doorkeeper 5.0.0 → 5.1.0

data/spec/lib/oauth/invalid_token_response_spec.rb

@@ -1,4 +1,6 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth
   describe InvalidTokenResponse do

data/spec/lib/oauth/password_access_token_request_spec.rb

@@ -1,4 +1,6 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth
   describe PasswordAccessTokenRequest do
@@ -16,87 +18,134 @@ module Doorkeeper::OAuth
     let(:client) { FactoryBot.create(:application) }
     let(:owner)  { double :owner, id: 99 }
 
+    before do
+      allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
+    end
+
     subject do
       PasswordAccessTokenRequest.new(server, client, owner)
     end
 
-    it 'issues a new token for the client' do
+    it "issues a new token for the client" do
       expect do
         subject.authorize
       end.to change { client.reload.access_tokens.count }.by(1)
-      expect(client.reload.access_tokens.sort_by(&:created_at).last.expires_in).to eq(1234)
+
+      expect(client.reload.access_tokens.max_by(&:created_at).expires_in).to eq(1234)
     end
 
-    it 'issues a new token without a client' do
+    it "issues a new token without a client" do
       expect do
         subject.client = nil
         subject.authorize
       end.to change { Doorkeeper::AccessToken.count }.by(1)
     end
 
-    it 'does not issue a new token with an invalid client' do
+    it "does not issue a new token with an invalid client" do
       expect do
         subject.client = nil
-        subject.parameters = { client_id: 'bad_id' }
+        subject.parameters = { client_id: "bad_id" }
         subject.authorize
-      end.to_not change { Doorkeeper::AccessToken.count }
+      end.not_to(change { Doorkeeper::AccessToken.count })
 
       expect(subject.error).to eq(:invalid_client)
     end
 
-    it 'requires the owner' do
+    it "requires the owner" do
       subject.resource_owner = nil
       subject.validate
       expect(subject.error).to eq(:invalid_grant)
     end
 
-    it 'optionally accepts the client' do
+    it "optionally accepts the client" do
       subject.client = nil
       expect(subject).to be_valid
     end
 
-    it 'creates token even when there is already one (default)' do
+    it "creates token even when there is already one (default)" do
       FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
+
       expect do
         subject.authorize
       end.to change { Doorkeeper::AccessToken.count }.by(1)
     end
 
-    it 'skips token creation if there is already one' do
+    it "skips token creation if there is already one reusable" do
       allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
       FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
+
       expect do
         subject.authorize
-      end.to_not change { Doorkeeper::AccessToken.count }
+      end.not_to(change { Doorkeeper::AccessToken.count })
+    end
+
+    it "creates token when there is already one but non reusable" do
+      allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
+      FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
+      allow_any_instance_of(Doorkeeper::AccessToken).to receive(:reusable?).and_return(false)
+
+      expect do
+        subject.authorize
+      end.to change { Doorkeeper::AccessToken.count }.by(1)
     end
 
     it "calls configured request callback methods" do
-      expect(Doorkeeper.configuration.before_successful_strategy_response).to receive(:call).with(subject).once
-      expect(Doorkeeper.configuration.after_successful_strategy_response).to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
+      expect(Doorkeeper.configuration.before_successful_strategy_response)
+        .to receive(:call).with(subject).once
+
+      expect(Doorkeeper.configuration.after_successful_strategy_response)
+        .to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
+
       subject.authorize
     end
 
-    describe 'with scopes' do
+    describe "with scopes" do
       subject do
-        PasswordAccessTokenRequest.new(server, client, owner, scope: 'public')
+        PasswordAccessTokenRequest.new(server, client, owner, scope: "public")
       end
 
-      it 'validates the current scope' do
-        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('another'))
-        subject.validate
-        expect(subject.error).to eq(:invalid_scope)
+      context "when scopes_by_grant_type is not configured for grant_type" do
+        it "returns error when scopes are invalid" do
+          allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("another"))
+          subject.validate
+          expect(subject.error).to eq(:invalid_scope)
+        end
+
+        it "creates the token with scopes if scopes are valid" do
+          allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
+          expect do
+            subject.authorize
+          end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+          expect(Doorkeeper::AccessToken.last.scopes).to include("public")
+        end
       end
 
-      it 'creates the token with scopes' do
-        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('public'))
-        expect do
-          subject.authorize
-        end.to change { Doorkeeper::AccessToken.count }.by(1)
-        expect(Doorkeeper::AccessToken.last.scopes).to include('public')
+      context "when scopes_by_grant_type is configured for grant_type" do
+        it "returns error when scopes are valid but not permitted for grant_type" do
+          allow(server)
+            .to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
+          allow(Doorkeeper.configuration)
+            .to receive(:scopes_by_grant_type).and_return(password: "another")
+          subject.validate
+          expect(subject.error).to eq(:invalid_scope)
+        end
+
+        it "creates the token with scopes if scopes are valid and permitted for grant_type" do
+          allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
+          allow(Doorkeeper.configuration)
+            .to receive(:scopes_by_grant_type).and_return(password: [:public])
+
+          expect do
+            subject.authorize
+          end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+          expect(Doorkeeper::AccessToken.last.scopes).to include("public")
+        end
       end
     end
 
-    describe 'with custom expiry' do
+    describe "with custom expiry" do
       let(:server) do
         double(
           :server,
@@ -104,26 +153,38 @@ module Doorkeeper::OAuth
           access_token_expires_in: 2.hours,
           refresh_token_enabled?: false,
           custom_access_token_expires_in: lambda { |context|
-            context.scopes.exists?('public') ? 222 : nil
+            if context.scopes.exists?("public")
+              222
+            elsif context.scopes.exists?("magic")
+              Float::INFINITY
+            end
           }
         )
       end
 
-      it 'checks scopes' do
-        subject = PasswordAccessTokenRequest.new(server, client, owner, scope: 'public')
-        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('public'))
+      before do
+        allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
+      end
+
+      it "checks scopes" do
+        subject = PasswordAccessTokenRequest.new(server, client, owner, scope: "public")
+        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
+
         expect do
           subject.authorize
         end.to change { Doorkeeper::AccessToken.count }.by(1)
+
         expect(Doorkeeper::AccessToken.last.expires_in).to eq(222)
       end
 
-      it 'falls back to the default otherwise' do
-        subject = PasswordAccessTokenRequest.new(server, client, owner, scope: 'private')
-        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('private'))
+      it "falls back to the default otherwise" do
+        subject = PasswordAccessTokenRequest.new(server, client, owner, scope: "private")
+        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("private"))
+
         expect do
           subject.authorize
         end.to change { Doorkeeper::AccessToken.count }.by(1)
+
         expect(Doorkeeper::AccessToken.last.expires_in).to eq(2.hours)
       end
     end

data/spec/lib/oauth/pre_authorization_spec.rb

@@ -1,29 +1,31 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth
   describe PreAuthorization do
     let(:server) do
       server = Doorkeeper.configuration
       allow(server).to receive(:default_scopes).and_return(Scopes.new)
-      allow(server).to receive(:scopes).and_return(Scopes.from_string('public profile'))
+      allow(server).to receive(:scopes).and_return(Scopes.from_string("public profile"))
       server
     end
 
     let(:application) do
       application = double :application
-      allow(application).to receive(:scopes).and_return(Scopes.from_string(''))
+      allow(application).to receive(:scopes).and_return(Scopes.from_string(""))
       application
     end
 
     let(:client) do
-      double :client, redirect_uri: 'http://tst.com/auth', application: application
+      double :client, redirect_uri: "http://tst.com/auth", application: application
     end
 
     let :attributes do
       {
-        response_type: 'code',
-        redirect_uri: 'http://tst.com/auth',
-        state: 'save-this'
+        response_type: "code",
+        redirect_uri: "http://tst.com/auth",
+        state: "save-this",
       }
     end
 
@@ -31,133 +33,157 @@ module Doorkeeper::OAuth
       PreAuthorization.new(server, client, attributes)
     end
 
-    it 'is authorizable when request is valid' do
+    it "is authorizable when request is valid" do
       expect(subject).to be_authorizable
     end
 
-    it 'accepts code as response type' do
-      subject.response_type = 'code'
+    it "accepts code as response type" do
+      subject.response_type = "code"
       expect(subject).to be_authorizable
     end
 
-    it 'accepts token as response type' do
-      allow(server).to receive(:grant_flows).and_return(['implicit'])
-      subject.response_type = 'token'
+    it "accepts token as response type" do
+      allow(server).to receive(:grant_flows).and_return(["implicit"])
+      subject.response_type = "token"
       expect(subject).to be_authorizable
     end
 
-    context 'when using default grant flows' do
+    context "when using default grant flows" do
       it 'accepts "code" as response type' do
-        subject.response_type = 'code'
+        subject.response_type = "code"
         expect(subject).to be_authorizable
       end
 
       it 'accepts "token" as response type' do
-        allow(server).to receive(:grant_flows).and_return(['implicit'])
-        subject.response_type = 'token'
+        allow(server).to receive(:grant_flows).and_return(["implicit"])
+        subject.response_type = "token"
         expect(subject).to be_authorizable
       end
     end
 
-    context 'when authorization code grant flow is disabled' do
+    context "when authorization code grant flow is disabled" do
       before do
-        allow(server).to receive(:grant_flows).and_return(['implicit'])
+        allow(server).to receive(:grant_flows).and_return(["implicit"])
       end
 
       it 'does not accept "code" as response type' do
-        subject.response_type = 'code'
+        subject.response_type = "code"
         expect(subject).not_to be_authorizable
       end
     end
 
-    context 'when implicit grant flow is disabled' do
+    context "when implicit grant flow is disabled" do
       before do
-        allow(server).to receive(:grant_flows).and_return(['authorization_code'])
+        allow(server).to receive(:grant_flows).and_return(["authorization_code"])
       end
 
       it 'does not accept "token" as response type' do
-        subject.response_type = 'token'
+        subject.response_type = "token"
         expect(subject).not_to be_authorizable
       end
     end
 
-    context 'client application does not restrict valid scopes' do
-      it 'accepts valid scopes' do
-        subject.scope = 'public'
+    context "client application does not restrict valid scopes" do
+      it "accepts valid scopes" do
+        subject.scope = "public"
+        expect(subject).to be_authorizable
+      end
+
+      it "rejects (globally) non-valid scopes" do
+        subject.scope = "invalid"
+        expect(subject).not_to be_authorizable
+      end
+
+      it "accepts scopes which are permitted for grant_type" do
+        allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:public])
+        subject.scope = "public"
         expect(subject).to be_authorizable
       end
 
-      it 'rejects (globally) non-valid scopes' do
-        subject.scope = 'invalid'
+      it "rejects scopes which are not permitted for grant_type" do
+        allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:profile])
+        subject.scope = "public"
         expect(subject).not_to be_authorizable
       end
     end
 
-    context 'client application restricts valid scopes' do
+    context "client application restricts valid scopes" do
       let(:application) do
         application = double :application
-        allow(application).to receive(:scopes).and_return(Scopes.from_string('public nonsense'))
+        allow(application).to receive(:scopes).and_return(Scopes.from_string("public nonsense"))
         application
       end
 
-      it 'accepts valid scopes' do
-        subject.scope = 'public'
+      it "accepts valid scopes" do
+        subject.scope = "public"
         expect(subject).to be_authorizable
       end
 
-      it 'rejects (globally) non-valid scopes' do
-        subject.scope = 'invalid'
+      it "rejects (globally) non-valid scopes" do
+        subject.scope = "invalid"
         expect(subject).not_to be_authorizable
       end
 
-      it 'rejects (application level) non-valid scopes' do
-        subject.scope = 'profile'
+      it "rejects (application level) non-valid scopes" do
+        subject.scope = "profile"
         expect(subject).to_not be_authorizable
       end
+
+      it "accepts scopes which are permitted for grant_type" do
+        allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:public])
+        subject.scope = "public"
+        expect(subject).to be_authorizable
+      end
+
+      it "rejects scopes which are not permitted for grant_type" do
+        allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:profile])
+        subject.scope = "public"
+        expect(subject).not_to be_authorizable
+      end
     end
 
-    it 'uses default scopes when none is required' do
-      allow(server).to receive(:default_scopes).and_return(Scopes.from_string('default'))
+    it "uses default scopes when none is required" do
+      allow(server).to receive(:default_scopes).and_return(Scopes.from_string("default"))
       subject.scope = nil
-      expect(subject.scope).to eq('default')
-      expect(subject.scopes).to eq(Scopes.from_string('default'))
+      expect(subject.scope).to eq("default")
+      expect(subject.scopes).to eq(Scopes.from_string("default"))
     end
 
-    context 'with native redirect uri' do
-      let(:native_redirect_uri) { 'urn:ietf:wg:oauth:2.0:oob' }
+    context "with native redirect uri" do
+      let(:native_redirect_uri) { "urn:ietf:wg:oauth:2.0:oob" }
 
-      it 'accepts redirect_uri when it matches with the client' do
+      it "accepts redirect_uri when it matches with the client" do
         subject.redirect_uri = native_redirect_uri
         allow(subject.client).to receive(:redirect_uri) { native_redirect_uri }
         expect(subject).to be_authorizable
       end
 
-      it 'invalidates redirect_uri when it does\'n match with the client' do
-        subject.redirect_uri = 'urn:ietf:wg:oauth:2.0:oob'
+      it "invalidates redirect_uri when it does'n match with the client" do
+        subject.redirect_uri = "urn:ietf:wg:oauth:2.0:oob"
         expect(subject).not_to be_authorizable
       end
     end
 
-    it 'matches the redirect uri against client\'s one' do
-      subject.redirect_uri = 'http://nothesame.com'
+    it "matches the redirect uri against client's one" do
+      subject.redirect_uri = "http://nothesame.com"
       expect(subject).not_to be_authorizable
     end
 
-    it 'stores the state' do
-      expect(subject.state).to eq('save-this')
+    it "stores the state" do
+      expect(subject.state).to eq("save-this")
     end
 
-    it 'rejects if response type is not allowed' do
-      subject.response_type = 'whops'
+    it "rejects if response type is not allowed" do
+      subject.response_type = "whops"
       expect(subject).not_to be_authorizable
     end
 
-    it 'requires an existing client' do
+    it "requires an existing client" do
       subject.client = nil
       expect(subject).not_to be_authorizable
     end
 
-    it 'requires a redirect uri' do
+    it "requires a redirect uri" do
       subject.redirect_uri = nil
       expect(subject).not_to be_authorizable
     end
@@ -182,7 +208,7 @@ module Doorkeeper::OAuth
         expect(json[:response_type]).to eq subject.response_type
         expect(json[:scope]).to eq subject.scope
         expect(json[:client_name]).to eq client_name
-        expect(json[:status]).to eq I18n.t('doorkeeper.pre_authorization.status')
+        expect(json[:status]).to eq I18n.t("doorkeeper.pre_authorization.status")
       end
     end
   end