doorkeeper 5.0.0 → 5.1.0

data/spec/lib/{orm/active_record/stale_records_cleaner_spec.rb → stale_records_cleaner_spec.rb}

@@ -1,76 +1,86 @@
 # frozen_string_literal: true
 
-require 'spec_helper'
+require "spec_helper"
 
-describe Doorkeeper::Orm::ActiveRecord::StaleRecordsCleaner do
+describe Doorkeeper::StaleRecordsCleaner do
   let(:cleaner) { described_class.new(model) }
   let(:models_by_name) do
     {
       access_token: Doorkeeper::AccessToken,
-      access_grant: Doorkeeper::AccessGrant
+      access_grant: Doorkeeper::AccessGrant,
     }
   end
 
+  context "when ORM has no cleaner class" do
+    it "raises an error" do
+      allow_any_instance_of(Doorkeeper::Config).to receive(:orm).and_return("hibernate")
+
+      expect do
+        described_class.for(Doorkeeper::AccessToken)
+      end.to raise_error(Doorkeeper::Errors::NoOrmCleaner, /has no cleaner/)
+    end
+  end
+
   %i[access_token access_grant].each do |model_name|
     context "(#{model_name})" do
       let(:model) { models_by_name.fetch(model_name) }
 
-      describe '#clean_revoked' do
+      describe "#clean_revoked" do
         subject { cleaner.clean_revoked }
 
-        context 'with revoked record' do
+        context "with revoked record" do
           before do
             FactoryBot.create model_name, revoked_at: Time.current - 1.minute
           end
 
-          it 'removes the record' do
+          it "removes the record" do
             expect { subject }.to change { model.count }.to(0)
           end
         end
 
-        context 'with record revoked in the future' do
+        context "with record revoked in the future" do
           before do
             FactoryBot.create model_name, revoked_at: Time.current + 1.minute
           end
 
-          it 'keeps the record' do
-            expect { subject }.not_to change { model.count }
+          it "keeps the record" do
+            expect { subject }.not_to(change { model.count })
           end
         end
 
-        context 'with unrevoked record' do
+        context "with unrevoked record" do
           before do
             FactoryBot.create model_name, revoked_at: nil
           end
 
-          it 'keeps the record' do
-            expect { subject }.not_to change { model.count }
+          it "keeps the record" do
+            expect { subject }.not_to(change { model.count })
           end
         end
       end
 
-      describe '#clean_expired' do
+      describe "#clean_expired" do
         subject { cleaner.clean_expired(ttl) }
         let(:ttl) { 500 }
         let(:expiry_border) { ttl.seconds.ago }
 
-        context 'with record that is expired' do
+        context "with record that is expired" do
           before do
             FactoryBot.create model_name, created_at: expiry_border - 1.minute
           end
 
-          it 'removes the record' do
+          it "removes the record" do
             expect { subject }.to change { model.count }.to(0)
           end
         end
 
-        context 'with record that is not expired' do
+        context "with record that is not expired" do
           before do
             FactoryBot.create model_name, created_at: expiry_border + 1.minute
           end
 
-          it 'keeps the record' do
-            expect { subject }.not_to change { model.count }
+          it "keeps the record" do
+            expect { subject }.not_to(change { model.count })
           end
         end
       end

data/spec/models/doorkeeper/access_grant_spec.rb

@@ -1,50 +1,115 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 describe Doorkeeper::AccessGrant do
-  subject { FactoryBot.build(:access_grant) }
+  let(:client) { FactoryBot.build_stubbed(:application) }
+  let(:clazz) { Doorkeeper::AccessGrant }
+
+  subject { FactoryBot.build(:access_grant, application: client) }
 
   it { expect(subject).to be_valid }
 
-  it_behaves_like 'an accessible token'
-  it_behaves_like 'a revocable token'
-  it_behaves_like 'a unique token' do
+  it_behaves_like "an accessible token"
+  it_behaves_like "a revocable token"
+  it_behaves_like "a unique token" do
     let(:factory_name) { :access_grant }
   end
 
-  describe 'validations' do
-    it 'is invalid without resource_owner_id' do
+  context "with hashing enabled" do
+    let(:grant) { FactoryBot.create :access_grant }
+    include_context "with token hashing enabled"
+
+    it "holds a volatile plaintext token when created" do
+      expect(grant.plaintext_token).to be_a(String)
+      expect(grant.token)
+        .to eq(hashed_or_plain_token_func.call(grant.plaintext_token))
+
+      # Finder method only finds the hashed token
+      loaded = clazz.find_by(token: grant.token)
+      expect(loaded).to eq(grant)
+      expect(loaded.plaintext_token).to be_nil
+      expect(loaded.token).to eq(grant.token)
+    end
+
+    it "does not find_by plain text tokens" do
+      expect(clazz.find_by(token: grant.plaintext_token)).to be_nil
+    end
+
+    describe "with having a plain text token" do
+      let(:plain_text_token) { "plain text token" }
+
+      before do
+        # Assume we have a plain text token from before activating the option
+        grant.update_column(:token, plain_text_token)
+      end
+
+      context "without fallback lookup" do
+        it "does not provide lookups with either through by_token" do
+          expect(clazz.by_token(plain_text_token)).to eq(nil)
+          expect(clazz.by_token(grant.token)).to eq(nil)
+
+          # And it does not touch the token
+          grant.reload
+          expect(grant.token).to eq(plain_text_token)
+        end
+      end
+
+      context "with fallback lookup" do
+        include_context "with token hashing and fallback lookup enabled"
+
+        it "upgrades a plain token when falling back to it" do
+          # Side-effect: This will automatically upgrade the token
+          expect(clazz).to receive(:upgrade_fallback_value).and_call_original
+          expect(clazz.by_token(plain_text_token)).to eq(grant)
+
+          # Will find subsequently by hashing the token
+          expect(clazz.by_token(plain_text_token)).to eq(grant)
+
+          # And it modifies the token value
+          grant.reload
+          expect(grant.token).not_to eq(plain_text_token)
+          expect(clazz.find_by(token: plain_text_token)).to eq(nil)
+          expect(clazz.find_by(token: grant.token)).not_to be_nil
+        end
+      end
+    end
+  end
+
+  describe "validations" do
+    it "is invalid without resource_owner_id" do
       subject.resource_owner_id = nil
       expect(subject).not_to be_valid
     end
 
-    it 'is invalid without application_id' do
+    it "is invalid without application_id" do
       subject.application_id = nil
       expect(subject).not_to be_valid
     end
 
-    it 'is invalid without token' do
+    it "is invalid without token" do
       subject.save
       subject.token = nil
       expect(subject).not_to be_valid
     end
 
-    it 'is invalid without expires_in' do
+    it "is invalid without expires_in" do
       subject.expires_in = nil
       expect(subject).not_to be_valid
     end
   end
 
-  describe '.revoke_all_for' do
+  describe ".revoke_all_for" do
     let(:resource_owner) { double(id: 100) }
     let(:application) { FactoryBot.create :application }
     let(:default_attributes) do
       {
         application: application,
-        resource_owner_id: resource_owner.id
+        resource_owner_id: resource_owner.id,
       }
     end
 
-    it 'revokes all tokens for given application and resource owner' do
+    it "revokes all tokens for given application and resource owner" do
       FactoryBot.create :access_grant, default_attributes
 
       described_class.revoke_all_for(application.id, resource_owner)
@@ -54,7 +119,7 @@ describe Doorkeeper::AccessGrant do
       end
     end
 
-    it 'matches application' do
+    it "matches application" do
       access_grant_for_different_app = FactoryBot.create(
         :access_grant,
         default_attributes.merge(application: FactoryBot.create(:application))
@@ -65,7 +130,7 @@ describe Doorkeeper::AccessGrant do
       expect(access_grant_for_different_app.reload).not_to be_revoked
     end
 
-    it 'matches resource owner' do
+    it "matches resource owner" do
       access_grant_for_different_owner = FactoryBot.create(
         :access_grant,
         default_attributes.merge(resource_owner_id: 90)