doorkeeper 5.0.3 → 5.1.0

data/spec/lib/doorkeeper_spec.rb

@@ -1,4 +1,6 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 describe Doorkeeper do
   describe "#authenticate" do

data/spec/lib/models/expirable_spec.rb

@@ -1,6 +1,8 @@
-require 'spec_helper'
+# frozen_string_literal: true
 
-describe 'Expirable' do
+require "spec_helper"
+
+describe "Expirable" do
   subject do
     Class.new do
       include Doorkeeper::Models::Expirable
@@ -12,36 +14,48 @@ describe 'Expirable' do
   end
 
   describe :expired? do
-    it 'is not expired if time has not passed' do
+    it "is not expired if time has not passed" do
       allow(subject).to receive(:expires_in).and_return(2.minutes)
       expect(subject).not_to be_expired
     end
 
-    it 'is expired if time has passed' do
+    it "is expired if time has passed" do
       allow(subject).to receive(:expires_in).and_return(10.seconds)
       expect(subject).to be_expired
     end
 
-    it 'is not expired if expires_in is not set' do
+    it "is not expired if expires_in is not set" do
       allow(subject).to receive(:expires_in).and_return(nil)
       expect(subject).not_to be_expired
     end
   end
 
   describe :expires_in_seconds do
-    it 'should return the amount of time remaining until the token is expired' do
+    it "should return the amount of time remaining until the token is expired" do
       allow(subject).to receive(:expires_in).and_return(2.minutes)
       expect(subject.expires_in_seconds).to eq(60)
     end
 
-    it 'should return 0 when expired' do
+    it "should return 0 when expired" do
       allow(subject).to receive(:expires_in).and_return(30.seconds)
       expect(subject.expires_in_seconds).to eq(0)
     end
 
-    it 'should return nil when expires_in is nil' do
+    it "should return nil when expires_in is nil" do
       allow(subject).to receive(:expires_in).and_return(nil)
       expect(subject.expires_in_seconds).to be_nil
     end
   end
+
+  describe :expires_at do
+    it "should return the expiration time of the token" do
+      allow(subject).to receive(:expires_in).and_return(2.minutes)
+      expect(subject.expires_at).to be_a(Time)
+    end
+
+    it "should return nil when expires_in is nil" do
+      allow(subject).to receive(:expires_in).and_return(nil)
+      expect(subject.expires_at).to be_nil
+    end
+  end
 end

data/spec/lib/models/reusable_spec.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+describe "Reusable" do
+  subject do
+    Class.new do
+      include Doorkeeper::Models::Reusable
+    end.new
+  end
+
+  describe :reusable? do
+    it "is reusable if its expires_in is nil" do
+      allow(subject).to receive(:expired?).and_return(false)
+      allow(subject).to receive(:expires_in).and_return(nil)
+      expect(subject).to be_reusable
+    end
+
+    it "is reusable if its expiry has crossed reusable limit" do
+      allow(subject).to receive(:expired?).and_return(false)
+      allow(Doorkeeper.configuration).to receive(:token_reuse_limit).and_return(90)
+      allow(subject).to receive(:expires_in).and_return(100.seconds)
+      allow(subject).to receive(:expires_in_seconds).and_return(20.seconds)
+      expect(subject).to be_reusable
+    end
+
+    it "is not reusable if its expiry has crossed reusable limit" do
+      allow(subject).to receive(:expired?).and_return(false)
+      allow(Doorkeeper.configuration).to receive(:token_reuse_limit).and_return(90)
+      allow(subject).to receive(:expires_in).and_return(100.seconds)
+      allow(subject).to receive(:expires_in_seconds).and_return(5.seconds)
+      expect(subject).not_to be_reusable
+    end
+
+    it "is not reusable if it is already expired" do
+      allow(subject).to receive(:expired?).and_return(true)
+      expect(subject).not_to be_reusable
+    end
+  end
+end

data/spec/lib/models/revocable_spec.rb

@@ -1,6 +1,8 @@
-require 'spec_helper'
+# frozen_string_literal: true
 
-describe 'Revocable' do
+require "spec_helper"
+
+describe "Revocable" do
   subject do
     Class.new do
       include Doorkeeper::Models::Revocable
@@ -8,7 +10,7 @@ describe 'Revocable' do
   end
 
   describe :revoke do
-    it 'updates :revoked_at attribute with current time' do
+    it "updates :revoked_at attribute with current time" do
       utc = double utc: double
       clock = double now: utc
       expect(subject).to receive(:update_attribute).with(:revoked_at, clock.now.utc)
@@ -17,17 +19,17 @@ describe 'Revocable' do
   end
 
   describe :revoked? do
-    it 'is revoked if :revoked_at has passed' do
+    it "is revoked if :revoked_at has passed" do
       allow(subject).to receive(:revoked_at).and_return(Time.now.utc - 1000)
       expect(subject).to be_revoked
     end
 
-    it 'is not revoked if :revoked_at has not passed' do
+    it "is not revoked if :revoked_at has not passed" do
       allow(subject).to receive(:revoked_at).and_return(Time.now.utc + 1000)
       expect(subject).not_to be_revoked
     end
 
-    it 'is not revoked if :revoked_at is not set' do
+    it "is not revoked if :revoked_at is not set" do
       allow(subject).to receive(:revoked_at).and_return(nil)
       expect(subject).not_to be_revoked
     end

data/spec/lib/models/scopes_spec.rb

@@ -1,39 +1,53 @@
-require 'spec_helper'
+# frozen_string_literal: true
 
-describe 'Doorkeeper::Models::Scopes' do
+require "spec_helper"
+
+describe "Doorkeeper::Models::Scopes" do
   subject do
-    Class.new(Hash) do
+    Class.new(Struct.new(:scopes)) do
       include Doorkeeper::Models::Scopes
     end.new
   end
 
   before do
-    subject[:scopes] = 'public admin'
+    subject[:scopes] = "public admin"
   end
 
   describe :scopes do
-    it 'is a `Scopes` class' do
+    it "is a `Scopes` class" do
       expect(subject.scopes).to be_a(Doorkeeper::OAuth::Scopes)
     end
 
-    it 'includes scopes' do
-      expect(subject.scopes).to include('public')
+    it "includes scopes" do
+      expect(subject.scopes).to include("public")
+    end
+  end
+
+  describe :scopes= do
+    it "accepts String" do
+      subject.scopes = "private admin"
+      expect(subject.scopes_string).to eq("private admin")
+    end
+
+    it "accepts Array" do
+      subject.scopes = %w[private admin]
+      expect(subject.scopes_string).to eq("private admin")
     end
   end
 
   describe :scopes_string do
-    it 'is a `Scopes` class' do
-      expect(subject.scopes_string).to eq('public admin')
+    it "is a `Scopes` class" do
+      expect(subject.scopes_string).to eq("public admin")
     end
   end
 
   describe :includes_scope? do
-    it 'should return true if at least one scope is included' do
-      expect(subject.includes_scope?('public', 'private')).to be true
+    it "should return true if at least one scope is included" do
+      expect(subject.includes_scope?("public", "private")).to be true
     end
 
-    it 'should return false if no scopes are included' do
-      expect(subject.includes_scope?('teacher', 'student')).to be false
+    it "should return false if no scopes are included" do
+      expect(subject.includes_scope?("teacher", "student")).to be false
     end
   end
 end

data/spec/lib/models/secret_storable_spec.rb

@@ -0,0 +1,135 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+describe "SecretStorable" do
+  let(:clazz) do
+    Class.new do
+      include Doorkeeper::Models::SecretStorable
+
+      def self.find_by(*)
+        raise "stub this"
+      end
+
+      def update_column(*)
+        raise "stub this"
+      end
+
+      def token
+        raise "stub this"
+      end
+    end
+  end
+  let(:strategy) { clazz.secret_strategy }
+
+  describe :find_by_plaintext_token do
+    subject { clazz.send(:find_by_plaintext_token, "attr", "input") }
+
+    it "forwards to the secret_strategy" do
+      expect(strategy)
+        .to receive(:transform_secret)
+        .with("input")
+        .and_return "found"
+
+      expect(clazz)
+        .to receive(:find_by)
+        .with("attr" => "found")
+        .and_return "result"
+
+      expect(subject).to eq "result"
+    end
+
+    it "calls find_by_fallback_token if not found" do
+      expect(clazz)
+        .to receive(:find_by)
+        .with("attr" => "input")
+        .and_return nil
+
+      expect(clazz)
+        .to receive(:find_by_fallback_token)
+        .with("attr", "input")
+        .and_return "fallback"
+
+      expect(subject).to eq "fallback"
+    end
+  end
+
+  describe :find_by_fallback_token do
+    subject { clazz.send(:find_by_fallback_token, "attr", "input") }
+    let(:fallback) { double(::Doorkeeper::SecretStoring::Plain) }
+
+    it "returns nil if none defined" do
+      expect(clazz.fallback_secret_strategy).to eq nil
+      expect(subject).to eq nil
+    end
+
+    context "if a fallback strategy is defined" do
+      before do
+        allow(clazz).to receive(:fallback_secret_strategy).and_return(fallback)
+      end
+
+      context "if a resource is defined" do
+        let(:resource) { double("Token model") }
+
+        it "calls the strategy for lookup" do
+          expect(clazz)
+            .to receive(:find_by)
+            .with("attr" => "fallback")
+            .and_return(resource)
+
+          expect(fallback)
+            .to receive(:transform_secret)
+            .with("input")
+            .and_return("fallback")
+
+          # store_secret will call the resource
+          expect(resource)
+            .to receive(:attr=)
+            .with("new value")
+
+          # It will upgrade the secret automtically using the current strategy
+          expect(strategy)
+            .to receive(:transform_secret)
+            .with("input")
+            .and_return("new value")
+
+          expect(resource).to receive(:update).with("attr" => "new value")
+          expect(subject).to eq resource
+        end
+      end
+
+      context "if a resource is not defined" do
+        before do
+          allow(clazz).to receive(:fallback_secret_strategy).and_return(fallback)
+        end
+
+        it "returns nil" do
+          expect(clazz)
+            .to receive(:find_by)
+            .with("attr" => "fallback")
+            .and_return(nil)
+
+          expect(fallback)
+            .to receive(:transform_secret)
+            .with("input")
+            .and_return("fallback")
+
+          # It does not find a token even with the fallback method
+          expect(subject).to be_nil
+        end
+      end
+    end
+  end
+
+  describe :secret_strategy do
+    it "defaults to plain strategy" do
+      expect(strategy).to eq Doorkeeper::SecretStoring::Plain
+    end
+  end
+
+  describe :fallback_secret_strategy do
+    it "defaults to nil" do
+      expect(clazz.fallback_secret_strategy).to eq nil
+    end
+  end
+end

data/spec/lib/oauth/authorization/uri_builder_spec.rb

@@ -1,36 +1,38 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth::Authorization
   describe URIBuilder do
     subject { URIBuilder }
 
     describe :uri_with_query do
-      it 'returns the uri with query' do
-        uri = subject.uri_with_query 'http://example.com/', parameter: 'value'
-        expect(uri).to eq('http://example.com/?parameter=value')
+      it "returns the uri with query" do
+        uri = subject.uri_with_query "http://example.com/", parameter: "value"
+        expect(uri).to eq("http://example.com/?parameter=value")
       end
 
-      it 'rejects nil values' do
-        uri = subject.uri_with_query 'http://example.com/', parameter: ''
-        expect(uri).to eq('http://example.com/?')
+      it "rejects nil values" do
+        uri = subject.uri_with_query "http://example.com/", parameter: ""
+        expect(uri).to eq("http://example.com/?")
       end
 
-      it 'preserves original query parameters' do
-        uri = subject.uri_with_query 'http://example.com/?query1=value', parameter: 'value'
+      it "preserves original query parameters" do
+        uri = subject.uri_with_query "http://example.com/?query1=value", parameter: "value"
         expect(uri).to match(/query1=value/)
         expect(uri).to match(/parameter=value/)
       end
     end
 
     describe :uri_with_fragment do
-      it 'returns uri with parameters as fragments' do
-        uri = subject.uri_with_fragment 'http://example.com/', parameter: 'value'
-        expect(uri).to eq('http://example.com/#parameter=value')
+      it "returns uri with parameters as fragments" do
+        uri = subject.uri_with_fragment "http://example.com/", parameter: "value"
+        expect(uri).to eq("http://example.com/#parameter=value")
       end
 
-      it 'preserves original query parameters' do
-        uri = subject.uri_with_fragment 'http://example.com/?query1=value1', parameter: 'value'
-        expect(uri).to eq('http://example.com/?query1=value1#parameter=value')
+      it "preserves original query parameters" do
+        uri = subject.uri_with_fragment "http://example.com/?query1=value1", parameter: "value"
+        expect(uri).to eq("http://example.com/?query1=value1#parameter=value")
       end
     end
   end

data/spec/lib/oauth/authorization_code_request_spec.rb

@@ -1,4 +1,6 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth
   describe AuthorizationCodeRequest do
@@ -16,11 +18,15 @@ module Doorkeeper::OAuth
     let(:redirect_uri) { client.redirect_uri }
     let(:params) { { redirect_uri: redirect_uri } }
 
+    before do
+      allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
+    end
+
     subject do
       AuthorizationCodeRequest.new server, grant, client, params
     end
 
-    it 'issues a new token for the client' do
+    it "issues a new token for the client" do
       expect do
         subject.authorize
       end.to change { client.reload.access_tokens.count }.by(1)
@@ -33,36 +39,36 @@ module Doorkeeper::OAuth
       expect(Doorkeeper::AccessToken.last.scopes).to eq(grant.scopes)
     end
 
-    it 'revokes the grant' do
+    it "revokes the grant" do
       expect { subject.authorize }.to(change { grant.reload.accessible? })
     end
 
-    it 'requires the grant to be accessible' do
+    it "requires the grant to be accessible" do
       grant.revoke
       subject.validate
       expect(subject.error).to eq(:invalid_grant)
     end
 
-    it 'requires the grant' do
+    it "requires the grant" do
       subject.grant = nil
       subject.validate
       expect(subject.error).to eq(:invalid_grant)
     end
 
-    it 'requires the client' do
+    it "requires the client" do
       subject.client = nil
       subject.validate
       expect(subject.error).to eq(:invalid_client)
     end
 
-    it 'requires the redirect_uri' do
+    it "requires the redirect_uri" do
       subject.redirect_uri = nil
       subject.validate
       expect(subject.error).to eq(:invalid_request)
     end
 
     it "matches the redirect_uri with grant's one" do
-      subject.redirect_uri = 'http://other.com'
+      subject.redirect_uri = "http://other.com"
       subject.validate
       expect(subject.error).to eq(:invalid_grant)
     end
@@ -73,7 +79,7 @@ module Doorkeeper::OAuth
       expect(subject.error).to eq(:invalid_grant)
     end
 
-    it 'skips token creation if there is a matching one' do
+    it "skips token creation if there is a matching one reusable" do
       scopes = grant.scopes
 
       Doorkeeper.configure do
@@ -88,6 +94,23 @@ module Doorkeeper::OAuth
       expect { subject.authorize }.to_not(change { Doorkeeper::AccessToken.count })
     end
 
+    it "creates token if there is a matching one but non reusable" do
+      scopes = grant.scopes
+
+      Doorkeeper.configure do
+        orm DOORKEEPER_ORM
+        reuse_access_token
+        default_scopes(*scopes)
+      end
+
+      FactoryBot.create(:access_token, application_id: client.id,
+                                       resource_owner_id: grant.resource_owner_id, scopes: grant.scopes.to_s)
+
+      allow_any_instance_of(Doorkeeper::AccessToken).to receive(:reusable?).and_return(false)
+
+      expect { subject.authorize }.to change { Doorkeeper::AccessToken.count }.by(1)
+    end
+
     it "calls configured request callback methods" do
       expect(Doorkeeper.configuration.before_successful_strategy_response)
         .to receive(:call).with(subject).once
@@ -107,7 +130,7 @@ module Doorkeeper::OAuth
     end
 
     context "when redirect_uri is not an URI" do
-      let(:redirect_uri) { '123d#!s' }
+      let(:redirect_uri) { "123d#!s" }
 
       it "responds with invalid_grant" do
         subject.validate
@@ -116,7 +139,7 @@ module Doorkeeper::OAuth
     end
 
     context "when redirect_uri is the native one" do
-      let(:redirect_uri) { 'urn:ietf:wg:oauth:2.0:oob' }
+      let(:redirect_uri) { "urn:ietf:wg:oauth:2.0:oob" }
 
       it "invalidates when redirect_uri of the grant is not native" do
         subject.validate

data/spec/lib/oauth/base_request_spec.rb

@@ -1,19 +1,21 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth
   describe BaseRequest do
     let(:access_token) do
       double :access_token,
-             token:              "some-token",
-             expires_in:         "3600",
+             plaintext_token: "some-token",
+             expires_in: "3600",
              expires_in_seconds: "300",
-             scopes_string:      "two scopes",
-             refresh_token:      "some-refresh-token",
-             token_type:         "bearer",
-             created_at:         0
+             scopes_string: "two scopes",
+             plaintext_refresh_token: "some-refresh-token",
+             token_type: "bearer",
+             created_at: 0
     end
 
-    let(:client) { double :client, id: '1' }
+    let(:client) { double :client, id: "1" }
 
     let(:scopes_array) { %w[public write] }
 
@@ -24,6 +26,10 @@ module Doorkeeper::OAuth
              refresh_token_enabled?: false
     end
 
+    before do
+      allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
+    end
+
     subject do
       BaseRequest.new
     end
@@ -111,6 +117,9 @@ module Doorkeeper::OAuth
                         access_token_expires_in: 100,
                         custom_access_token_expires_in: ->(context) { context.scopes == "public" ? 500 : nil },
                         refresh_token_enabled?: false)
+
+        allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
+
         result = subject.find_or_create_access_token(
           client,
           "1",
@@ -127,6 +136,9 @@ module Doorkeeper::OAuth
                         refresh_token_enabled?: lambda { |context|
                           context.scopes == "public"
                         })
+
+        allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
+
         result = subject.find_or_create_access_token(
           client,
           "1",

data/spec/lib/oauth/base_response_spec.rb

@@ -1,4 +1,6 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth
   describe BaseResponse do