doorkeeper 5.0.3 → 5.1.0

data/spec/controllers/tokens_controller_spec.rb

@@ -1,11 +1,13 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 describe Doorkeeper::TokensController do
-  describe 'when authorization has succeeded' do
+  describe "when authorization has succeeded" do
     let(:token) { double(:token, authorize: true) }
 
-    it 'returns the authorization' do
-      skip 'verify need of these specs'
+    it "returns the authorization" do
+      skip "verify need of these specs"
 
       expect(token).to receive(:authorization)
 
@@ -13,20 +15,20 @@ describe Doorkeeper::TokensController do
     end
   end
 
-  describe 'when authorization has failed' do
-    it 'returns the error response' do
+  describe "when authorization has failed" do
+    it "returns the error response" do
       token = double(:token, authorize: false)
       allow(controller).to receive(:token) { token }
 
       post :create
 
-      expect(response.status).to eq 401
-      expect(response.headers['WWW-Authenticate']).to match(/Bearer/)
+      expect(response.status).to eq 400
+      expect(response.headers["WWW-Authenticate"]).to match(/Bearer/)
     end
   end
 
-  describe 'when there is a failure due to a custom error' do
-    it 'returns the error response with a custom message' do
+  describe "when there is a failure due to a custom error" do
+    it "returns the error response with a custom message" do
       # I18n looks for `doorkeeper.errors.messages.custom_message` in locale files
       custom_message = "my_message"
       allow(I18n).to receive(:translate)
@@ -34,7 +36,7 @@ describe Doorkeeper::TokensController do
           custom_message,
           hash_including(scope: %i[doorkeeper errors messages])
         )
-        .and_return('Authorization custom message')
+        .and_return("Authorization custom message")
 
       doorkeeper_error = Doorkeeper::Errors::DoorkeeperError.new(custom_message)
 
@@ -46,41 +48,37 @@ describe Doorkeeper::TokensController do
       post :create
 
       expected_response_body = {
-        "error"             => custom_message,
-        "error_description" => "Authorization custom message"
+        "error" => custom_message,
+        "error_description" => "Authorization custom message",
       }
-      expect(response.status).to eq 401
-      expect(response.headers['WWW-Authenticate']).to match(/Bearer/)
+      expect(response.status).to eq 400
+      expect(response.headers["WWW-Authenticate"]).to match(/Bearer/)
       expect(JSON.parse(response.body)).to eq expected_response_body
     end
   end
 
   # http://tools.ietf.org/html/rfc7009#section-2.2
-  describe 'revoking tokens' do
+  describe "revoking tokens" do
     let(:client) { FactoryBot.create(:application) }
     let(:access_token) { FactoryBot.create(:access_token, application: client) }
 
-    before(:each) do
-      allow(controller).to receive(:token) { access_token }
-    end
-
-    context 'when associated app is public' do
+    context "when associated app is public" do
       let(:client) { FactoryBot.create(:application, confidential: false) }
 
-      it 'returns 200' do
-        post :revoke
+      it "returns 200" do
+        post :revoke, params: { token: access_token.token }
 
         expect(response.status).to eq 200
       end
 
-      it 'revokes the access token' do
-        post :revoke
+      it "revokes the access token" do
+        post :revoke, params: { token: access_token.token }
 
         expect(access_token.reload).to have_attributes(revoked?: true)
       end
     end
 
-    context 'when associated app is confidential' do
+    context "when associated app is confidential" do
       let(:client) { FactoryBot.create(:application, confidential: true) }
       let(:oauth_client) { Doorkeeper::OAuth::Client.new(client) }
 
@@ -88,30 +86,30 @@ describe Doorkeeper::TokensController do
         allow_any_instance_of(Doorkeeper::Server).to receive(:client) { oauth_client }
       end
 
-      it 'returns 200' do
-        post :revoke
+      it "returns 200" do
+        post :revoke, params: { token: access_token.token }
 
         expect(response.status).to eq 200
       end
 
-      it 'revokes the access token' do
-        post :revoke
+      it "revokes the access token" do
+        post :revoke, params: { token: access_token.token }
 
         expect(access_token.reload).to have_attributes(revoked?: true)
       end
 
-      context 'when authorization fails' do
+      context "when authorization fails" do
         let(:some_other_client) { FactoryBot.create(:application, confidential: true) }
         let(:oauth_client) { Doorkeeper::OAuth::Client.new(some_other_client) }
 
-        it 'returns 200' do
-          post :revoke
+        it "returns 200" do
+          post :revoke, params: { token: access_token.token }
 
           expect(response.status).to eq 200
         end
 
-        it 'does not revoke the access token' do
-          post :revoke
+        it "does not revoke the access token" do
+          post :revoke, params: { token: access_token.token }
 
           expect(access_token.reload).to have_attributes(revoked?: false)
         end
@@ -119,7 +117,7 @@ describe Doorkeeper::TokensController do
     end
   end
 
-  describe 'authorize response memoization' do
+  describe "authorize response memoization" do
     it "memoizes the result of the authorization" do
       strategy = double(:strategy, authorize: true)
       expect(strategy).to receive(:authorize).once
@@ -133,138 +131,199 @@ describe Doorkeeper::TokensController do
     end
   end
 
-  describe 'when requested token introspection' do
-    context 'authorized using Bearer token' do
-      let(:client) { FactoryBot.create(:application) }
-      let(:access_token) { FactoryBot.create(:access_token, application: client) }
+  describe "when requested token introspection" do
+    let(:client) { FactoryBot.create(:application) }
+    let(:access_token) { FactoryBot.create(:access_token, application: client) }
+    let(:token_for_introspection) { FactoryBot.create(:access_token, application: client) }
 
-      it 'responds with full token introspection' do
-        request.headers['Authorization'] = "Bearer #{access_token.token}"
+    context "authorized using valid Bearer token" do
+      it "responds with full token introspection" do
+        request.headers["Authorization"] = "Bearer #{access_token.token}"
 
-        post :introspect, params: { token: access_token.token }
+        post :introspect, params: { token: token_for_introspection.token }
 
-        should_have_json 'active', true
-        expect(json_response).to include('client_id', 'token_type', 'exp', 'iat')
+        should_have_json "active", true
+        expect(json_response).to include("client_id", "token_type", "exp", "iat")
       end
     end
 
-    context 'authorized using Client Authentication' do
-      let(:client) { FactoryBot.create(:application) }
-      let(:access_token) { FactoryBot.create(:access_token, application: client) }
+    context "authorized using valid Client Authentication" do
+      it "responds with full token introspection" do
+        request.headers["Authorization"] = basic_auth_header_for_client(client)
 
-      it 'responds with full token introspection' do
-        request.headers['Authorization'] = basic_auth_header_for_client(client)
+        post :introspect, params: { token: token_for_introspection.token }
 
-        post :introspect, params: { token: access_token.token }
+        should_have_json "active", true
+        expect(json_response).to include("client_id", "token_type", "exp", "iat")
+        should_have_json "client_id", client.uid
+      end
+    end
 
-        should_have_json 'active', true
-        expect(json_response).to include('client_id', 'token_type', 'exp', 'iat')
-        should_have_json 'client_id', client.uid
+    context "using custom introspection response" do
+      before do
+        Doorkeeper.configure do
+          orm DOORKEEPER_ORM
+          custom_introspection_response do |_token, _context|
+            {
+              sub: "Z5O3upPC88QrAjx00dis",
+              aud: "https://protected.example.net/resource",
+            }
+          end
+        end
+      end
+
+      it "responds with full token introspection" do
+        request.headers["Authorization"] = "Bearer #{access_token.token}"
+
+        post :introspect, params: { token: token_for_introspection.token }
+
+        expect(json_response).to include("client_id", "token_type", "exp", "iat", "sub", "aud")
+        should_have_json "sub", "Z5O3upPC88QrAjx00dis"
+        should_have_json "aud", "https://protected.example.net/resource"
       end
     end
 
-    context 'public access token' do
-      let(:client) { FactoryBot.create(:application) }
-      let(:access_token) { FactoryBot.create(:access_token, application: nil) }
+    context "public access token" do
+      let(:token_for_introspection) { FactoryBot.create(:access_token, application: nil) }
 
-      it 'responds with full token introspection' do
-        request.headers['Authorization'] = basic_auth_header_for_client(client)
+      it "responds with full token introspection" do
+        request.headers["Authorization"] = basic_auth_header_for_client(client)
 
-        post :introspect, params: { token: access_token.token }
+        post :introspect, params: { token: token_for_introspection.token }
 
-        should_have_json 'active', true
-        expect(json_response).to include('client_id', 'token_type', 'exp', 'iat')
-        should_have_json 'client_id', nil
+        should_have_json "active", true
+        expect(json_response).to include("client_id", "token_type", "exp", "iat")
+        should_have_json "client_id", nil
       end
     end
 
-    context 'token was issued to a different client than is making this request' do
-      let(:client) { FactoryBot.create(:application) }
+    context "token was issued to a different client than is making this request" do
       let(:different_client) { FactoryBot.create(:application) }
-      let(:access_token) { FactoryBot.create(:access_token, application: client) }
 
-      it 'responds with only active state' do
-        request.headers['Authorization'] = basic_auth_header_for_client(different_client)
+      it "responds with only active state" do
+        request.headers["Authorization"] = basic_auth_header_for_client(different_client)
 
-        post :introspect, params: { token: access_token.token }
+        post :introspect, params: { token: token_for_introspection.token }
 
         expect(response).to be_successful
 
-        should_have_json 'active', false
-        expect(json_response).not_to include('client_id', 'token_type', 'exp', 'iat')
+        should_have_json "active", false
+        expect(json_response).not_to include("client_id", "token_type", "exp", "iat")
       end
     end
 
-    context 'using invalid credentials to authorize' do
-      let(:client) { double(uid: '123123', secret: '666999') }
+    context "authorized using invalid Bearer token" do
+      let(:access_token) do
+        FactoryBot.create(:access_token, application: client, revoked_at: 1.day.ago)
+      end
+
+      it "responds with invalid token error" do
+        request.headers["Authorization"] = "Bearer #{access_token.token}"
+
+        post :introspect, params: { token: token_for_introspection.token }
+
+        response_status_should_be 401
+
+        should_not_have_json "active"
+        should_have_json "error", "invalid_token"
+      end
+    end
+
+    context "authorized using the Bearer token that need to be introspected" do
+      it "responds with invalid token error" do
+        request.headers["Authorization"] = "Bearer #{access_token.token}"
+
+        post :introspect, params: { token: access_token.token }
+
+        response_status_should_be 401
+
+        should_not_have_json "active"
+        should_have_json "error", "invalid_token"
+      end
+    end
+
+    context "using invalid credentials to authorize" do
+      let(:client) { double(uid: "123123", secret: "666999") }
       let(:access_token) { FactoryBot.create(:access_token) }
 
-      it 'responds with invalid_client error' do
-        request.headers['Authorization'] = basic_auth_header_for_client(client)
+      it "responds with invalid_client error" do
+        request.headers["Authorization"] = basic_auth_header_for_client(client)
 
         post :introspect, params: { token: access_token.token }
 
         expect(response).not_to be_successful
         response_status_should_be 401
 
-        should_not_have_json 'active'
-        should_have_json 'error', 'invalid_client'
+        should_not_have_json "active"
+        should_have_json "error", "invalid_client"
       end
     end
 
-    context 'using wrong token value' do
-      let(:client) { FactoryBot.create(:application) }
-      let(:access_token) { FactoryBot.create(:access_token, application: client) }
+    context "using wrong token value" do
+      context "authorized using client credentials" do
+        it "responds with only active state" do
+          request.headers["Authorization"] = basic_auth_header_for_client(client)
+
+          post :introspect, params: { token: SecureRandom.hex(16) }
 
-      it 'responds with only active state' do
-        request.headers['Authorization'] = basic_auth_header_for_client(client)
+          should_have_json "active", false
+          expect(json_response).not_to include("client_id", "token_type", "exp", "iat")
+        end
+      end
+
+      context "authorized using valid Bearer token" do
+        it "responds with only active state" do
+          request.headers["Authorization"] = "Bearer #{access_token.token}"
 
-        post :introspect, params: { token: SecureRandom.hex(16) }
+          post :introspect, params: { token: SecureRandom.hex(16) }
 
-        should_have_json 'active', false
-        expect(json_response).not_to include('client_id', 'token_type', 'exp', 'iat')
+          should_have_json "active", false
+          expect(json_response).not_to include("client_id", "token_type", "exp", "iat")
+        end
       end
     end
 
-    context 'when requested Access Token expired' do
-      let(:client) { FactoryBot.create(:application) }
-      let(:access_token) { FactoryBot.create(:access_token, application: client, created_at: 1.year.ago) }
+    context "when requested access token expired" do
+      let(:token_for_introspection) do
+        FactoryBot.create(:access_token, application: client, created_at: 1.year.ago)
+      end
 
-      it 'responds with only active state' do
-        request.headers['Authorization'] = basic_auth_header_for_client(client)
+      it "responds with only active state" do
+        request.headers["Authorization"] = basic_auth_header_for_client(client)
 
-        post :introspect, params: { token: access_token.token }
+        post :introspect, params: { token: token_for_introspection.token }
 
-        should_have_json 'active', false
-        expect(json_response).not_to include('client_id', 'token_type', 'exp', 'iat')
+        should_have_json "active", false
+        expect(json_response).not_to include("client_id", "token_type", "exp", "iat")
       end
     end
 
-    context 'when requested Access Token revoked' do
-      let(:client) { FactoryBot.create(:application) }
-      let(:access_token) { FactoryBot.create(:access_token, application: client, revoked_at: 1.year.ago) }
+    context "when requested Access Token revoked" do
+      let(:token_for_introspection) do
+        FactoryBot.create(:access_token, application: client, revoked_at: 1.year.ago)
+      end
 
-      it 'responds with only active state' do
-        request.headers['Authorization'] = basic_auth_header_for_client(client)
+      it "responds with only active state" do
+        request.headers["Authorization"] = basic_auth_header_for_client(client)
 
-        post :introspect, params: { token: access_token.token }
+        post :introspect, params: { token: token_for_introspection.token }
 
-        should_have_json 'active', false
-        expect(json_response).not_to include('client_id', 'token_type', 'exp', 'iat')
+        should_have_json "active", false
+        expect(json_response).not_to include("client_id", "token_type", "exp", "iat")
       end
     end
 
-    context 'unauthorized (no bearer token or client credentials)' do
-      let(:access_token) { FactoryBot.create(:access_token) }
+    context "unauthorized (no bearer token or client credentials)" do
+      let(:token_for_introspection) { FactoryBot.create(:access_token) }
 
-      it 'responds with invalid_request error' do
-        post :introspect, params: { token: access_token.token }
+      it "responds with invalid_request error" do
+        post :introspect, params: { token: token_for_introspection.token }
 
         expect(response).not_to be_successful
-        response_status_should_be 401
+        response_status_should_be 400
 
-        should_not_have_json 'active'
-        should_have_json 'error', 'invalid_request'
+        should_not_have_json "active"
+        should_have_json "error", "invalid_request"
       end
     end
   end

data/spec/dummy/Rakefile

@@ -1,7 +1,9 @@
 #!/usr/bin/env rake
+# frozen_string_literal: true
+
 # Add your own tasks in files placed in lib/tasks ending in .rake,
 # for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.
 
-require File.expand_path('config/application', __dir__)
+require File.expand_path("config/application", __dir__)
 
 Dummy::Application.load_tasks

data/spec/dummy/app/controllers/application_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class ApplicationController < ActionController::Base
-  protect_from_forgery
+  protect_from_forgery with: :exception
 end

data/spec/dummy/app/controllers/custom_authorizations_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class CustomAuthorizationsController < ::ApplicationController
   %w[index show new create edit update destroy].each do |action|
     define_method action do

data/spec/dummy/app/controllers/full_protected_resources_controller.rb

@@ -1,12 +1,14 @@
+# frozen_string_literal: true
+
 class FullProtectedResourcesController < ApplicationController
   before_action -> { doorkeeper_authorize! :write, :admin }, only: :show
   before_action :doorkeeper_authorize!, only: :index
 
   def index
-    render plain: 'index'
+    render plain: "index"
   end
 
   def show
-    render plain: 'show'
+    render plain: "show"
   end
 end

data/spec/dummy/app/controllers/home_controller.rb

@@ -1,16 +1,18 @@
+# frozen_string_literal: true
+
 class HomeController < ApplicationController
   def index; end
 
   def sign_in
     session[:user_id] = if Rails.env.development?
-                          User.first || User.create!(name: 'Joe', password: 'sekret')
+                          User.first || User.create!(name: "Joe", password: "sekret")
                         else
                           User.first
                         end
-    redirect_to '/'
+    redirect_to "/"
   end
 
   def callback
-    render plain: 'ok'
+    render plain: "ok"
   end
 end

data/spec/dummy/app/controllers/metal_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class MetalController < ActionController::Metal
   include AbstractController::Callbacks
   include ActionController::Head

data/spec/dummy/app/controllers/semi_protected_resources_controller.rb

@@ -1,11 +1,13 @@
+# frozen_string_literal: true
+
 class SemiProtectedResourcesController < ApplicationController
   before_action :doorkeeper_authorize!, only: :index
 
   def index
-    render plain: 'protected index'
+    render plain: "protected index"
   end
 
   def show
-    render plain: 'non protected show'
+    render plain: "non protected show"
   end
 end

data/spec/dummy/app/helpers/application_helper.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module ApplicationHelper
   def current_user
     @current_user ||= User.find_by_id(session[:user_id])

data/spec/dummy/app/models/user.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class User < ActiveRecord::Base
   def self.authenticate!(name, password)
     User.where(name: name, password: password).first

data/spec/dummy/config/application.rb

@@ -1,6 +1,17 @@
 require File.expand_path('boot', __dir__)
 
-require 'rails/all'
+require "rails"
+
+%w[
+  action_controller/railtie
+  action_view/railtie
+  sprockets/railtie
+].each do |railtie|
+  begin
+    require railtie
+  rescue LoadError
+  end
+end
 
 Bundler.require(*Rails.groups)
 
@@ -16,6 +27,19 @@ require "#{orm}/railtie"
 
 module Dummy
   class Application < Rails::Application
+    if Rails.gem_version < Gem::Version.new('5.1')
+      config.action_controller.per_form_csrf_tokens = true
+      config.action_controller.forgery_protection_origin_check = true
+
+      ActiveSupport.to_time_preserves_timezone = true
+
+      config.active_record.belongs_to_required_by_default = true
+
+      config.ssl_options = { hsts: { subdomains: true } }
+    else
+      config.load_defaults "#{Rails::VERSION::MAJOR}.#{Rails::VERSION::MINOR}"
+    end
+
     # Settings in config/environments/* take precedence over those specified here.
     # Application configuration should go into files in config/initializers
     # -- all .rb files in that directory are automatically loaded.

data/spec/dummy/config/environments/development.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 Dummy::Application.configure do
   # Settings specified here will take precedence over those in config/application.rb
 

data/spec/dummy/config/environments/production.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 Dummy::Application.configure do
   # Settings specified here will take precedence over those in config/application.rb
 

data/spec/dummy/config/environments/test.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 Dummy::Application.configure do
   # Settings specified here will take precedence over those in config/application.rb
 
@@ -8,7 +10,7 @@ Dummy::Application.configure do
   config.cache_classes = true
 
   config.assets.enabled = true
-  config.assets.version = '1.0'
+  config.assets.version = "1.0"
   config.assets.digest = false
 
   # Do not eager load code on boot. This avoids loading your whole application

data/spec/dummy/config/initializers/backtrace_silencers.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # Be sure to restart your server when you modify this file.
 
 # You can add backtrace silencers for libraries that you're using but don't wish to see in your backtraces.

data/spec/dummy/config/initializers/doorkeeper.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 Doorkeeper.configure do
   # Change the ORM that doorkeeper will use.
   orm DOORKEEPER_ORM
@@ -5,7 +7,7 @@ Doorkeeper.configure do
   # This block will be called to check whether the resource owner is authenticated or not.
   resource_owner_authenticator do
     # Put your resource owner authentication logic here.
-    User.where(id: session[:user_id]).first || redirect_to(root_url, alert: 'Needs sign in.')
+    User.where(id: session[:user_id]).first || redirect_to(root_url, alert: "Needs sign in.")
   end
 
   # If you didn't skip applications controller from Doorkeeper routes in your application routes.rb
@@ -66,7 +68,8 @@ Doorkeeper.configure do
   # Change the native redirect uri for client apps
   # When clients register with the following redirect uri, they won't be redirected to any server and
   # the authorization code will be displayed within the provider
-  # The value can be any string. Use nil to disable this feature. When disabled, clients must provide a valid URL
+  # The value can be any string. Use nil to disable this feature.
+  # When disabled, clients must provide a valid URL
   # (Similar behaviour: https://developers.google.com/accounts/docs/OAuth2InstalledApp#choosingredirecturi)
   #
   # native_redirect_uri 'urn:ietf:wg:oauth:2.0:oob'

data/spec/dummy/config/initializers/secret_token.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # Be sure to restart your server when you modify this file.
 
 # Your secret key for verifying the integrity of signed cookies.
@@ -5,4 +7,4 @@
 # Make sure the secret is at least 30 characters and all random,
 # no regular words or you'll be exposed to dictionary attacks.
 Dummy::Application.config.secret_key_base =
-  'c00157b5a1bb6181792f0f4a8a080485de7bab9987e6cf159'
+  "c00157b5a1bb6181792f0f4a8a080485de7bab9987e6cf159"