doorkeeper 5.0.3 → 5.1.0.rc1

data/spec/lib/oauth/password_access_token_request_spec.rb

@@ -88,19 +88,40 @@ module Doorkeeper::OAuth
         PasswordAccessTokenRequest.new(server, client, owner, scope: 'public')
       end
 
-      it 'validates the current scope' do
-        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('another'))
-        subject.validate
-        expect(subject.error).to eq(:invalid_scope)
+      context 'when scopes_by_grant_type is not configured for grant_type' do
+        it 'returns error when scopes are invalid' do
+          allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('another'))
+          subject.validate
+          expect(subject.error).to eq(:invalid_scope)
+        end
+
+        it 'creates the token with scopes if scopes are valid' do
+          allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('public'))
+          expect do
+            subject.authorize
+          end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+          expect(Doorkeeper::AccessToken.last.scopes).to include('public')
+        end
       end
 
-      it 'creates the token with scopes' do
-        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('public'))
-        expect do
-          subject.authorize
-        end.to change { Doorkeeper::AccessToken.count }.by(1)
-
-        expect(Doorkeeper::AccessToken.last.scopes).to include('public')
+      context 'when scopes_by_grant_type is configured for grant_type' do
+        it 'returns error when scopes are valid but not permitted for grant_type' do
+          allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('public'))
+          allow(Doorkeeper.configuration).to receive(:scopes_by_grant_type).and_return(password: 'another')
+          subject.validate
+          expect(subject.error).to eq(:invalid_scope)
+        end
+
+        it 'creates the token with scopes if scopes are valid and permitted for grant_type' do
+          allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('public'))
+          allow(Doorkeeper.configuration).to receive(:scopes_by_grant_type).and_return(password: [:public])
+          expect do
+            subject.authorize
+          end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+          expect(Doorkeeper::AccessToken.last.scopes).to include('public')
+        end
       end
     end
 

data/spec/lib/oauth/pre_authorization_spec.rb

@@ -91,6 +91,18 @@ module Doorkeeper::OAuth
         subject.scope = 'invalid'
         expect(subject).not_to be_authorizable
       end
+
+      it 'accepts scopes which are permitted for grant_type' do
+        allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:public])
+        subject.scope = 'public'
+        expect(subject).to be_authorizable
+      end
+
+      it 'rejects scopes which are not permitted for grant_type' do
+        allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:profile])
+        subject.scope = 'public'
+        expect(subject).not_to be_authorizable
+      end
     end
 
     context 'client application restricts valid scopes' do
@@ -114,6 +126,18 @@ module Doorkeeper::OAuth
         subject.scope = 'profile'
         expect(subject).to_not be_authorizable
       end
+
+      it 'accepts scopes which are permitted for grant_type' do
+        allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:public])
+        subject.scope = 'public'
+        expect(subject).to be_authorizable
+      end
+
+      it 'rejects scopes which are not permitted for grant_type' do
+        allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:profile])
+        subject.scope = 'public'
+        expect(subject).not_to be_authorizable
+      end
     end
 
     it 'uses default scopes when none is required' do

data/spec/lib/oauth/token_response_spec.rb

@@ -17,13 +17,13 @@ module Doorkeeper::OAuth
     describe '.body' do
       let(:access_token) do
         double :access_token,
-               token:              'some-token',
-               expires_in:         '3600',
-               expires_in_seconds: '300',
-               scopes_string:      'two scopes',
-               refresh_token:      'some-refresh-token',
-               token_type:         'bearer',
-               created_at:         0
+               plaintext_token:         "some-token",
+               expires_in:              "3600",
+               expires_in_seconds:      "300",
+               scopes_string:           "two scopes",
+               plaintext_refresh_token: "some-refresh-token",
+               token_type:              "bearer",
+               created_at:              0
       end
 
       subject { TokenResponse.new(access_token).body }
@@ -58,12 +58,12 @@ module Doorkeeper::OAuth
     describe '.body filters out empty values' do
       let(:access_token) do
         double :access_token,
-               token:              'some-token',
-               expires_in_seconds: '',
-               scopes_string:      '',
-               refresh_token:      '',
-               token_type:         'bearer',
-               created_at:         0
+               plaintext_token:         'some-token',
+               expires_in_seconds:      '',
+               scopes_string:           '',
+               plaintext_refresh_token: '',
+               token_type:              'bearer',
+               created_at:              0
       end
 
       subject { TokenResponse.new(access_token).body }

data/spec/lib/oauth/token_spec.rb

@@ -113,6 +113,20 @@ module Doorkeeper
           end
         end
 
+        context 'token hashing is enabled' do
+          include_context 'with token hashing enabled'
+
+          let(:hashed_token) { hashed_or_plain_token_func.call('token') }
+          let(:token) { ->(_r) { 'token' } }
+
+          it 'searches with the hashed token' do
+            expect(
+              AccessToken
+            ).to receive(:find_by).with(token: hashed_token).and_return(token)
+            Token.authenticate double, token
+          end
+        end
+
         context 'refresh tokens are enabled' do
           before do
             Doorkeeper.configure do

data/spec/models/doorkeeper/access_grant_spec.rb

@@ -1,6 +1,7 @@
 require 'spec_helper'
 
 describe Doorkeeper::AccessGrant do
+  let(:clazz) { Doorkeeper::AccessGrant }
   subject { FactoryBot.build(:access_grant) }
 
   it { expect(subject).to be_valid }
@@ -11,6 +12,66 @@ describe Doorkeeper::AccessGrant do
     let(:factory_name) { :access_grant }
   end
 
+  context 'with hashing enabled' do
+    let(:grant) { FactoryBot.create :access_grant }
+    include_context 'with token hashing enabled'
+
+    it 'holds a volatile plaintext token when created' do
+      expect(grant.plaintext_token).to be_a(String)
+      expect(grant.token)
+        .to eq(hashed_or_plain_token_func.call(grant.plaintext_token))
+
+      # Finder method only finds the hashed token
+      loaded = clazz.find_by(token: grant.token)
+      expect(loaded).to eq(grant)
+      expect(loaded.plaintext_token).to be_nil
+      expect(loaded.token).to eq(grant.token)
+    end
+
+    it 'does not find_by plain text tokens' do
+      expect(clazz.find_by(token: grant.plaintext_token)).to be_nil
+    end
+
+    describe 'with having a plain text token' do
+      let(:plain_text_token) { 'plain text token' }
+
+      before do
+        # Assume we have a plain text token from before activating the option
+        grant.update_column(:token, plain_text_token)
+      end
+
+      context 'without fallback lookup' do
+        it 'does not provide lookups with either through by_token' do
+          expect(clazz.by_token(plain_text_token)).to eq(nil)
+          expect(clazz.by_token(grant.token)).to eq(nil)
+
+          # And it does not touch the token
+          grant.reload
+          expect(grant.token).to eq(plain_text_token)
+        end
+      end
+
+      context 'with fallback lookup' do
+        include_context 'with token hashing and fallback lookup enabled'
+
+        it 'upgrades a plain token when falling back to it' do
+          # Side-effect: This will automatically upgrade the token
+          expect(clazz).to receive(:upgrade_fallback_value).and_call_original
+          expect(clazz.by_token(plain_text_token)).to eq(grant)
+
+          # Will find subsequently by hashing the token
+          expect(clazz.by_token(plain_text_token)).to eq(grant)
+
+          # And it modifies the token value
+          grant.reload
+          expect(grant.token).not_to eq(plain_text_token)
+          expect(clazz.find_by(token: plain_text_token)).to eq(nil)
+          expect(clazz.find_by(token: grant.token)).not_to be_nil
+        end
+      end
+    end
+  end
+
   describe 'validations' do
     it 'is invalid without resource_owner_id' do
       subject.resource_owner_id = nil

data/spec/models/doorkeeper/access_token_spec.rb

@@ -2,6 +2,7 @@ require 'spec_helper'
 
 module Doorkeeper
   describe AccessToken do
+    let(:clazz) { Doorkeeper::AccessToken }
     subject { FactoryBot.build(:access_token) }
 
     it { expect(subject).to be_valid }
@@ -24,6 +25,67 @@ module Doorkeeper
         expect(token.token).to be_a(String)
       end
 
+      context 'with hashing enabled' do
+        let(:token) { FactoryBot.create :access_token }
+        include_context 'with token hashing enabled'
+
+        it 'holds a volatile plaintext token when created' do
+          expect(token.plaintext_token).to be_a(String)
+          expect(token.token)
+            .to eq(hashed_or_plain_token_func.call(token.plaintext_token))
+
+          # Finder method only finds the hashed token
+          loaded = clazz.find_by(token: token.token)
+          expect(loaded).to eq(token)
+          expect(loaded.plaintext_token).to be_nil
+          expect(loaded.token).to eq(token.token)
+        end
+
+        it 'does not find_by plain text tokens' do
+          expect(clazz.find_by(token: token.plaintext_token)).to be_nil
+        end
+
+        describe 'with having a plain text token' do
+          let(:plain_text_token) { 'plain text token' }
+          let(:access_token) { FactoryBot.create :access_token }
+
+          before do
+            # Assume we have a plain text token from before activating the option
+            access_token.update_column(:token, plain_text_token)
+          end
+
+          context 'without fallback lookup' do
+            it 'does not provide lookups with either through by_token' do
+              expect(clazz.by_token(plain_text_token)).to eq(nil)
+              expect(clazz.by_token(access_token.token)).to eq(nil)
+
+              # And it does not touch the token
+              access_token.reload
+              expect(access_token.token).to eq(plain_text_token)
+            end
+          end
+
+          context 'with fallback lookup' do
+            include_context 'with token hashing and fallback lookup enabled'
+
+            it 'upgrades a plain token when falling back to it' do
+              # Side-effect: This will automatically upgrade the token
+              expect(clazz).to receive(:upgrade_fallback_value).and_call_original
+              expect(clazz.by_token(plain_text_token)).to eq(access_token)
+
+              # Will find subsequently by hashing the token
+              expect(clazz.by_token(plain_text_token)).to eq(access_token)
+
+              # And it modifies the token value
+              access_token.reload
+              expect(access_token.token).not_to eq(plain_text_token)
+              expect(clazz.find_by(token: plain_text_token)).to eq(nil)
+              expect(clazz.find_by(token: access_token.token)).not_to be_nil
+            end
+          end
+        end
+      end
+
       it 'generates a token using a custom object' do
         eigenclass = class << CustomGeneratorArgs; self; end
         eigenclass.class_eval do
@@ -196,6 +258,67 @@ module Doorkeeper
           token2.save(validate: false)
         end.to raise_error(uniqueness_error)
       end
+
+      context 'with hashing enabled' do
+        include_context 'with token hashing enabled'
+        let(:token) { FactoryBot.create :access_token, use_refresh_token: true }
+
+        it 'holds a volatile refresh token when created' do
+          expect(token.plaintext_refresh_token).to be_a(String)
+          expect(token.refresh_token)
+            .to eq(hashed_or_plain_token_func.call(token.plaintext_refresh_token))
+
+          # Finder method only finds the hashed token
+          loaded = clazz.find_by(refresh_token: token.refresh_token)
+          expect(loaded).to eq(token)
+          expect(loaded.plaintext_refresh_token).to be_nil
+          expect(loaded.refresh_token).to eq(token.refresh_token)
+        end
+
+        it 'does not find_by plain text refresh tokens' do
+          expect(clazz.find_by(refresh_token: token.plaintext_refresh_token)).to be_nil
+        end
+
+        describe 'with having a plain text token' do
+          let(:plain_refresh_token) { 'plain refresh token' }
+          let(:access_token) { FactoryBot.create :access_token }
+
+          before do
+            # Assume we have a plain text token from before activating the option
+            access_token.update_column(:refresh_token, plain_refresh_token)
+          end
+
+          context 'without fallback lookup' do
+            it 'does not provide lookups with either through by_token' do
+              expect(clazz.by_refresh_token(plain_refresh_token)).to eq(nil)
+              expect(clazz.by_refresh_token(access_token.refresh_token)).to eq(nil)
+
+              # And it does not touch the token
+              access_token.reload
+              expect(access_token.refresh_token).to eq(plain_refresh_token)
+            end
+          end
+
+          context 'with fallback lookup' do
+            include_context 'with token hashing and fallback lookup enabled'
+
+            it 'upgrades a plain token when falling back to it' do
+              # Side-effect: This will automatically upgrade the token
+              expect(clazz).to receive(:upgrade_fallback_value).and_call_original
+              expect(clazz.by_refresh_token(plain_refresh_token)).to eq(access_token)
+
+              # Will find subsequently by hashing the token
+              expect(clazz.by_refresh_token(plain_refresh_token)).to eq(access_token)
+
+              # And it modifies the token value
+              access_token.reload
+              expect(access_token.refresh_token).not_to eq(plain_refresh_token)
+              expect(clazz.find_by(refresh_token: plain_refresh_token)).to eq(nil)
+              expect(clazz.find_by(refresh_token: access_token.refresh_token)).not_to be_nil
+            end
+          end
+        end
+      end
     end
 
     describe 'validations' do

data/spec/models/doorkeeper/application_spec.rb

@@ -1,374 +1,306 @@
-# frozen_string_literal: true
+require 'spec_helper'
 
-require "spec_helper"
+module Doorkeeper
+  describe Application do
+    let(:clazz) { Doorkeeper::Application }
+    let(:require_owner) { Doorkeeper.configuration.instance_variable_set('@confirm_application_owner', true) }
+    let(:unset_require_owner) { Doorkeeper.configuration.instance_variable_set('@confirm_application_owner', false) }
+    let(:new_application) { FactoryBot.build(:application) }
 
-describe Doorkeeper::Application do
-  let(:require_owner) { Doorkeeper.configuration.instance_variable_set("@confirm_application_owner", true) }
-  let(:unset_require_owner) { Doorkeeper.configuration.instance_variable_set("@confirm_application_owner", false) }
-  let(:new_application) { FactoryBot.build(:application) }
+    let(:uid) { SecureRandom.hex(8) }
+    let(:secret) { SecureRandom.hex(8) }
 
-  let(:uid) { SecureRandom.hex(8) }
-  let(:secret) { SecureRandom.hex(8) }
-
-  it "is invalid without a name" do
-    new_application.name = nil
-    expect(new_application).not_to be_valid
-  end
-
-  it "is invalid without determining confidentiality" do
-    new_application.confidential = nil
-    expect(new_application).not_to be_valid
-  end
-
-  it "generates uid on create" do
-    expect(new_application.uid).to be_nil
-    new_application.save
-    expect(new_application.uid).not_to be_nil
-  end
-
-  it "generates uid on create if an empty string" do
-    new_application.uid = ""
-    new_application.save
-    expect(new_application.uid).not_to be_blank
-  end
-
-  it "generates uid on create unless one is set" do
-    new_application.uid = uid
-    new_application.save
-    expect(new_application.uid).to eq(uid)
-  end
-
-  it "is invalid without uid" do
-    new_application.save
-    new_application.uid = nil
-    expect(new_application).not_to be_valid
-  end
-
-  it "checks uniqueness of uid" do
-    app1 = FactoryBot.create(:application)
-    app2 = FactoryBot.create(:application)
-    app2.uid = app1.uid
-    expect(app2).not_to be_valid
-  end
-
-  it "expects database to throw an error when uids are the same" do
-    app1 = FactoryBot.create(:application)
-    app2 = FactoryBot.create(:application)
-    app2.uid = app1.uid
-    expect { app2.save!(validate: false) }.to raise_error(uniqueness_error)
-  end
+    context 'application_owner is enabled' do
+      before do
+        Doorkeeper.configure do
+          orm DOORKEEPER_ORM
+          enable_application_owner
+        end
+      end
 
-  it "generate secret on create" do
-    expect(new_application.secret).to be_nil
-    new_application.save
-    expect(new_application.secret).not_to be_nil
-  end
+      context 'application owner is not required' do
+        before(:each) do
+          unset_require_owner
+        end
 
-  it "generate secret on create if is blank string" do
-    new_application.secret = ""
-    new_application.save
-    expect(new_application.secret).not_to be_blank
-  end
+        it 'is valid given valid attributes' do
+          expect(new_application).to be_valid
+        end
+      end
 
-  it "generate secret on create unless one is set" do
-    new_application.secret = secret
-    new_application.save
-    expect(new_application.secret).to eq(secret)
-  end
+      context 'application owner is required' do
+        before(:each) do
+          require_owner
+          @owner = FactoryBot.build_stubbed(:doorkeeper_testing_user)
+        end
 
-  it "is invalid without secret" do
-    new_application.save
-    new_application.secret = nil
-    expect(new_application).not_to be_valid
-  end
+        it 'is invalid without an owner' do
+          expect(new_application).not_to be_valid
+        end
 
-  context "application_owner is enabled" do
-    before do
-      Doorkeeper.configure do
-        orm DOORKEEPER_ORM
-        enable_application_owner
+        it 'is valid with an owner' do
+          new_application.owner = @owner
+          expect(new_application).to be_valid
+        end
       end
     end
 
-    context "application owner is not required" do
-      before(:each) do
-        unset_require_owner
-      end
+    it 'is invalid without a name' do
+      new_application.name = nil
+      expect(new_application).not_to be_valid
+    end
 
-      it "is valid given valid attributes" do
-        expect(new_application).to be_valid
-      end
+    it 'is invalid without determining confidentiality' do
+      new_application.confidential = nil
+      expect(new_application).not_to be_valid
     end
 
-    context "application owner is required" do
-      before do
-        require_owner
-        @owner = FactoryBot.build_stubbed(:doorkeeper_testing_user)
-      end
+    it 'generates uid on create' do
+      expect(new_application.uid).to be_nil
+      new_application.save
+      expect(new_application.uid).not_to be_nil
+    end
 
-      it "is invalid without an owner" do
-        expect(new_application).not_to be_valid
-      end
+    it 'generates uid on create if an empty string' do
+      new_application.uid = ''
+      new_application.save
+      expect(new_application.uid).not_to be_blank
+    end
 
-      it "is valid with an owner" do
-        new_application.owner = @owner
-        expect(new_application).to be_valid
-      end
+    it 'generates uid on create unless one is set' do
+      new_application.uid = uid
+      new_application.save
+      expect(new_application.uid).to eq(uid)
     end
-  end
 
-  context "redirect URI" do
-    it "is invalid without redirect_uri" do
+    it 'is invalid without uid' do
       new_application.save
-      new_application.redirect_uri = nil
+      new_application.uid = nil
       expect(new_application).not_to be_valid
     end
-  end
 
-  describe "destroy related models on cascade" do
-    before(:each) do
+    it 'is invalid without redirect_uri' do
       new_application.save
+      new_application.redirect_uri = nil
+      expect(new_application).not_to be_valid
     end
 
-    let(:resource_owner) { FactoryBot.create(:doorkeeper_testing_user) }
-
-    it "should destroy its access grants" do
-      FactoryBot.create(
-        :access_grant,
-        application: new_application,
-        resource_owner_id: resource_owner.id,
-      )
-
-      expect { new_application.destroy }.to change { Doorkeeper::AccessGrant.count }.by(-1)
+    it 'checks uniqueness of uid' do
+      app1 = FactoryBot.create(:application)
+      app2 = FactoryBot.create(:application)
+      app2.uid = app1.uid
+      expect(app2).not_to be_valid
     end
 
-    it "should destroy its access tokens" do
-      FactoryBot.create(:access_token, application: new_application)
-      FactoryBot.create(:access_token, application: new_application, revoked_at: Time.now.utc)
-      expect do
-        new_application.destroy
-      end.to change { Doorkeeper::AccessToken.count }.by(-2)
+    it 'expects database to throw an error when uids are the same' do
+      app1 = FactoryBot.create(:application)
+      app2 = FactoryBot.create(:application)
+      app2.uid = app1.uid
+      expect { app2.save!(validate: false) }.to raise_error(uniqueness_error)
     end
-  end
 
-  describe "#ordered_by" do
-    let(:applications) { FactoryBot.create_list(:application, 5) }
+    it 'generate secret on create' do
+      expect(new_application.secret).to be_nil
+      new_application.save
+      expect(new_application.secret).not_to be_nil
+    end
 
-    context "when a direction is not specified" do
-      it "calls order with a default order of asc" do
-        names = applications.map(&:name).sort
-        expect(described_class.ordered_by(:name).map(&:name)).to eq(names)
-      end
+    it 'generate secret on create if is blank string' do
+      new_application.secret = ''
+      new_application.save
+      expect(new_application.secret).not_to be_blank
     end
 
-    context "when a direction is specified" do
-      it "calls order with specified direction" do
-        names = applications.map(&:name).sort.reverse
-        expect(described_class.ordered_by(:name, :desc).map(&:name)).to eq(names)
-      end
+    it 'generate secret on create unless one is set' do
+      new_application.secret = secret
+      new_application.save
+      expect(new_application.secret).to eq(secret)
     end
-  end
 
-  describe "#redirect_uri=" do
-    context "when array of valid redirect_uris" do
-      it "should join by newline" do
-        new_application.redirect_uri = ["http://localhost/callback1", "http://localhost/callback2"]
-        expect(new_application.redirect_uri).to eq("http://localhost/callback1\nhttp://localhost/callback2")
-      end
+    it 'is invalid without secret' do
+      new_application.save
+      new_application.secret = nil
+      expect(new_application).not_to be_valid
     end
-    context "when string of valid redirect_uris" do
-      it "should store as-is" do
-        new_application.redirect_uri = "http://localhost/callback1\nhttp://localhost/callback2"
-        expect(new_application.redirect_uri).to eq("http://localhost/callback1\nhttp://localhost/callback2")
+
+    context 'with hashing enabled' do
+      include_context 'with application hashing enabled'
+      let(:app) { FactoryBot.create :application }
+
+      it 'holds a volatile plaintext and BCrypt secret' do
+        expect(app.plaintext_secret).to be_a(String)
+        expect(app.secret).not_to eq(app.plaintext_secret)
+        expect { BCrypt::Password.create(app.secret) }.not_to raise_error
       end
-    end
-  end
 
-  describe "#authorized_for" do
-    let(:resource_owner) { FactoryBot.create(:doorkeeper_testing_user) }
-    let(:other_resource_owner) { FactoryBot.create(:doorkeeper_testing_user) }
+      it 'does not fallback to plain lookup by default' do
+        lookup = clazz.by_uid_and_secret(app.uid, app.secret)
+        expect(lookup).to eq(nil)
 
-    it "is empty if the application is not authorized for anyone" do
-      expect(described_class.authorized_for(resource_owner)).to be_empty
-    end
+        lookup = clazz.by_uid_and_secret(app.uid, app.plaintext_secret)
+        expect(lookup).to eq(app)
+      end
 
-    it "returns only application for a specific resource owner" do
-      FactoryBot.create(
-        :access_token,
-        resource_owner_id: other_resource_owner.id,
-      )
-      token = FactoryBot.create(
-        :access_token,
-        resource_owner_id: resource_owner.id,
-      )
-      expect(described_class.authorized_for(resource_owner)).to eq([token.application])
-    end
+      context 'with fallback enabled' do
+        include_context 'with token hashing and fallback lookup enabled'
 
-    it "excludes revoked tokens" do
-      FactoryBot.create(
-        :access_token,
-        resource_owner_id: resource_owner.id,
-        revoked_at: 2.days.ago,
-      )
-      expect(described_class.authorized_for(resource_owner)).to be_empty
-    end
+        it 'provides plain and hashed lookup' do
+          lookup = clazz.by_uid_and_secret(app.uid, app.secret)
+          expect(lookup).to eq(app)
 
-    it "returns all applications that have been authorized" do
-      token1 = FactoryBot.create(
-        :access_token,
-        resource_owner_id: resource_owner.id,
-      )
-      token2 = FactoryBot.create(
-        :access_token,
-        resource_owner_id: resource_owner.id,
-      )
-      expect(described_class.authorized_for(resource_owner))
-        .to eq([token1.application, token2.application])
-    end
+          lookup = clazz.by_uid_and_secret(app.uid, app.plaintext_secret)
+          expect(lookup).to eq(app)
+        end
+      end
 
-    it "returns only one application even if it has been authorized twice" do
-      application = FactoryBot.create(:application)
-      FactoryBot.create(
-        :access_token,
-        resource_owner_id: resource_owner.id,
-        application: application,
-      )
-      FactoryBot.create(
-        :access_token,
-        resource_owner_id: resource_owner.id,
-        application: application,
-      )
-      expect(described_class.authorized_for(resource_owner)).to eq([application])
+      it 'does not provide access to secret after loading' do
+        lookup = clazz.by_uid_and_secret(app.uid, app.plaintext_secret)
+        expect(lookup.plaintext_secret).to be_nil
+      end
     end
-  end
 
-  describe "#revoke_tokens_and_grants_for" do
-    it "revokes all access tokens and access grants" do
-      application_id = 42
-      resource_owner = double
-      expect(Doorkeeper::AccessToken)
-        .to receive(:revoke_all_for).with(application_id, resource_owner)
-      expect(Doorkeeper::AccessGrant)
-        .to receive(:revoke_all_for).with(application_id, resource_owner)
+    describe 'destroy related models on cascade' do
+      before(:each) do
+        new_application.save
+      end
 
-      described_class.revoke_tokens_and_grants_for(application_id, resource_owner)
+      it 'should destroy its access grants' do
+        FactoryBot.create(:access_grant, application: new_application)
+        expect { new_application.destroy }.to change { Doorkeeper::AccessGrant.count }.by(-1)
+      end
+
+      it 'should destroy its access tokens' do
+        FactoryBot.create(:access_token, application: new_application)
+        FactoryBot.create(:access_token, application: new_application, revoked_at: Time.now.utc)
+        expect do
+          new_application.destroy
+        end.to change { Doorkeeper::AccessToken.count }.by(-2)
+      end
     end
-  end
 
-  describe "#by_uid_and_secret" do
-    context "when application is private/confidential" do
-      it "finds the application via uid/secret" do
-        app = FactoryBot.create :application
-        authenticated = described_class.by_uid_and_secret(app.uid, app.secret)
-        expect(authenticated).to eq(app)
+    describe :ordered_by do
+      let(:applications) { FactoryBot.create_list(:application, 5) }
+
+      context 'when a direction is not specified' do
+        it 'calls order with a default order of asc' do
+          names = applications.map(&:name).sort
+          expect(Application.ordered_by(:name).map(&:name)).to eq(names)
+        end
       end
-      context "when secret is wrong" do
-        it "should not find the application" do
-          app = FactoryBot.create :application
-          authenticated = described_class.by_uid_and_secret(app.uid, "bad")
-          expect(authenticated).to eq(nil)
+
+      context 'when a direction is specified' do
+        it 'calls order with specified direction' do
+          names = applications.map(&:name).sort.reverse
+          expect(Application.ordered_by(:name, :desc).map(&:name)).to eq(names)
         end
       end
     end
 
-    context "when application is public/non-confidential" do
-      context "when secret is blank" do
-        it "should find the application" do
-          app = FactoryBot.create :application, confidential: false
-          authenticated = described_class.by_uid_and_secret(app.uid, nil)
-          expect(authenticated).to eq(app)
+    describe "#redirect_uri=" do
+      context "when array of valid redirect_uris" do
+        it "should join by newline" do
+          new_application.redirect_uri = ['http://localhost/callback1', 'http://localhost/callback2']
+          expect(new_application.redirect_uri).to eq("http://localhost/callback1\nhttp://localhost/callback2")
         end
       end
-      context "when secret is wrong" do
-        it "should not find the application" do
-          app = FactoryBot.create :application, confidential: false
-          authenticated = described_class.by_uid_and_secret(app.uid, "bad")
-          expect(authenticated).to eq(nil)
+      context "when string of valid redirect_uris" do
+        it "should store as-is" do
+          new_application.redirect_uri = "http://localhost/callback1\nhttp://localhost/callback2"
+          expect(new_application.redirect_uri).to eq("http://localhost/callback1\nhttp://localhost/callback2")
         end
       end
     end
-  end
-
-  describe "#confidential?" do
-    subject { FactoryBot.create(:application, confidential: confidential).confidential? }
-
-    context "when application is private/confidential" do
-      let(:confidential) { true }
-      it { expect(subject).to eq(true) }
-    end
 
-    context "when application is public/non-confidential" do
-      let(:confidential) { false }
-      it { expect(subject).to eq(false) }
-    end
-  end
+    describe :authorized_for do
+      let(:resource_owner) { double(:resource_owner, id: 10) }
 
-  describe "#as_json" do
-    let(:app) { FactoryBot.create :application, secret: "123123123" }
+      it 'is empty if the application is not authorized for anyone' do
+        expect(Application.authorized_for(resource_owner)).to be_empty
+      end
 
-    # AR specific feature
-    if DOORKEEPER_ORM == :active_record
-      it "correctly works with #to_json" do
-        ActiveRecord::Base.include_root_in_json = true
-        expect(app.to_json(include_root_in_json: true)).to match(/application.+?:\{/)
-        ActiveRecord::Base.include_root_in_json = false
+      it 'returns only application for a specific resource owner' do
+        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id + 1)
+        token = FactoryBot.create(:access_token, resource_owner_id: resource_owner.id)
+        expect(Application.authorized_for(resource_owner)).to eq([token.application])
       end
-    end
 
-    context "when called without authorized resource owner" do
-      it "includes minimal set of attributes" do
-        expect(app.as_json).to match(
-          "id" => app.id,
-          "name" => app.name,
-          "created_at" => anything,
-        )
+      it 'excludes revoked tokens' do
+        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id, revoked_at: 2.days.ago)
+        expect(Application.authorized_for(resource_owner)).to be_empty
       end
 
-      it "includes application UID if it's public" do
-        app = FactoryBot.create :application, secret: "123123123", confidential: false
+      it 'returns all applications that have been authorized' do
+        token1 = FactoryBot.create(:access_token, resource_owner_id: resource_owner.id)
+        token2 = FactoryBot.create(:access_token, resource_owner_id: resource_owner.id)
+        expect(Application.authorized_for(resource_owner)).to eq([token1.application, token2.application])
+      end
 
-        expect(app.as_json).to match(
-          "id" => app.id,
-          "name" => app.name,
-          "created_at" => anything,
-          "uid" => app.uid,
-        )
+      it 'returns only one application even if it has been authorized twice' do
+        application = FactoryBot.create(:application)
+        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id, application: application)
+        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id, application: application)
+        expect(Application.authorized_for(resource_owner)).to eq([application])
       end
+    end
+
+    describe :revoke_tokens_and_grants_for do
+      it 'revokes all access tokens and access grants' do
+        application_id = 42
+        resource_owner = double
+        expect(Doorkeeper::AccessToken)
+          .to receive(:revoke_all_for).with(application_id, resource_owner)
+        expect(Doorkeeper::AccessGrant)
+          .to receive(:revoke_all_for).with(application_id, resource_owner)
 
-      it "respects custom options" do
-        expect(app.as_json(except: :id)).not_to include("id")
-        expect(app.as_json(only: %i[name created_at secret]))
-          .to match(
-            "name" => app.name,
-            "created_at" => anything,
-          )
+        Application.revoke_tokens_and_grants_for(application_id, resource_owner)
       end
     end
 
-    context "when called with authorized resource owner" do
-      let(:owner) { FactoryBot.create(:doorkeeper_testing_user) }
-      let(:other_owner) { FactoryBot.create(:doorkeeper_testing_user) }
-      let(:app) { FactoryBot.create(:application, secret: "123123123", owner: owner) }
+    describe :by_uid_and_secret do
+      context "when application is private/confidential" do
+        it "finds the application via uid/secret" do
+          app = FactoryBot.create :application
+          authenticated = Application.by_uid_and_secret(app.uid, app.secret)
+          expect(authenticated).to eq(app)
+        end
+        context "when secret is wrong" do
+          it "should not find the application" do
+            app = FactoryBot.create :application
+            authenticated = Application.by_uid_and_secret(app.uid, 'bad')
+            expect(authenticated).to eq(nil)
+          end
+        end
+      end
 
-      before do
-        Doorkeeper.configure do
-          orm DOORKEEPER_ORM
-          enable_application_owner confirmation: false
+      context "when application is public/non-confidential" do
+        context "when secret is blank" do
+          it "should find the application" do
+            app = FactoryBot.create :application, confidential: false
+            authenticated = Application.by_uid_and_secret(app.uid, nil)
+            expect(authenticated).to eq(app)
+          end
+        end
+        context "when secret is wrong" do
+          it "should not find the application" do
+            app = FactoryBot.create :application, confidential: false
+            authenticated = Application.by_uid_and_secret(app.uid, 'bad')
+            expect(authenticated).to eq(nil)
+          end
         end
       end
+    end
+
+    describe :confidential? do
+      subject { FactoryBot.create(:application, confidential: confidential).confidential? }
 
-      it "includes all the attributes" do
-        expect(app.as_json(current_resource_owner: owner))
-          .to include(
-            "secret" => "123123123",
-            "redirect_uri" => app.redirect_uri,
-            "uid" => app.uid,
-          )
+      context 'when application is private/confidential' do
+        let(:confidential) { true }
+        it { expect(subject).to eq(true) }
       end
 
-      it "doesn't include unsafe attributes if current owner isn't the same as owner" do
-        expect(app.as_json(current_resource_owner: other_owner))
-          .not_to include("redirect_uri")
+      context 'when application is public/non-confidential' do
+        let(:confidential) { false }
+        it { expect(subject).to eq(false) }
       end
     end
   end