doorkeeper 5.0.2 → 5.1.0.rc2

data/spec/lib/models/secret_storable_spec.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'SecretStorable' do
+  let(:clazz) do
+    Class.new do
+      include Doorkeeper::Models::SecretStorable
+
+      def self.find_by(*)
+        raise 'stub this'
+      end
+
+      def update_column(*)
+        raise 'stub this'
+      end
+
+      def token
+        raise 'stub this'
+      end
+    end
+  end
+  let(:strategy) { clazz.secret_strategy }
+
+  describe :find_by_plaintext_token do
+    subject { clazz.send(:find_by_plaintext_token, 'attr', 'input') }
+
+    it 'forwards to the secret_strategy' do
+      expect(strategy)
+        .to receive(:transform_secret)
+        .with('input')
+        .and_return 'found'
+
+      expect(clazz)
+        .to receive(:find_by)
+        .with('attr' => 'found')
+        .and_return 'result'
+
+
+      expect(subject).to eq 'result'
+    end
+
+    it 'calls find_by_fallback_token if not found' do
+      expect(clazz)
+        .to receive(:find_by)
+        .with('attr' => 'input')
+        .and_return nil
+
+      expect(clazz)
+        .to receive(:find_by_fallback_token)
+        .with('attr', 'input')
+        .and_return 'fallback'
+
+      expect(subject).to eq 'fallback'
+    end
+  end
+
+  describe :find_by_fallback_token do
+    subject { clazz.send(:find_by_fallback_token, 'attr', 'input') }
+    let(:fallback) { double(::Doorkeeper::SecretStoring::Plain) }
+
+    it 'returns nil if none defined' do
+      expect(clazz.fallback_secret_strategy).to eq nil
+      expect(subject).to eq nil
+    end
+
+    context 'if a fallback strategy is defined' do
+      let(:resource) { double('Token model') }
+      before do
+        allow(clazz).to receive(:fallback_secret_strategy).and_return(fallback)
+      end
+
+      it 'calls the strategy for lookup' do
+        expect(clazz)
+          .to receive(:find_by)
+          .with('attr' => 'fallback')
+          .and_return(resource)
+
+        expect(fallback)
+          .to receive(:transform_secret)
+          .with('input')
+          .and_return('fallback')
+
+        # store_secret will call the resource
+        expect(resource)
+          .to receive(:attr=)
+          .with('new value')
+
+        # It will upgrade the secret automtically using the current strategy
+        expect(strategy)
+          .to receive(:transform_secret)
+          .with('input')
+          .and_return('new value')
+
+        expect(resource).to receive(:update).with('attr' => 'new value')
+        expect(subject).to eq resource
+      end
+    end
+  end
+
+
+  describe :secret_strategy do
+    it 'defaults to plain strategy' do
+      expect(strategy).to eq Doorkeeper::SecretStoring::Plain
+    end
+  end
+
+  describe :fallback_secret_strategy do
+    it 'defaults to nil' do
+      expect(clazz.fallback_secret_strategy).to eq nil
+    end
+  end
+end

data/spec/lib/oauth/authorization_code_request_spec.rb

@@ -73,7 +73,7 @@ module Doorkeeper::OAuth
       expect(subject.error).to eq(:invalid_grant)
     end
 
-    it 'skips token creation if there is a matching one' do
+    it 'skips token creation if there is a matching one reusable' do
       scopes = grant.scopes
 
       Doorkeeper.configure do
@@ -88,6 +88,23 @@ module Doorkeeper::OAuth
       expect { subject.authorize }.to_not(change { Doorkeeper::AccessToken.count })
     end
 
+    it 'creates token if there is a matching one but non reusable' do
+      scopes = grant.scopes
+
+      Doorkeeper.configure do
+        orm DOORKEEPER_ORM
+        reuse_access_token
+        default_scopes(*scopes)
+      end
+
+      FactoryBot.create(:access_token, application_id: client.id,
+                                       resource_owner_id: grant.resource_owner_id, scopes: grant.scopes.to_s)
+
+      allow_any_instance_of(Doorkeeper::AccessToken).to receive(:reusable?).and_return(false)
+
+      expect { subject.authorize }.to change { Doorkeeper::AccessToken.count }.by(1)
+    end
+
     it "calls configured request callback methods" do
       expect(Doorkeeper.configuration.before_successful_strategy_response)
         .to receive(:call).with(subject).once

data/spec/lib/oauth/base_request_spec.rb

@@ -4,13 +4,13 @@ module Doorkeeper::OAuth
   describe BaseRequest do
     let(:access_token) do
       double :access_token,
-             token:              "some-token",
-             expires_in:         "3600",
-             expires_in_seconds: "300",
-             scopes_string:      "two scopes",
-             refresh_token:      "some-refresh-token",
-             token_type:         "bearer",
-             created_at:         0
+             plaintext_token:         "some-token",
+             expires_in:              "3600",
+             expires_in_seconds:      "300",
+             scopes_string:           "two scopes",
+             plaintext_refresh_token: "some-refresh-token",
+             token_type:              "bearer",
+             created_at:              0
     end
 
     let(:client) { double :client, id: '1' }

data/spec/lib/oauth/client_credentials/creator_spec.rb

@@ -15,15 +15,59 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
       end.to change { Doorkeeper::AccessToken.count }.by(1)
     end
 
-    context "when reuse_access_token is true" do
-      it "returns the existing valid token" do
-        allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-        existing_token = subject.call(client, scopes)
+    context 'when reuse_access_token is true' do
+      context 'when expiration is disabled' do
+        it 'returns the existing valid token' do
+          allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
+          existing_token = subject.call(client, scopes)
 
-        result = subject.call(client, scopes)
+          result = subject.call(client, scopes)
+
+          expect(Doorkeeper::AccessToken.count).to eq(1)
+          expect(result).to eq(existing_token)
+        end
+      end
+
+      context 'when existing token has not crossed token_reuse_limit' do
+        it 'returns the existing valid token' do
+          allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
+          allow(Doorkeeper.configuration).to receive(:token_reuse_limit).and_return(50)
+          existing_token = subject.call(client, scopes, expires_in: 1000)
+
+          allow_any_instance_of(Doorkeeper::AccessToken).to receive(:expires_in_seconds).and_return(600)
+          result = subject.call(client, scopes, expires_in: 1000)
+
+          expect(Doorkeeper::AccessToken.count).to eq(1)
+          expect(result).to eq(existing_token)
+        end
+      end
+
+      context 'when existing token has crossed token_reuse_limit' do
+        it "returns a new token" do
+          allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
+          allow(Doorkeeper.configuration).to receive(:token_reuse_limit).and_return(50)
+          existing_token = subject.call(client, scopes, expires_in: 1000)
+
+          allow_any_instance_of(Doorkeeper::AccessToken).to receive(:expires_in_seconds).and_return(400)
+          result = subject.call(client, scopes, expires_in: 1000)
+
+          expect(Doorkeeper::AccessToken.count).to eq(2)
+          expect(result).not_to eq(existing_token)
+        end
+      end
+
+      context 'when existing token has been expired' do
+        it "returns a new token" do
+          allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
+          allow(Doorkeeper.configuration).to receive(:token_reuse_limit).and_return(50)
+          existing_token = subject.call(client, scopes, expires_in: 1000)
+
+          allow_any_instance_of(Doorkeeper::AccessToken).to receive(:expired?).and_return(true)
+          result = subject.call(client, scopes, expires_in: 1000)
 
-        expect(Doorkeeper::AccessToken.count).to eq(1)
-        expect(result).to eq(existing_token)
+          expect(Doorkeeper::AccessToken.count).to eq(2)
+          expect(result).not_to eq(existing_token)
+        end
       end
     end
 

data/spec/lib/oauth/client_credentials/validation_spec.rb

@@ -21,6 +21,7 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
     context 'with scopes' do
       it 'is invalid when scopes are not included in the server' do
         server_scopes = Doorkeeper::OAuth::Scopes.from_string 'email'
+        allow(request).to receive(:grant_type).and_return(Doorkeeper::OAuth::CLIENT_CREDENTIALS)
         allow(server).to receive(:scopes).and_return(server_scopes)
         allow(request).to receive(:scopes).and_return(
           Doorkeeper::OAuth::Scopes.from_string('invalid')
@@ -34,6 +35,7 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
           server_scopes = Doorkeeper::OAuth::Scopes.from_string 'email app'
           allow(application).to receive(:scopes).and_return(application_scopes)
           allow(server).to receive(:scopes).and_return(server_scopes)
+          allow(request).to receive(:grant_type).and_return(Doorkeeper::OAuth::CLIENT_CREDENTIALS)
           allow(request).to receive(:scopes).and_return(application_scopes)
           expect(subject).to be_valid
         end
@@ -42,6 +44,7 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
           application_scopes = Doorkeeper::OAuth::Scopes.from_string 'app'
           server_scopes = Doorkeeper::OAuth::Scopes.from_string 'email app'
           allow(application).to receive(:scopes).and_return(application_scopes)
+          allow(request).to receive(:grant_type).and_return(Doorkeeper::OAuth::CLIENT_CREDENTIALS)
           allow(server).to receive(:scopes).and_return(server_scopes)
           allow(request).to receive(:scopes).and_return(
             Doorkeeper::OAuth::Scopes.from_string('email')

data/spec/lib/oauth/error_response_spec.rb

@@ -3,7 +3,13 @@ require 'spec_helper'
 module Doorkeeper::OAuth
   describe ErrorResponse do
     describe '#status' do
-      it 'should have a status of unauthorized' do
+      it 'should have a status of bad_request' do
+        expect(subject.status).to eq(:bad_request)
+      end
+
+      it 'should have a status of unauthorized for an invalid_client error' do
+        subject = described_class.new(name: :invalid_client)
+
         expect(subject.status).to eq(:unauthorized)
       end
     end

data/spec/lib/oauth/helpers/scope_checker_spec.rb

@@ -6,31 +6,31 @@ module Doorkeeper::OAuth::Helpers
 
     it 'is valid if scope is present' do
       server_scopes.add :scope
-      expect(ScopeChecker.valid?('scope', server_scopes)).to be_truthy
+      expect(ScopeChecker.valid?(scope_str: 'scope', server_scopes: server_scopes)).to be_truthy
     end
 
     it 'is invalid if includes tabs space' do
-      expect(ScopeChecker.valid?("\tsomething", server_scopes)).to be_falsey
+      expect(ScopeChecker.valid?(scope_str: "\tsomething", server_scopes: server_scopes)).to be_falsey
     end
 
     it 'is invalid if scope is not present' do
-      expect(ScopeChecker.valid?(nil, server_scopes)).to be_falsey
+      expect(ScopeChecker.valid?(scope_str: nil, server_scopes: server_scopes)).to be_falsey
     end
 
     it 'is invalid if scope is blank' do
-      expect(ScopeChecker.valid?(' ', server_scopes)).to be_falsey
+      expect(ScopeChecker.valid?(scope_str: ' ', server_scopes: server_scopes)).to be_falsey
     end
 
     it 'is invalid if includes return space' do
-      expect(ScopeChecker.valid?("scope\r", server_scopes)).to be_falsey
+      expect(ScopeChecker.valid?(scope_str: "scope\r", server_scopes: server_scopes)).to be_falsey
     end
 
     it 'is invalid if includes new lines' do
-      expect(ScopeChecker.valid?("scope\nanother", server_scopes)).to be_falsey
+      expect(ScopeChecker.valid?(scope_str: "scope\nanother", server_scopes: server_scopes)).to be_falsey
     end
 
     it 'is invalid if any scope is not included in server scopes' do
-      expect(ScopeChecker.valid?('scope another', server_scopes)).to be_falsey
+      expect(ScopeChecker.valid?(scope_str: 'scope another', server_scopes: server_scopes)).to be_falsey
     end
 
     context 'with application_scopes' do
@@ -42,19 +42,54 @@ module Doorkeeper::OAuth::Helpers
       end
 
       it 'is valid if scope is included in the application scope list' do
-        expect(ScopeChecker.valid?(
-                 'app123',
-                 server_scopes,
-                 application_scopes
-               )).to be_truthy
+        expect(ScopeChecker.valid?(scope_str: 'app123',
+                                   server_scopes: server_scopes,
+                                   app_scopes: application_scopes)).to be_truthy
       end
 
       it 'is invalid if any scope is not included in the application' do
-        expect(ScopeChecker.valid?(
-                 'svr',
-                 server_scopes,
-                 application_scopes
-               )).to be_falsey
+        expect(ScopeChecker.valid?(scope_str: 'svr',
+                                   server_scopes: server_scopes,
+                                   app_scopes: application_scopes)).to be_falsey
+      end
+    end
+
+    context 'with grant_type' do
+      let(:server_scopes) do
+        Doorkeeper::OAuth::Scopes.from_string 'scope1 scope2'
+      end
+
+      context 'with scopes_by_grant_type not configured for grant_type' do
+        it 'is valid if the scope is in server scopes' do
+          expect(ScopeChecker.valid?(scope_str: 'scope1',
+                                     server_scopes: server_scopes,
+                                     grant_type: Doorkeeper::OAuth::PASSWORD)).to be_truthy
+        end
+
+        it 'is invalid if the scope is not in server scopes' do
+          expect(ScopeChecker.valid?(scope_str: 'unknown',
+                                     server_scopes: server_scopes,
+                                     grant_type: Doorkeeper::OAuth::PASSWORD)).to be_falsey
+        end
+      end
+
+      context 'when scopes_by_grant_type configured for grant_type' do
+        before do
+          allow(Doorkeeper.configuration).to receive(:scopes_by_grant_type).
+            and_return(password: [:scope1])
+        end
+
+        it 'is valid if the scope is permitted for grant_type' do
+          expect(ScopeChecker.valid?(scope_str: 'scope1',
+                                     server_scopes: server_scopes,
+                                     grant_type: Doorkeeper::OAuth::PASSWORD)).to be_truthy
+        end
+
+        it 'is invalid if the scope is permitted for grant_type' do
+          expect(ScopeChecker.valid?(scope_str: 'scope2',
+                                     server_scopes: server_scopes,
+                                     grant_type: Doorkeeper::OAuth::PASSWORD)).to be_falsey
+        end
       end
     end
   end

data/spec/lib/oauth/helpers/uri_checker_spec.rb

@@ -61,18 +61,36 @@ module Doorkeeper::OAuth::Helpers
         expect(URIChecker.matches?(uri, client_uri)).to be_truthy
       end
 
-      it 'doesn\'t allow non-matching domains through' do
+      it "doesn't allow non-matching domains through" do
         uri = 'http://app.abc/?query=hello'
         client_uri = 'http://app.co'
         expect(URIChecker.matches?(uri, client_uri)).to be_falsey
       end
 
-      it 'doesn\'t allow non-matching domains that don\'t start at the beginning' do
+      it "doesn't allow non-matching domains that don't start at the beginning" do
         uri = 'http://app.co/?query=hello'
         client_uri = 'http://example.com?app.co=test'
         expect(URIChecker.matches?(uri, client_uri)).to be_falsey
       end
 
+      context 'loopback IP redirect URIs' do
+        it 'ignores port for same URIs' do
+          uri = 'http://127.0.0.1:5555/auth/callback'
+          client_uri = 'http://127.0.0.1:48599/auth/callback'
+          expect(URIChecker.matches?(uri, client_uri)).to be_truthy
+
+          uri = 'http://[::1]:5555/auth/callback'
+          client_uri = 'http://[::1]:5555/auth/callback'
+          expect(URIChecker.matches?(uri, client_uri)).to be_truthy
+        end
+
+        it "doesn't ignore port for URIs with different queries" do
+          uri = 'http://127.0.0.1:5555/auth/callback'
+          client_uri = 'http://127.0.0.1:48599/auth/callback2'
+          expect(URIChecker.matches?(uri, client_uri)).to be_falsey
+        end
+      end
+
       context "client registered query params" do
         it "doesn't allow query being absent" do
           uri = 'http://app.co'

data/spec/lib/oauth/password_access_token_request_spec.rb

@@ -64,7 +64,7 @@ module Doorkeeper::OAuth
       end.to change { Doorkeeper::AccessToken.count }.by(1)
     end
 
-    it 'skips token creation if there is already one' do
+    it 'skips token creation if there is already one reusable' do
       allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
       FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
 
@@ -73,6 +73,16 @@ module Doorkeeper::OAuth
       end.not_to(change { Doorkeeper::AccessToken.count })
     end
 
+    it 'creates token when there is already one but non reusable' do
+      allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
+      FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
+      allow_any_instance_of(Doorkeeper::AccessToken).to receive(:reusable?).and_return(false)
+
+      expect do
+        subject.authorize
+      end.to change { Doorkeeper::AccessToken.count }.by(1)
+    end
+
     it "calls configured request callback methods" do
       expect(Doorkeeper.configuration.before_successful_strategy_response)
         .to receive(:call).with(subject).once
@@ -88,19 +98,40 @@ module Doorkeeper::OAuth
         PasswordAccessTokenRequest.new(server, client, owner, scope: 'public')
       end
 
-      it 'validates the current scope' do
-        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('another'))
-        subject.validate
-        expect(subject.error).to eq(:invalid_scope)
+      context 'when scopes_by_grant_type is not configured for grant_type' do
+        it 'returns error when scopes are invalid' do
+          allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('another'))
+          subject.validate
+          expect(subject.error).to eq(:invalid_scope)
+        end
+
+        it 'creates the token with scopes if scopes are valid' do
+          allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('public'))
+          expect do
+            subject.authorize
+          end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+          expect(Doorkeeper::AccessToken.last.scopes).to include('public')
+        end
       end
 
-      it 'creates the token with scopes' do
-        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('public'))
-        expect do
-          subject.authorize
-        end.to change { Doorkeeper::AccessToken.count }.by(1)
-
-        expect(Doorkeeper::AccessToken.last.scopes).to include('public')
+      context 'when scopes_by_grant_type is configured for grant_type' do
+        it 'returns error when scopes are valid but not permitted for grant_type' do
+          allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('public'))
+          allow(Doorkeeper.configuration).to receive(:scopes_by_grant_type).and_return(password: 'another')
+          subject.validate
+          expect(subject.error).to eq(:invalid_scope)
+        end
+
+        it 'creates the token with scopes if scopes are valid and permitted for grant_type' do
+          allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('public'))
+          allow(Doorkeeper.configuration).to receive(:scopes_by_grant_type).and_return(password: [:public])
+          expect do
+            subject.authorize
+          end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+          expect(Doorkeeper::AccessToken.last.scopes).to include('public')
+        end
       end
     end
 

data/spec/lib/oauth/pre_authorization_spec.rb

@@ -91,6 +91,18 @@ module Doorkeeper::OAuth
         subject.scope = 'invalid'
         expect(subject).not_to be_authorizable
       end
+
+      it 'accepts scopes which are permitted for grant_type' do
+        allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:public])
+        subject.scope = 'public'
+        expect(subject).to be_authorizable
+      end
+
+      it 'rejects scopes which are not permitted for grant_type' do
+        allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:profile])
+        subject.scope = 'public'
+        expect(subject).not_to be_authorizable
+      end
     end
 
     context 'client application restricts valid scopes' do
@@ -114,6 +126,18 @@ module Doorkeeper::OAuth
         subject.scope = 'profile'
         expect(subject).to_not be_authorizable
       end
+
+      it 'accepts scopes which are permitted for grant_type' do
+        allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:public])
+        subject.scope = 'public'
+        expect(subject).to be_authorizable
+      end
+
+      it 'rejects scopes which are not permitted for grant_type' do
+        allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:profile])
+        subject.scope = 'public'
+        expect(subject).not_to be_authorizable
+      end
     end
 
     it 'uses default scopes when none is required' do

data/spec/lib/oauth/token_request_spec.rb

@@ -80,7 +80,7 @@ module Doorkeeper::OAuth
         end.to change { Doorkeeper::AccessToken.count }.by(1)
       end
 
-      it 'skips token creation if there is a matching one' do
+      it 'skips token creation if there is a matching one reusable' do
         allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
         allow(application.scopes).to receive(:has_scopes?).and_return(true)
         allow(application.scopes).to receive(:all?).and_return(true)
@@ -90,6 +90,21 @@ module Doorkeeper::OAuth
 
         expect { subject.authorize }.not_to(change { Doorkeeper::AccessToken.count })
       end
+
+      it 'creates new token if there is a matching one but non reusable' do
+        allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
+        allow(application.scopes).to receive(:has_scopes?).and_return(true)
+        allow(application.scopes).to receive(:all?).and_return(true)
+
+        FactoryBot.create(:access_token, application_id: pre_auth.client.id,
+                                         resource_owner_id: owner.id, scopes: 'public')
+
+        allow_any_instance_of(Doorkeeper::AccessToken).to receive(:reusable?).and_return(false)
+
+        expect do
+          subject.authorize
+        end.to change { Doorkeeper::AccessToken.count }.by(1)
+      end
     end
   end
 end

data/spec/lib/oauth/token_response_spec.rb

@@ -17,13 +17,13 @@ module Doorkeeper::OAuth
     describe '.body' do
       let(:access_token) do
         double :access_token,
-               token:              'some-token',
-               expires_in:         '3600',
-               expires_in_seconds: '300',
-               scopes_string:      'two scopes',
-               refresh_token:      'some-refresh-token',
-               token_type:         'bearer',
-               created_at:         0
+               plaintext_token:         "some-token",
+               expires_in:              "3600",
+               expires_in_seconds:      "300",
+               scopes_string:           "two scopes",
+               plaintext_refresh_token: "some-refresh-token",
+               token_type:              "bearer",
+               created_at:              0
       end
 
       subject { TokenResponse.new(access_token).body }
@@ -58,12 +58,12 @@ module Doorkeeper::OAuth
     describe '.body filters out empty values' do
       let(:access_token) do
         double :access_token,
-               token:              'some-token',
-               expires_in_seconds: '',
-               scopes_string:      '',
-               refresh_token:      '',
-               token_type:         'bearer',
-               created_at:         0
+               plaintext_token:         'some-token',
+               expires_in_seconds:      '',
+               scopes_string:           '',
+               plaintext_refresh_token: '',
+               token_type:              'bearer',
+               created_at:              0
       end
 
       subject { TokenResponse.new(access_token).body }

data/spec/lib/oauth/token_spec.rb

@@ -113,6 +113,20 @@ module Doorkeeper
           end
         end
 
+        context 'token hashing is enabled' do
+          include_context 'with token hashing enabled'
+
+          let(:hashed_token) { hashed_or_plain_token_func.call('token') }
+          let(:token) { ->(_r) { 'token' } }
+
+          it 'searches with the hashed token' do
+            expect(
+              AccessToken
+            ).to receive(:find_by).with(token: hashed_token).and_return(token)
+            Token.authenticate double, token
+          end
+        end
+
         context 'refresh tokens are enabled' do
           before do
             Doorkeeper.configure do