doorkeeper 5.0.2 → 5.1.0.rc2

data/spec/controllers/tokens_controller_spec.rb

@@ -20,7 +20,7 @@ describe Doorkeeper::TokensController do
 
       post :create
 
-      expect(response.status).to eq 401
+      expect(response.status).to eq 400
       expect(response.headers['WWW-Authenticate']).to match(/Bearer/)
     end
   end
@@ -28,7 +28,7 @@ describe Doorkeeper::TokensController do
   describe 'when there is a failure due to a custom error' do
     it 'returns the error response with a custom message' do
       # I18n looks for `doorkeeper.errors.messages.custom_message` in locale files
-      custom_message = "my_message"
+      custom_message = 'my_message'
       allow(I18n).to receive(:translate)
         .with(
           custom_message,
@@ -49,7 +49,7 @@ describe Doorkeeper::TokensController do
         "error"             => custom_message,
         "error_description" => "Authorization custom message"
       }
-      expect(response.status).to eq 401
+      expect(response.status).to eq 400
       expect(response.headers['WWW-Authenticate']).to match(/Bearer/)
       expect(JSON.parse(response.body)).to eq expected_response_body
     end
@@ -60,21 +60,17 @@ describe Doorkeeper::TokensController do
     let(:client) { FactoryBot.create(:application) }
     let(:access_token) { FactoryBot.create(:access_token, application: client) }
 
-    before(:each) do
-      allow(controller).to receive(:token) { access_token }
-    end
-
     context 'when associated app is public' do
       let(:client) { FactoryBot.create(:application, confidential: false) }
 
       it 'returns 200' do
-        post :revoke
+        post :revoke, params: { token: access_token.token }
 
         expect(response.status).to eq 200
       end
 
       it 'revokes the access token' do
-        post :revoke
+        post :revoke, params: { token: access_token.token }
 
         expect(access_token.reload).to have_attributes(revoked?: true)
       end
@@ -89,13 +85,13 @@ describe Doorkeeper::TokensController do
       end
 
       it 'returns 200' do
-        post :revoke
+        post :revoke, params: { token: access_token.token }
 
         expect(response.status).to eq 200
       end
 
       it 'revokes the access token' do
-        post :revoke
+        post :revoke, params: { token: access_token.token }
 
         expect(access_token.reload).to have_attributes(revoked?: true)
       end
@@ -105,13 +101,13 @@ describe Doorkeeper::TokensController do
         let(:oauth_client) { Doorkeeper::OAuth::Client.new(some_other_client) }
 
         it 'returns 200' do
-          post :revoke
+          post :revoke, params: { token: access_token.token }
 
           expect(response.status).to eq 200
         end
 
         it 'does not revoke the access token' do
-          post :revoke
+          post :revoke, params: { token: access_token.token }
 
           expect(access_token.reload).to have_attributes(revoked?: false)
         end
@@ -134,28 +130,26 @@ describe Doorkeeper::TokensController do
   end
 
   describe 'when requested token introspection' do
-    context 'authorized using Bearer token' do
-      let(:client) { FactoryBot.create(:application) }
-      let(:access_token) { FactoryBot.create(:access_token, application: client) }
+    let(:client) { FactoryBot.create(:application) }
+    let(:access_token) { FactoryBot.create(:access_token, application: client) }
+    let(:token_for_introspection) { FactoryBot.create(:access_token, application: client) }
 
+    context 'authorized using valid Bearer token' do
       it 'responds with full token introspection' do
         request.headers['Authorization'] = "Bearer #{access_token.token}"
 
-        post :introspect, params: { token: access_token.token }
+        post :introspect, params: { token: token_for_introspection.token }
 
         should_have_json 'active', true
         expect(json_response).to include('client_id', 'token_type', 'exp', 'iat')
       end
     end
 
-    context 'authorized using Client Authentication' do
-      let(:client) { FactoryBot.create(:application) }
-      let(:access_token) { FactoryBot.create(:access_token, application: client) }
-
+    context 'authorized using valid Client Authentication' do
       it 'responds with full token introspection' do
         request.headers['Authorization'] = basic_auth_header_for_client(client)
 
-        post :introspect, params: { token: access_token.token }
+        post :introspect, params: { token: token_for_introspection.token }
 
         should_have_json 'active', true
         expect(json_response).to include('client_id', 'token_type', 'exp', 'iat')
@@ -163,14 +157,37 @@ describe Doorkeeper::TokensController do
       end
     end
 
+    context 'using custom introspection response' do
+      before do
+        Doorkeeper.configure do
+          orm DOORKEEPER_ORM
+          custom_introspection_response do |_token, _context|
+            {
+              sub: 'Z5O3upPC88QrAjx00dis',
+              aud: 'https://protected.example.net/resource'
+            }
+          end
+        end
+      end
+
+      it 'responds with full token introspection' do
+        request.headers['Authorization'] = "Bearer #{access_token.token}"
+
+        post :introspect, params: { token: token_for_introspection.token }
+
+        expect(json_response).to include('client_id', 'token_type', 'exp', 'iat', 'sub', 'aud')
+        should_have_json 'sub', 'Z5O3upPC88QrAjx00dis'
+        should_have_json 'aud', 'https://protected.example.net/resource'
+      end
+    end
+
     context 'public access token' do
-      let(:client) { FactoryBot.create(:application) }
-      let(:access_token) { FactoryBot.create(:access_token, application: nil) }
+      let(:token_for_introspection) { FactoryBot.create(:access_token, application: nil) }
 
       it 'responds with full token introspection' do
         request.headers['Authorization'] = basic_auth_header_for_client(client)
 
-        post :introspect, params: { token: access_token.token }
+        post :introspect, params: { token: token_for_introspection.token }
 
         should_have_json 'active', true
         expect(json_response).to include('client_id', 'token_type', 'exp', 'iat')
@@ -179,14 +196,12 @@ describe Doorkeeper::TokensController do
     end
 
     context 'token was issued to a different client than is making this request' do
-      let(:client) { FactoryBot.create(:application) }
       let(:different_client) { FactoryBot.create(:application) }
-      let(:access_token) { FactoryBot.create(:access_token, application: client) }
 
       it 'responds with only active state' do
         request.headers['Authorization'] = basic_auth_header_for_client(different_client)
 
-        post :introspect, params: { token: access_token.token }
+        post :introspect, params: { token: token_for_introspection.token }
 
         expect(response).to be_successful
 
@@ -195,6 +210,36 @@ describe Doorkeeper::TokensController do
       end
     end
 
+    context 'authorized using invalid Bearer token' do
+      let(:token_for_introspection) do
+        FactoryBot.create(:access_token, application: client, revoked_at: 1.day.ago)
+      end
+
+      it 'responds with invalid token error' do
+        request.headers['Authorization'] = "Bearer #{token_for_introspection.token}"
+
+        post :introspect, params: { token: access_token.token }
+
+        response_status_should_be 401
+
+        should_not_have_json 'active'
+        should_have_json 'error', 'invalid_token'
+      end
+    end
+
+    context 'authorized using the Bearer token that need to be introspected' do
+      it 'responds with invalid token error' do
+        request.headers['Authorization'] = "Bearer #{access_token.token}"
+
+        post :introspect, params: { token: access_token.token }
+
+        response_status_should_be 401
+
+        should_not_have_json 'active'
+        should_have_json 'error', 'invalid_token'
+      end
+    end
+
     context 'using invalid credentials to authorize' do
       let(:client) { double(uid: '123123', secret: '666999') }
       let(:access_token) { FactoryBot.create(:access_token) }
@@ -213,9 +258,6 @@ describe Doorkeeper::TokensController do
     end
 
     context 'using wrong token value' do
-      let(:client) { FactoryBot.create(:application) }
-      let(:access_token) { FactoryBot.create(:access_token, application: client) }
-
       it 'responds with only active state' do
         request.headers['Authorization'] = basic_auth_header_for_client(client)
 
@@ -226,14 +268,15 @@ describe Doorkeeper::TokensController do
       end
     end
 
-    context 'when requested Access Token expired' do
-      let(:client) { FactoryBot.create(:application) }
-      let(:access_token) { FactoryBot.create(:access_token, application: client, created_at: 1.year.ago) }
+    context 'when requested access token expired' do
+      let(:token_for_introspection) do
+        FactoryBot.create(:access_token, application: client, created_at: 1.year.ago)
+      end
 
       it 'responds with only active state' do
         request.headers['Authorization'] = basic_auth_header_for_client(client)
 
-        post :introspect, params: { token: access_token.token }
+        post :introspect, params: { token: token_for_introspection.token }
 
         should_have_json 'active', false
         expect(json_response).not_to include('client_id', 'token_type', 'exp', 'iat')
@@ -241,13 +284,14 @@ describe Doorkeeper::TokensController do
     end
 
     context 'when requested Access Token revoked' do
-      let(:client) { FactoryBot.create(:application) }
-      let(:access_token) { FactoryBot.create(:access_token, application: client, revoked_at: 1.year.ago) }
+      let(:token_for_introspection) do
+        FactoryBot.create(:access_token, application: client, revoked_at: 1.year.ago)
+      end
 
       it 'responds with only active state' do
         request.headers['Authorization'] = basic_auth_header_for_client(client)
 
-        post :introspect, params: { token: access_token.token }
+        post :introspect, params: { token: token_for_introspection.token }
 
         should_have_json 'active', false
         expect(json_response).not_to include('client_id', 'token_type', 'exp', 'iat')
@@ -255,13 +299,13 @@ describe Doorkeeper::TokensController do
     end
 
     context 'unauthorized (no bearer token or client credentials)' do
-      let(:access_token) { FactoryBot.create(:access_token) }
+      let(:token_for_introspection) { FactoryBot.create(:access_token) }
 
       it 'responds with invalid_request error' do
-        post :introspect, params: { token: access_token.token }
+        post :introspect, params: { token: token_for_introspection.token }
 
         expect(response).not_to be_successful
-        response_status_should_be 401
+        response_status_should_be 400
 
         should_not_have_json 'active'
         should_have_json 'error', 'invalid_request'

data/spec/dummy/app/controllers/application_controller.rb

@@ -1,3 +1,3 @@
 class ApplicationController < ActionController::Base
-  protect_from_forgery
+  protect_from_forgery with: :exception
 end

data/spec/dummy/config/application.rb

@@ -1,6 +1,17 @@
 require File.expand_path('boot', __dir__)
 
-require 'rails/all'
+require "rails"
+
+%w[
+  action_controller/railtie
+  action_view/railtie
+  sprockets/railtie
+].each do |railtie|
+  begin
+    require railtie
+  rescue LoadError
+  end
+end
 
 Bundler.require(*Rails.groups)
 

data/spec/factories.rb

@@ -1,5 +1,5 @@
 FactoryBot.define do
-  factory :access_grant, class: Doorkeeper::AccessGrant do
+  factory :access_grant, class: "Doorkeeper::AccessGrant" do
     sequence(:resource_owner_id) { |n| n }
     application
     redirect_uri { 'https://app.com/callback' }
@@ -7,7 +7,7 @@ FactoryBot.define do
     scopes { 'public write' }
   end
 
-  factory :access_token, class: Doorkeeper::AccessToken do
+  factory :access_token, class: "Doorkeeper::AccessToken" do
     sequence(:resource_owner_id) { |n| n }
     application
     expires_in { 2.hours }
@@ -17,7 +17,7 @@ FactoryBot.define do
     end
   end
 
-  factory :application, class: Doorkeeper::Application do
+  factory :application, class: "Doorkeeper::Application" do
     sequence(:name) { |n| "Application #{n}" }
     redirect_uri { 'https://app.com/callback' }
   end

data/spec/lib/config_spec.rb

@@ -141,6 +141,22 @@ describe Doorkeeper, 'configuration' do
     end
   end
 
+  describe 'scopes_by_grant_type' do
+    it 'is {} by default' do
+      expect(subject.scopes_by_grant_type).to eq({})
+    end
+
+    it 'has hash value' do
+      hash = {}
+      Doorkeeper.configure do
+        orm DOORKEEPER_ORM
+        scopes_by_grant_type hash
+      end
+
+      expect(subject.scopes_by_grant_type).to eq(hash)
+    end
+  end
+
   describe 'use_refresh_token' do
     it 'is false by default' do
       expect(subject.refresh_token_enabled?).to eq(false)
@@ -191,6 +207,31 @@ describe Doorkeeper, 'configuration' do
     end
   end
 
+  describe 'token_reuse_limit' do
+    it 'is 100 by default' do
+      expect(subject.token_reuse_limit).to eq(100)
+    end
+
+    it 'can change the value' do
+      Doorkeeper.configure do
+        token_reuse_limit 90
+      end
+
+      expect(subject.token_reuse_limit).to eq(90)
+    end
+
+    it 'sets the value to 100 if invalid value is being set' do
+      expect(Rails.logger).to receive(:warn).with(/will be set to default 100/)
+
+      Doorkeeper.configure do
+        reuse_access_token
+        token_reuse_limit 110
+      end
+
+      expect(subject.token_reuse_limit).to eq(100)
+    end
+  end
+
   describe 'enforce_configured_scopes' do
     it 'is false by default' do
       expect(subject.enforce_configured_scopes?).to eq(false)
@@ -441,6 +482,22 @@ describe Doorkeeper, 'configuration' do
     end
   end
 
+  describe 'default_generator_method' do
+    it "is :urlsafe_base64 by default" do
+      expect(Doorkeeper.configuration.default_generator_method)
+        .to eq(:urlsafe_base64)
+    end
+
+    it 'can change the value' do
+      Doorkeeper.configure do
+        orm DOORKEEPER_ORM
+        default_generator_method :hex
+      end
+
+      expect(subject.default_generator_method).to eq(:hex)
+    end
+  end
+
   describe 'base_controller' do
     context 'default' do
       it { expect(Doorkeeper.configuration.base_controller).to eq('ActionController::Base') }
@@ -525,4 +582,115 @@ describe Doorkeeper, 'configuration' do
       expect(subject.handle_auth_errors).to eq(:raise)
     end
   end
+
+  describe 'token_secret_strategy' do
+    it 'is plain by default' do
+      expect(subject.token_secret_strategy).to eq(Doorkeeper::SecretStoring::Plain)
+      expect(subject.token_secret_fallback_strategy).to eq(nil)
+    end
+
+    context 'when provided' do
+      before do
+        Doorkeeper.configure do
+          hash_token_secrets
+        end
+      end
+
+      it 'will enable hashing for applications' do
+        expect(subject.token_secret_strategy).to eq(Doorkeeper::SecretStoring::Sha256Hash)
+        expect(subject.token_secret_fallback_strategy).to eq(nil)
+      end
+    end
+
+    context 'when manually provided with invalid constant' do
+      it 'raises an exception' do
+        expect {
+          Doorkeeper.configure do
+            hash_token_secrets using: 'does not exist'
+          end
+        }.to raise_error(NameError)
+      end
+    end
+
+    context 'when manually provided with invalid option' do
+      it 'raises an exception' do
+        expect do
+          Doorkeeper.configure do
+            hash_token_secrets using: 'Doorkeeper::SecretStoring::BCrypt'
+          end
+        end.to raise_error(ArgumentError,
+                           /can only be used for storing application secrets/)
+      end
+    end
+
+    context 'when provided with fallback' do
+      before do
+        Doorkeeper.configure do
+          hash_token_secrets fallback: :plain
+        end
+      end
+
+      it 'will enable hashing for applications' do
+        expect(subject.token_secret_strategy).to eq(Doorkeeper::SecretStoring::Sha256Hash)
+        expect(subject.token_secret_fallback_strategy).to eq(Doorkeeper::SecretStoring::Plain)
+      end
+    end
+
+
+    describe 'hash_token_secrets together with reuse_access_token' do
+      it 'will disable reuse_access_token' do
+        expect(Rails.logger).to receive(:warn).with(/reuse_access_token will be disabled/)
+
+        Doorkeeper.configure do
+          reuse_access_token
+          hash_token_secrets
+        end
+
+        expect(subject.reuse_access_token).to eq(false)
+      end
+    end
+  end
+
+  describe 'application_secret_strategy' do
+    it 'is plain by default' do
+      expect(subject.application_secret_strategy).to eq(Doorkeeper::SecretStoring::Plain)
+      expect(subject.application_secret_fallback_strategy).to eq(nil)
+    end
+
+    context 'when provided' do
+      before do
+        Doorkeeper.configure do
+          hash_application_secrets
+        end
+      end
+
+      it 'will enable hashing for applications' do
+        expect(subject.application_secret_strategy).to eq(Doorkeeper::SecretStoring::Sha256Hash)
+        expect(subject.application_secret_fallback_strategy).to eq(nil)
+      end
+    end
+
+    context 'when manually provided with invalid constant' do
+      it 'raises an exception' do
+        expect {
+          Doorkeeper.configure do
+            hash_application_secrets using: 'does not exist'
+          end
+        }.to raise_error(NameError)
+      end
+    end
+
+    context 'when provided with fallback' do
+      before do
+        Doorkeeper.configure do
+          hash_application_secrets fallback: :plain
+        end
+      end
+
+      it 'will enable hashing for applications' do
+        expect(subject.application_secret_strategy).to eq(Doorkeeper::SecretStoring::Sha256Hash)
+        expect(subject.application_secret_fallback_strategy).to eq(Doorkeeper::SecretStoring::Plain)
+      end
+    end
+  end
 end

data/spec/lib/models/expirable_spec.rb

@@ -44,4 +44,16 @@ describe 'Expirable' do
       expect(subject.expires_in_seconds).to be_nil
     end
   end
+
+  describe :expires_at do
+    it 'should return the expiration time of the token' do
+      allow(subject).to receive(:expires_in).and_return(2.minutes)
+      expect(subject.expires_at).to be_a(Time)
+    end
+
+    it 'should return nil when expires_in is nil' do
+      allow(subject).to receive(:expires_in).and_return(nil)
+      expect(subject.expires_at).to be_nil
+    end
+  end
 end

data/spec/lib/models/reusable_spec.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'Reusable' do
+  subject do
+    Class.new do
+      include Doorkeeper::Models::Reusable
+    end.new
+  end
+
+  describe :reusable? do
+    it 'is reusable if its expires_in is nil' do
+      allow(subject).to receive(:expired?).and_return(false)
+      allow(subject).to receive(:expires_in).and_return(nil)
+      expect(subject).to be_reusable
+    end
+
+    it 'is reusable if its expiry has crossed reusable limit' do
+      allow(subject).to receive(:expired?).and_return(false)
+      allow(Doorkeeper.configuration).to receive(:token_reuse_limit).and_return(90)
+      allow(subject).to receive(:expires_in).and_return(100.seconds)
+      allow(subject).to receive(:expires_in_seconds).and_return(20.seconds)
+      expect(subject).to be_reusable
+    end
+
+    it 'is not reusable if its expiry has crossed reusable limit' do
+      allow(subject).to receive(:expired?).and_return(false)
+      allow(Doorkeeper.configuration).to receive(:token_reuse_limit).and_return(90)
+      allow(subject).to receive(:expires_in).and_return(100.seconds)
+      allow(subject).to receive(:expires_in_seconds).and_return(5.seconds)
+      expect(subject).not_to be_reusable
+    end
+
+    it 'is not reusable if it is already expired' do
+      allow(subject).to receive(:expired?).and_return(true)
+      expect(subject).not_to be_reusable
+    end
+  end
+end

data/spec/lib/models/scopes_spec.rb

@@ -2,7 +2,7 @@ require 'spec_helper'
 
 describe 'Doorkeeper::Models::Scopes' do
   subject do
-    Class.new(Hash) do
+    Class.new(Struct.new(:scopes)) do
       include Doorkeeper::Models::Scopes
     end.new
   end
@@ -21,6 +21,18 @@ describe 'Doorkeeper::Models::Scopes' do
     end
   end
 
+  describe :scopes= do
+    it 'accepts String' do
+      subject.scopes = 'private admin'
+      expect(subject.scopes_string).to eq('private admin')
+    end
+
+    it 'accepts Array' do
+      subject.scopes = %w[private admin]
+      expect(subject.scopes_string).to eq('private admin')
+    end
+  end
+
   describe :scopes_string do
     it 'is a `Scopes` class' do
       expect(subject.scopes_string).to eq('public admin')