doorkeeper 5.0.0 → 5.1.0

data/spec/lib/oauth/refresh_token_request_spec.rb

@@ -1,15 +1,12 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth
   describe RefreshTokenRequest do
-    before do
-      allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(false)
-    end
-
     let(:server) do
       double :server,
-             access_token_expires_in: 2.minutes,
-             custom_access_token_expires_in: ->(_context) { nil }
+             access_token_expires_in: 2.minutes
     end
 
     let(:refresh_token) do
@@ -19,46 +16,56 @@ module Doorkeeper::OAuth
     let(:client) { refresh_token.application }
     let(:credentials) { Client::Credentials.new(client.uid, client.secret) }
 
+    before do
+      allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(false)
+      allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(false)
+    end
+
     subject { RefreshTokenRequest.new server, refresh_token, credentials }
 
-    it 'issues a new token for the client' do
+    it "issues a new token for the client" do
       expect { subject.authorize }.to change { client.reload.access_tokens.count }.by(1)
       # #sort_by used for MongoDB ORM extensions for valid ordering
-      expect(client.reload.access_tokens.sort_by(&:created_at).last.expires_in).to eq(120)
+      expect(client.reload.access_tokens.max_by(&:created_at).expires_in).to eq(120)
     end
 
-    it 'issues a new token for the client with custom expires_in' do
+    it "issues a new token for the client with custom expires_in" do
       server = double :server,
                       access_token_expires_in: 2.minutes,
                       custom_access_token_expires_in: lambda { |context|
                         context.grant_type == Doorkeeper::OAuth::REFRESH_TOKEN ? 1234 : nil
                       }
 
+      allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
       allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(false)
 
       RefreshTokenRequest.new(server, refresh_token, credentials).authorize
 
       # #sort_by used for MongoDB ORM extensions for valid ordering
-      expect(client.reload.access_tokens.sort_by(&:created_at).last.expires_in).to eq(1234)
+      expect(client.reload.access_tokens.max_by(&:created_at).expires_in).to eq(1234)
     end
 
-    it 'revokes the previous token' do
+    it "revokes the previous token" do
       expect { subject.authorize }.to change { refresh_token.revoked? }.from(false).to(true)
     end
 
     it "calls configured request callback methods" do
-      expect(Doorkeeper.configuration.before_successful_strategy_response).to receive(:call).with(subject).once
-      expect(Doorkeeper.configuration.after_successful_strategy_response).to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
+      expect(Doorkeeper.configuration.before_successful_strategy_response)
+        .to receive(:call).with(subject).once
+
+      expect(Doorkeeper.configuration.after_successful_strategy_response)
+        .to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
+
       subject.authorize
     end
 
-    it 'requires the refresh token' do
+    it "requires the refresh token" do
       subject.refresh_token = nil
       subject.validate
       expect(subject.error).to eq(:invalid_request)
     end
 
-    it 'requires credentials to be valid if provided' do
+    it "requires credentials to be valid if provided" do
       subject.client = nil
       subject.validate
       expect(subject.error).to eq(:invalid_client)
@@ -70,20 +77,20 @@ module Doorkeeper::OAuth
       expect(subject.error).to eq(:invalid_grant)
     end
 
-    it 'rejects revoked tokens' do
+    it "rejects revoked tokens" do
       refresh_token.revoke
       subject.validate
       expect(subject.error).to eq(:invalid_grant)
     end
 
-    it 'accepts expired tokens' do
+    it "accepts expired tokens" do
       refresh_token.expires_in = -1
       refresh_token.save
       subject.validate
       expect(subject).to be_valid
     end
 
-    context 'refresh tokens expire on access token use' do
+    context "refresh tokens expire on access token use" do
       let(:server) do
         double :server,
                access_token_expires_in: 2.minutes,
@@ -96,71 +103,71 @@ module Doorkeeper::OAuth
         allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(true)
       end
 
-      it 'issues a new token for the client' do
+      it "issues a new token for the client" do
         expect { subject.authorize }.to change { client.reload.access_tokens.count }.by(1)
       end
 
-      it 'does not revoke the previous token' do
+      it "does not revoke the previous token" do
         subject.authorize
         expect(refresh_token).not_to be_revoked
       end
 
-      it 'sets the previous refresh token in the new access token' do
+      it "sets the previous refresh token in the new access token" do
         subject.authorize
         expect(
           # #sort_by used for MongoDB ORM extensions for valid ordering
-          client.access_tokens.sort_by(&:created_at).last.previous_refresh_token
+          client.access_tokens.max_by(&:created_at).previous_refresh_token
         ).to eq(refresh_token.refresh_token)
       end
     end
 
-    context 'clientless access tokens' do
+    context "clientless access tokens" do
       let!(:refresh_token) { FactoryBot.create(:clientless_access_token, use_refresh_token: true) }
 
       subject { RefreshTokenRequest.new server, refresh_token, nil }
 
-      it 'issues a new token without a client' do
+      it "issues a new token without a client" do
         expect { subject.authorize }.to change { Doorkeeper::AccessToken.count }.by(1)
       end
     end
 
-    context 'with scopes' do
+    context "with scopes" do
       let(:refresh_token) do
         FactoryBot.create :access_token,
-                           use_refresh_token: true,
-                           scopes: 'public write'
+                          use_refresh_token: true,
+                          scopes: "public write"
       end
       let(:parameters) { {} }
       subject { RefreshTokenRequest.new server, refresh_token, credentials, parameters }
 
-      it 'transfers scopes from the old token to the new token' do
+      it "transfers scopes from the old token to the new token" do
         subject.authorize
         expect(Doorkeeper::AccessToken.last.scopes).to eq(%i[public write])
       end
 
-      it 'reduces scopes to the provided scopes' do
-        parameters[:scopes] = 'public'
+      it "reduces scopes to the provided scopes" do
+        parameters[:scopes] = "public"
         subject.authorize
         expect(Doorkeeper::AccessToken.last.scopes).to eq(%i[public])
       end
 
-      it 'validates that scopes are included in the original access token' do
-        parameters[:scopes] = 'public update'
+      it "validates that scopes are included in the original access token" do
+        parameters[:scopes] = "public update"
 
         subject.validate
         expect(subject.error).to eq(:invalid_scope)
       end
 
-      it 'uses params[:scope] in favor of scopes if present (valid)' do
-        parameters[:scopes] = 'public update'
-        parameters[:scope] = 'public'
+      it "uses params[:scope] in favor of scopes if present (valid)" do
+        parameters[:scopes] = "public update"
+        parameters[:scope] = "public"
         subject.authorize
         expect(Doorkeeper::AccessToken.last.scopes).to eq(%i[public])
       end
 
-      it 'uses params[:scope] in favor of scopes if present (invalid)' do
-        parameters[:scopes] = 'public'
-        parameters[:scope] = 'public update'
+      it "uses params[:scope] in favor of scopes if present (invalid)" do
+        parameters[:scopes] = "public"
+        parameters[:scope] = "public update"
 
         subject.validate
         expect(subject.error).to eq(:invalid_scope)

data/spec/lib/oauth/scopes_spec.rb

@@ -1,113 +1,115 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth
   describe Scopes do
-    describe '#add' do
-      it 'allows you to add scopes with symbols' do
+    describe "#add" do
+      it "allows you to add scopes with symbols" do
         subject.add :public
-        expect(subject.all).to eq(['public'])
+        expect(subject.all).to eq(["public"])
       end
 
-      it 'allows you to add scopes with strings' do
-        subject.add 'public'
-        expect(subject.all).to eq(['public'])
+      it "allows you to add scopes with strings" do
+        subject.add "public"
+        expect(subject.all).to eq(["public"])
       end
 
-      it 'do not add already included scopes' do
+      it "do not add already included scopes" do
         subject.add :public
         subject.add :public
-        expect(subject.all).to eq(['public'])
+        expect(subject.all).to eq(["public"])
       end
     end
 
-    describe '#exists' do
+    describe "#exists" do
       before do
         subject.add :public
       end
 
-      it 'returns true if scope with given name is present' do
-        expect(subject.exists?('public')).to be_truthy
+      it "returns true if scope with given name is present" do
+        expect(subject.exists?("public")).to be_truthy
       end
 
-      it 'returns false if scope with given name does not exist' do
-        expect(subject.exists?('other')).to be_falsey
+      it "returns false if scope with given name does not exist" do
+        expect(subject.exists?("other")).to be_falsey
       end
 
-      it 'handles symbols' do
+      it "handles symbols" do
         expect(subject.exists?(:public)).to be_truthy
         expect(subject.exists?(:other)).to be_falsey
       end
     end
 
-    describe '.from_string' do
-      let(:string) { 'public write' }
+    describe ".from_string" do
+      let(:string) { "public write" }
 
       subject { Scopes.from_string(string) }
 
       it { expect(subject).to be_a(Scopes) }
 
-      describe '#all' do
-        it 'should be an array of the expected scopes' do
+      describe "#all" do
+        it "should be an array of the expected scopes" do
           scopes_array = subject.all
           expect(scopes_array.size).to eq(2)
-          expect(scopes_array).to include('public')
-          expect(scopes_array).to include('write')
+          expect(scopes_array).to include("public")
+          expect(scopes_array).to include("write")
         end
       end
     end
 
-    describe '#+' do
-      it 'can add to another scope object' do
-        scopes = Scopes.from_string('public') + Scopes.from_string('admin')
+    describe "#+" do
+      it "can add to another scope object" do
+        scopes = Scopes.from_string("public") + Scopes.from_string("admin")
         expect(scopes.all).to eq(%w[public admin])
       end
 
-      it 'does not change the existing object' do
-        origin = Scopes.from_string('public')
-        expect(origin.to_s).to eq('public')
+      it "does not change the existing object" do
+        origin = Scopes.from_string("public")
+        expect(origin.to_s).to eq("public")
       end
 
-      it 'can add an array to a scope object' do
-        scopes = Scopes.from_string('public') + ['admin']
+      it "can add an array to a scope object" do
+        scopes = Scopes.from_string("public") + ["admin"]
         expect(scopes.all).to eq(%w[public admin])
       end
 
-      it 'raises an error if cannot handle addition' do
+      it "raises an error if cannot handle addition" do
         expect do
-          Scopes.from_string('public') + 'admin'
+          Scopes.from_string("public") + "admin"
         end.to raise_error(NoMethodError)
       end
     end
 
-    describe '#&' do
-      it 'can get intersection with another scope object' do
-        scopes = Scopes.from_string('public admin') & Scopes.from_string('write admin')
+    describe "#&" do
+      it "can get intersection with another scope object" do
+        scopes = Scopes.from_string("public admin") & Scopes.from_string("write admin")
         expect(scopes.all).to eq(%w[admin])
       end
 
-      it 'does not change the existing object' do
-        origin = Scopes.from_string('public admin')
-        origin & Scopes.from_string('write admin')
-        expect(origin.to_s).to eq('public admin')
+      it "does not change the existing object" do
+        origin = Scopes.from_string("public admin")
+        origin & Scopes.from_string("write admin")
+        expect(origin.to_s).to eq("public admin")
       end
 
-      it 'can get intersection with an array' do
-        scopes = Scopes.from_string('public admin') & %w[write admin]
+      it "can get intersection with an array" do
+        scopes = Scopes.from_string("public admin") & %w[write admin]
         expect(scopes.all).to eq(%w[admin])
       end
     end
 
-    describe '#==' do
-      it 'is equal to another set of scopes' do
-        expect(Scopes.from_string('public')).to eq(Scopes.from_string('public'))
+    describe "#==" do
+      it "is equal to another set of scopes" do
+        expect(Scopes.from_string("public")).to eq(Scopes.from_string("public"))
       end
 
-      it 'is equal to another set of scopes with no particular order' do
-        expect(Scopes.from_string('public write')).to eq(Scopes.from_string('write public'))
+      it "is equal to another set of scopes with no particular order" do
+        expect(Scopes.from_string("public write")).to eq(Scopes.from_string("write public"))
       end
 
-      it 'differs from another set of scopes when scopes are not the same' do
-        expect(Scopes.from_string('public write')).not_to eq(Scopes.from_string('write'))
+      it "differs from another set of scopes when scopes are not the same" do
+        expect(Scopes.from_string("public write")).not_to eq(Scopes.from_string("write"))
       end
 
       it "does not raise an error when compared to a non-enumerable object" do
@@ -115,31 +117,31 @@ module Doorkeeper::OAuth
       end
     end
 
-    describe '#has_scopes?' do
-      subject { Scopes.from_string('public admin') }
+    describe "#has_scopes?" do
+      subject { Scopes.from_string("public admin") }
 
-      it 'returns true when at least one scope is included' do
-        expect(subject.has_scopes?(Scopes.from_string('public'))).to be_truthy
+      it "returns true when at least one scope is included" do
+        expect(subject.has_scopes?(Scopes.from_string("public"))).to be_truthy
       end
 
-      it 'returns true when all scopes are included' do
-        expect(subject.has_scopes?(Scopes.from_string('public admin'))).to be_truthy
+      it "returns true when all scopes are included" do
+        expect(subject.has_scopes?(Scopes.from_string("public admin"))).to be_truthy
       end
 
-      it 'is true if all scopes are included in any order' do
-        expect(subject.has_scopes?(Scopes.from_string('admin public'))).to be_truthy
+      it "is true if all scopes are included in any order" do
+        expect(subject.has_scopes?(Scopes.from_string("admin public"))).to be_truthy
       end
 
-      it 'is false if no scopes are included' do
-        expect(subject.has_scopes?(Scopes.from_string('notexistent'))).to be_falsey
+      it "is false if no scopes are included" do
+        expect(subject.has_scopes?(Scopes.from_string("notexistent"))).to be_falsey
       end
 
-      it 'returns false when any scope is not included' do
-        expect(subject.has_scopes?(Scopes.from_string('public nope'))).to be_falsey
+      it "returns false when any scope is not included" do
+        expect(subject.has_scopes?(Scopes.from_string("public nope"))).to be_falsey
       end
 
-      it 'is false if no scopes are included even for existing ones' do
-        expect(subject.has_scopes?(Scopes.from_string('public admin notexistent'))).to be_falsey
+      it "is false if no scopes are included even for existing ones" do
+        expect(subject.has_scopes?(Scopes.from_string("public admin notexistent"))).to be_falsey
       end
     end
   end

data/spec/lib/oauth/token_request_spec.rb

@@ -1,4 +1,6 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth
   describe TokenRequest do
@@ -10,9 +12,9 @@ module Doorkeeper::OAuth
       double(
         :pre_auth,
         client: application,
-        redirect_uri: 'http://tst.com/cb',
+        redirect_uri: "http://tst.com/cb",
         state: nil,
-        scopes: Scopes.from_string('public'),
+        scopes: Scopes.from_string("public"),
         error: nil,
         authorizable?: true
       )
@@ -26,69 +28,122 @@ module Doorkeeper::OAuth
       TokenRequest.new(pre_auth, owner)
     end
 
-    it 'creates an access token' do
+    it "creates an access token" do
       expect do
         subject.authorize
       end.to change { Doorkeeper::AccessToken.count }.by(1)
     end
 
-    it 'returns a code response' do
+    it "returns a code response" do
       expect(subject.authorize).to be_a(CodeResponse)
     end
 
-    it 'does not create token when not authorizable' do
+    it "does not create token when not authorizable" do
       allow(pre_auth).to receive(:authorizable?).and_return(false)
-      expect { subject.authorize }.not_to change { Doorkeeper::AccessToken.count }
+      expect { subject.authorize }.not_to(change { Doorkeeper::AccessToken.count })
     end
 
-    it 'returns a error response' do
+    it "returns a error response" do
       allow(pre_auth).to receive(:authorizable?).and_return(false)
       expect(subject.authorize).to be_a(ErrorResponse)
     end
 
-    context 'with custom expirations' do
-      before do
-        Doorkeeper.configure do
-          orm DOORKEEPER_ORM
-          custom_access_token_expires_in do |context|
-            context.grant_type == Doorkeeper::OAuth::IMPLICIT ? 1234 : nil
+    describe "with custom expiration" do
+      context "when proper TTL returned" do
+        before do
+          Doorkeeper.configure do
+            orm DOORKEEPER_ORM
+            custom_access_token_expires_in do |context|
+              context.grant_type == Doorkeeper::OAuth::IMPLICIT ? 1234 : nil
+            end
           end
         end
+
+        it "should use the custom ttl" do
+          subject.authorize
+          token = Doorkeeper::AccessToken.first
+          expect(token.expires_in).to eq(1234)
+        end
       end
 
-      it 'should use the custom ttl' do
-        subject.authorize
-        token = Doorkeeper::AccessToken.first
-        expect(token.expires_in).to eq(1234)
+      context "when nil TTL returned" do
+        before do
+          Doorkeeper.configure do
+            orm DOORKEEPER_ORM
+            access_token_expires_in 654
+            custom_access_token_expires_in do |_context|
+              nil
+            end
+          end
+        end
+
+        it "should fallback to access_token_expires_in" do
+          subject.authorize
+          token = Doorkeeper::AccessToken.first
+          expect(token.expires_in).to eq(654)
+        end
+      end
+
+      context "when infinite TTL returned" do
+        before do
+          Doorkeeper.configure do
+            orm DOORKEEPER_ORM
+            access_token_expires_in 654
+            custom_access_token_expires_in do |_context|
+              Float::INFINITY
+            end
+          end
+        end
+
+        it "should fallback to access_token_expires_in" do
+          subject.authorize
+          token = Doorkeeper::AccessToken.first
+          expect(token.expires_in).to be_nil
+        end
       end
     end
 
-    context 'token reuse' do
-      it 'creates a new token if there are no matching tokens' do
+    context "token reuse" do
+      it "creates a new token if there are no matching tokens" do
         allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
         expect do
           subject.authorize
         end.to change { Doorkeeper::AccessToken.count }.by(1)
       end
 
-      it 'creates a new token if scopes do not match' do
+      it "creates a new token if scopes do not match" do
         allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
         FactoryBot.create(:access_token, application_id: pre_auth.client.id,
-                           resource_owner_id: owner.id, scopes: '')
+                                         resource_owner_id: owner.id, scopes: "")
         expect do
           subject.authorize
         end.to change { Doorkeeper::AccessToken.count }.by(1)
       end
 
-      it 'skips token creation if there is a matching one' do
+      it "skips token creation if there is a matching one reusable" do
+        allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
+        allow(application.scopes).to receive(:has_scopes?).and_return(true)
+        allow(application.scopes).to receive(:all?).and_return(true)
+
+        FactoryBot.create(:access_token, application_id: pre_auth.client.id,
+                                         resource_owner_id: owner.id, scopes: "public")
+
+        expect { subject.authorize }.not_to(change { Doorkeeper::AccessToken.count })
+      end
+
+      it "creates new token if there is a matching one but non reusable" do
         allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
         allow(application.scopes).to receive(:has_scopes?).and_return(true)
         allow(application.scopes).to receive(:all?).and_return(true)
 
         FactoryBot.create(:access_token, application_id: pre_auth.client.id,
-                           resource_owner_id: owner.id, scopes: 'public')
+                                         resource_owner_id: owner.id, scopes: "public")
+
+        allow_any_instance_of(Doorkeeper::AccessToken).to receive(:reusable?).and_return(false)
 
-        expect { subject.authorize }.not_to change { Doorkeeper::AccessToken.count }
+        expect do
+          subject.authorize
+        end.to change { Doorkeeper::AccessToken.count }.by(1)
       end
     end
   end