', 'some-secret')
+      it "returns nil if client was not authenticated" do
+        credentials = Client::Credentials.new("some-uid", "some-secret")
         authenticator = double
-        expect(authenticator).to receive(:call).with('some-uid', 'some-secret').and_return(nil)
+        expect(authenticator).to receive(:call).with("some-uid", "some-secret").and_return(nil)
         expect(Client.authenticate(credentials, authenticator)).to be_nil
       end
     end

data/spec/lib/oauth/code_request_spec.rb

@@ -1,4 +1,6 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth
   describe CodeRequest do
@@ -6,13 +8,13 @@ module Doorkeeper::OAuth
       double(
         :pre_auth,
         client: double(:application, id: 9990),
-        redirect_uri: 'http://tst.com/cb',
+        redirect_uri: "http://tst.com/cb",
         scopes: nil,
         state: nil,
         error: nil,
         authorizable?: true,
         code_challenge: nil,
-        code_challenge_method: nil,
+        code_challenge_method: nil
       )
     end
 
@@ -22,22 +24,22 @@ module Doorkeeper::OAuth
       CodeRequest.new(pre_auth, owner)
     end
 
-    it 'creates an access grant' do
+    it "creates an access grant" do
       expect do
         subject.authorize
       end.to change { Doorkeeper::AccessGrant.count }.by(1)
     end
 
-    it 'returns a code response' do
+    it "returns a code response" do
       expect(subject.authorize).to be_a(CodeResponse)
     end
 
-    it 'does not create grant when not authorizable' do
+    it "does not create grant when not authorizable" do
       allow(pre_auth).to receive(:authorizable?).and_return(false)
-      expect { subject.authorize }.not_to change { Doorkeeper::AccessGrant.count }
+      expect { subject.authorize }.not_to(change { Doorkeeper::AccessGrant.count })
     end
 
-    it 'returns a error response' do
+    it "returns a error response" do
       allow(pre_auth).to receive(:authorizable?).and_return(false)
       expect(subject.authorize).to be_a(ErrorResponse)
     end