doorkeeper 5.0.3 → 5.1.0

data/spec/lib/oauth/error_response_spec.rb

@@ -1,50 +1,58 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth
   describe ErrorResponse do
-    describe '#status' do
-      it 'should have a status of unauthorized' do
+    describe "#status" do
+      it "should have a status of bad_request" do
+        expect(subject.status).to eq(:bad_request)
+      end
+
+      it "should have a status of unauthorized for an invalid_client error" do
+        subject = described_class.new(name: :invalid_client)
+
         expect(subject.status).to eq(:unauthorized)
       end
     end
 
     describe :from_request do
-      it 'has the error from request' do
+      it "has the error from request" do
         error = ErrorResponse.from_request double(error: :some_error)
         expect(error.name).to eq(:some_error)
       end
 
-      it 'ignores state if request does not respond to state' do
+      it "ignores state if request does not respond to state" do
         error = ErrorResponse.from_request double(error: :some_error)
         expect(error.state).to be_nil
       end
 
-      it 'has state if request responds to state' do
+      it "has state if request responds to state" do
         error = ErrorResponse.from_request double(error: :some_error, state: :hello)
         expect(error.state).to eq(:hello)
       end
     end
 
-    it 'ignores empty error values' do
+    it "ignores empty error values" do
       subject = ErrorResponse.new(error: :some_error, state: nil)
       expect(subject.body).not_to have_key(:state)
     end
 
-    describe '.body' do
+    describe ".body" do
       subject { ErrorResponse.new(name: :some_error, state: :some_state).body }
 
-      describe '#body' do
+      describe "#body" do
         it { expect(subject).to have_key(:error) }
         it { expect(subject).to have_key(:error_description) }
         it { expect(subject).to have_key(:state) }
       end
     end
 
-    describe '.headers' do
+    describe ".headers" do
       let(:error_response) { ErrorResponse.new(name: :some_error, state: :some_state) }
       subject { error_response.headers }
 
-      it { expect(subject).to include 'WWW-Authenticate' }
+      it { expect(subject).to include "WWW-Authenticate" }
 
       describe "WWW-Authenticate header" do
         subject { error_response.headers["WWW-Authenticate"] }

data/spec/lib/oauth/error_spec.rb

@@ -1,4 +1,6 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth
   describe Error do
@@ -8,7 +10,7 @@ module Doorkeeper::OAuth
     it { expect(subject).to respond_to(:state) }
 
     describe :description do
-      it 'is translated from translation messages' do
+      it "is translated from translation messages" do
         expect(I18n).to receive(:translate).with(
           :some_error,
           scope: %i[doorkeeper errors messages],

data/spec/lib/oauth/forbidden_token_response_spec.rb

@@ -1,19 +1,21 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth
   describe ForbiddenTokenResponse do
-    describe '#name' do
+    describe "#name" do
       it { expect(subject.name).to eq(:invalid_scope) }
     end
 
-    describe '#status' do
+    describe "#status" do
       it { expect(subject.status).to eq(:forbidden) }
     end
 
     describe :from_scopes do
-      it 'should have a list of acceptable scopes' do
+      it "should have a list of acceptable scopes" do
         response = ForbiddenTokenResponse.from_scopes(["public"])
-        expect(response.description).to include('public')
+        expect(response.description).to include("public")
       end
     end
   end

data/spec/lib/oauth/helpers/scope_checker_spec.rb

@@ -1,60 +1,97 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth::Helpers
-  describe ScopeChecker, '.valid?' do
+  describe ScopeChecker, ".valid?" do
     let(:server_scopes) { Doorkeeper::OAuth::Scopes.new }
 
-    it 'is valid if scope is present' do
+    it "is valid if scope is present" do
       server_scopes.add :scope
-      expect(ScopeChecker.valid?('scope', server_scopes)).to be_truthy
+      expect(ScopeChecker.valid?(scope_str: "scope", server_scopes: server_scopes)).to be_truthy
     end
 
-    it 'is invalid if includes tabs space' do
-      expect(ScopeChecker.valid?("\tsomething", server_scopes)).to be_falsey
+    it "is invalid if includes tabs space" do
+      expect(ScopeChecker.valid?(scope_str: "\tsomething", server_scopes: server_scopes)).to be_falsey
     end
 
-    it 'is invalid if scope is not present' do
-      expect(ScopeChecker.valid?(nil, server_scopes)).to be_falsey
+    it "is invalid if scope is not present" do
+      expect(ScopeChecker.valid?(scope_str: nil, server_scopes: server_scopes)).to be_falsey
     end
 
-    it 'is invalid if scope is blank' do
-      expect(ScopeChecker.valid?(' ', server_scopes)).to be_falsey
+    it "is invalid if scope is blank" do
+      expect(ScopeChecker.valid?(scope_str: " ", server_scopes: server_scopes)).to be_falsey
     end
 
-    it 'is invalid if includes return space' do
-      expect(ScopeChecker.valid?("scope\r", server_scopes)).to be_falsey
+    it "is invalid if includes return space" do
+      expect(ScopeChecker.valid?(scope_str: "scope\r", server_scopes: server_scopes)).to be_falsey
     end
 
-    it 'is invalid if includes new lines' do
-      expect(ScopeChecker.valid?("scope\nanother", server_scopes)).to be_falsey
+    it "is invalid if includes new lines" do
+      expect(ScopeChecker.valid?(scope_str: "scope\nanother", server_scopes: server_scopes)).to be_falsey
     end
 
-    it 'is invalid if any scope is not included in server scopes' do
-      expect(ScopeChecker.valid?('scope another', server_scopes)).to be_falsey
+    it "is invalid if any scope is not included in server scopes" do
+      expect(ScopeChecker.valid?(scope_str: "scope another", server_scopes: server_scopes)).to be_falsey
     end
 
-    context 'with application_scopes' do
+    context "with application_scopes" do
       let(:server_scopes) do
-        Doorkeeper::OAuth::Scopes.from_string 'common svr'
+        Doorkeeper::OAuth::Scopes.from_string "common svr"
       end
       let(:application_scopes) do
-        Doorkeeper::OAuth::Scopes.from_string 'app123'
+        Doorkeeper::OAuth::Scopes.from_string "app123"
+      end
+
+      it "is valid if scope is included in the application scope list" do
+        expect(ScopeChecker.valid?(scope_str: "app123",
+                                   server_scopes: server_scopes,
+                                   app_scopes: application_scopes)).to be_truthy
+      end
+
+      it "is invalid if any scope is not included in the application" do
+        expect(ScopeChecker.valid?(scope_str: "svr",
+                                   server_scopes: server_scopes,
+                                   app_scopes: application_scopes)).to be_falsey
+      end
+    end
+
+    context "with grant_type" do
+      let(:server_scopes) do
+        Doorkeeper::OAuth::Scopes.from_string "scope1 scope2"
       end
 
-      it 'is valid if scope is included in the application scope list' do
-        expect(ScopeChecker.valid?(
-                 'app123',
-                 server_scopes,
-                 application_scopes
-               )).to be_truthy
+      context "with scopes_by_grant_type not configured for grant_type" do
+        it "is valid if the scope is in server scopes" do
+          expect(ScopeChecker.valid?(scope_str: "scope1",
+                                     server_scopes: server_scopes,
+                                     grant_type: Doorkeeper::OAuth::PASSWORD)).to be_truthy
+        end
+
+        it "is invalid if the scope is not in server scopes" do
+          expect(ScopeChecker.valid?(scope_str: "unknown",
+                                     server_scopes: server_scopes,
+                                     grant_type: Doorkeeper::OAuth::PASSWORD)).to be_falsey
+        end
       end
 
-      it 'is invalid if any scope is not included in the application' do
-        expect(ScopeChecker.valid?(
-                 'svr',
-                 server_scopes,
-                 application_scopes
-               )).to be_falsey
+      context "when scopes_by_grant_type configured for grant_type" do
+        before do
+          allow(Doorkeeper.configuration).to receive(:scopes_by_grant_type)
+            .and_return(password: [:scope1])
+        end
+
+        it "is valid if the scope is permitted for grant_type" do
+          expect(ScopeChecker.valid?(scope_str: "scope1",
+                                     server_scopes: server_scopes,
+                                     grant_type: Doorkeeper::OAuth::PASSWORD)).to be_truthy
+        end
+
+        it "is invalid if the scope is permitted for grant_type" do
+          expect(ScopeChecker.valid?(scope_str: "scope2",
+                                     server_scopes: server_scopes,
+                                     grant_type: Doorkeeper::OAuth::PASSWORD)).to be_falsey
+        end
       end
     end
   end

data/spec/lib/oauth/helpers/unique_token_spec.rb

@@ -1,19 +1,21 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth::Helpers
   describe UniqueToken do
     let :generator do
-      ->(size) { 'a' * size }
+      ->(size) { "a" * size }
     end
 
-    it 'is able to customize the generator method' do
+    it "is able to customize the generator method" do
       token = UniqueToken.generate(generator: generator)
-      expect(token).to eq('a' * 32)
+      expect(token).to eq("a" * 32)
     end
 
-    it 'is able to customize the size of the token' do
+    it "is able to customize the size of the token" do
       token = UniqueToken.generate(generator: generator, size: 2)
-      expect(token).to eq('aa')
+      expect(token).to eq("aa")
     end
   end
 end

data/spec/lib/oauth/helpers/uri_checker_spec.rb

@@ -1,226 +1,246 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth::Helpers
   describe URIChecker do
-    describe '.valid?' do
-      it 'is valid for valid uris' do
-        uri = 'http://app.co'
+    describe ".valid?" do
+      it "is valid for valid uris" do
+        uri = "http://app.co"
         expect(URIChecker.valid?(uri)).to be_truthy
       end
 
-      it 'is valid if include path param' do
-        uri = 'http://app.co/path'
+      it "is valid if include path param" do
+        uri = "http://app.co/path"
         expect(URIChecker.valid?(uri)).to be_truthy
       end
 
-      it 'is valid if include query param' do
-        uri = 'http://app.co/?query=1'
+      it "is valid if include query param" do
+        uri = "http://app.co/?query=1"
         expect(URIChecker.valid?(uri)).to be_truthy
       end
 
-      it 'is invalid if uri includes fragment' do
-        uri = 'http://app.co/test#fragment'
+      it "is invalid if uri includes fragment" do
+        uri = "http://app.co/test#fragment"
         expect(URIChecker.valid?(uri)).to be_falsey
       end
 
-      it 'is invalid if scheme is missing' do
-        uri = 'app.co'
+      it "is invalid if scheme is missing" do
+        uri = "app.co"
         expect(URIChecker.valid?(uri)).to be_falsey
       end
 
-      it 'is invalid if is a relative uri' do
-        uri = '/abc/123'
+      it "is invalid if is a relative uri" do
+        uri = "/abc/123"
         expect(URIChecker.valid?(uri)).to be_falsey
       end
 
-      it 'is invalid if is not a url' do
-        uri = 'http://'
+      it "is invalid if is not a url" do
+        uri = "http://"
         expect(URIChecker.valid?(uri)).to be_falsey
       end
 
-      it 'is invalid if is not an uri' do
-        uri = '   '
+      it "is invalid if is not an uri" do
+        uri = "   "
         expect(URIChecker.valid?(uri)).to be_falsey
       end
 
-      it 'is valid for native uris' do
-        uri = 'urn:ietf:wg:oauth:2.0:oob'
+      it "is valid for native uris" do
+        uri = "urn:ietf:wg:oauth:2.0:oob"
         expect(URIChecker.valid?(uri)).to be_truthy
       end
     end
 
-    describe '.matches?' do
-      it 'is true if both url matches' do
-        uri = client_uri = 'http://app.co/aaa'
+    describe ".matches?" do
+      it "is true if both url matches" do
+        uri = client_uri = "http://app.co/aaa"
         expect(URIChecker.matches?(uri, client_uri)).to be_truthy
       end
 
-      it 'ignores query parameter on comparsion' do
-        uri = 'http://app.co/?query=hello'
-        client_uri = 'http://app.co'
+      it "ignores query parameter on comparsion" do
+        uri = "http://app.co/?query=hello"
+        client_uri = "http://app.co"
         expect(URIChecker.matches?(uri, client_uri)).to be_truthy
       end
 
-      it 'doesn\'t allow non-matching domains through' do
-        uri = 'http://app.abc/?query=hello'
-        client_uri = 'http://app.co'
+      it "doesn't allow non-matching domains through" do
+        uri = "http://app.abc/?query=hello"
+        client_uri = "http://app.co"
         expect(URIChecker.matches?(uri, client_uri)).to be_falsey
       end
 
-      it 'doesn\'t allow non-matching domains that don\'t start at the beginning' do
-        uri = 'http://app.co/?query=hello'
-        client_uri = 'http://example.com?app.co=test'
+      it "doesn't allow non-matching domains that don't start at the beginning" do
+        uri = "http://app.co/?query=hello"
+        client_uri = "http://example.com?app.co=test"
         expect(URIChecker.matches?(uri, client_uri)).to be_falsey
       end
 
+      context "loopback IP redirect URIs" do
+        it "ignores port for same URIs" do
+          uri = "http://127.0.0.1:5555/auth/callback"
+          client_uri = "http://127.0.0.1:48599/auth/callback"
+          expect(URIChecker.matches?(uri, client_uri)).to be_truthy
+
+          uri = "http://[::1]:5555/auth/callback"
+          client_uri = "http://[::1]:5555/auth/callback"
+          expect(URIChecker.matches?(uri, client_uri)).to be_truthy
+        end
+
+        it "doesn't ignore port for URIs with different queries" do
+          uri = "http://127.0.0.1:5555/auth/callback"
+          client_uri = "http://127.0.0.1:48599/auth/callback2"
+          expect(URIChecker.matches?(uri, client_uri)).to be_falsey
+        end
+      end
+
       context "client registered query params" do
         it "doesn't allow query being absent" do
-          uri = 'http://app.co'
-          client_uri = 'http://app.co/?vendorId=AJ4L7XXW9'
+          uri = "http://app.co"
+          client_uri = "http://app.co/?vendorId=AJ4L7XXW9"
           expect(URIChecker.matches?(uri, client_uri)).to be_falsey
         end
 
         it "is false if query values differ but key same" do
-          uri = 'http://app.co/?vendorId=pancakes'
-          client_uri = 'http://app.co/?vendorId=waffles'
+          uri = "http://app.co/?vendorId=pancakes"
+          client_uri = "http://app.co/?vendorId=waffles"
           expect(URIChecker.matches?(uri, client_uri)).to be_falsey
         end
 
         it "is false if query values same but key differs" do
-          uri = 'http://app.co/?foo=pancakes'
-          client_uri = 'http://app.co/?bar=pancakes'
+          uri = "http://app.co/?foo=pancakes"
+          client_uri = "http://app.co/?bar=pancakes"
           expect(URIChecker.matches?(uri, client_uri)).to be_falsey
         end
 
         it "is false if query present and match, but unknown queries present" do
-          uri = 'http://app.co/?vendorId=pancakes&unknown=query'
-          client_uri = 'http://app.co/?vendorId=waffles'
+          uri = "http://app.co/?vendorId=pancakes&unknown=query"
+          client_uri = "http://app.co/?vendorId=waffles"
           expect(URIChecker.matches?(uri, client_uri)).to be_falsey
         end
 
         it "is true if queries are present and matche" do
-          uri = 'http://app.co/?vendorId=AJ4L7XXW9&foo=bar'
-          client_uri = 'http://app.co/?vendorId=AJ4L7XXW9&foo=bar'
+          uri = "http://app.co/?vendorId=AJ4L7XXW9&foo=bar"
+          client_uri = "http://app.co/?vendorId=AJ4L7XXW9&foo=bar"
           expect(URIChecker.matches?(uri, client_uri)).to be_truthy
         end
 
         it "is true if queries are present, match and in different order" do
-          uri = 'http://app.co/?bing=bang&foo=bar'
-          client_uri = 'http://app.co/?foo=bar&bing=bang'
+          uri = "http://app.co/?bing=bang&foo=bar"
+          client_uri = "http://app.co/?foo=bar&bing=bang"
           expect(URIChecker.matches?(uri, client_uri)).to be_truthy
         end
       end
     end
 
-    describe '.valid_for_authorization?' do
-      it 'is true if valid and matches' do
-        uri = client_uri = 'http://app.co/aaa'
+    describe ".valid_for_authorization?" do
+      it "is true if valid and matches" do
+        uri = client_uri = "http://app.co/aaa"
         expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_truthy
 
-        uri = client_uri = 'http://app.co/aaa?b=c'
+        uri = client_uri = "http://app.co/aaa?b=c"
         expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_truthy
       end
 
-      it 'is true if uri includes blank query' do
-        uri = client_uri = 'http://app.co/aaa?'
+      it "is true if uri includes blank query" do
+        uri = client_uri = "http://app.co/aaa?"
         expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_truthy
 
-        uri = 'http://app.co/aaa?'
-        client_uri = 'http://app.co/aaa'
+        uri = "http://app.co/aaa?"
+        client_uri = "http://app.co/aaa"
         expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_truthy
 
-        uri = 'http://app.co/aaa'
-        client_uri = 'http://app.co/aaa?'
+        uri = "http://app.co/aaa"
+        client_uri = "http://app.co/aaa?"
         expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_truthy
       end
 
-      it 'is false if valid and mismatches' do
-        uri = 'http://app.co/aaa'
-        client_uri = 'http://app.co/bbb'
+      it "is false if valid and mismatches" do
+        uri = "http://app.co/aaa"
+        client_uri = "http://app.co/bbb"
         expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_falsey
       end
 
-      it 'is true if valid and included in array' do
-        uri = 'http://app.co/aaa'
+      it "is true if valid and included in array" do
+        uri = "http://app.co/aaa"
         client_uri = "http://example.com/bbb\nhttp://app.co/aaa"
         expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_truthy
       end
 
-      it 'is false if valid and not included in array' do
-        uri = 'http://app.co/aaa'
+      it "is false if valid and not included in array" do
+        uri = "http://app.co/aaa"
         client_uri = "http://example.com/bbb\nhttp://app.co/cc"
         expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be_falsey
       end
 
-      it 'is false if queries does not match' do
-        uri = 'http://app.co/aaa?pankcakes=abc'
-        client_uri = 'http://app.co/aaa?waffles=abc'
+      it "is false if queries does not match" do
+        uri = "http://app.co/aaa?pankcakes=abc"
+        client_uri = "http://app.co/aaa?waffles=abc"
         expect(URIChecker.valid_for_authorization?(uri, client_uri)).to be false
       end
 
-      it 'calls .matches?' do
-        uri = 'http://app.co/aaa?pankcakes=abc'
-        client_uri = 'http://app.co/aaa?waffles=abc'
+      it "calls .matches?" do
+        uri = "http://app.co/aaa?pankcakes=abc"
+        client_uri = "http://app.co/aaa?waffles=abc"
         expect(URIChecker).to receive(:matches?).with(uri, client_uri).once
         URIChecker.valid_for_authorization?(uri, client_uri)
       end
 
-      it 'calls .valid?' do
-        uri = 'http://app.co/aaa?pankcakes=abc'
-        client_uri = 'http://app.co/aaa?waffles=abc'
+      it "calls .valid?" do
+        uri = "http://app.co/aaa?pankcakes=abc"
+        client_uri = "http://app.co/aaa?waffles=abc"
         expect(URIChecker).to receive(:valid?).with(uri).once
         URIChecker.valid_for_authorization?(uri, client_uri)
       end
     end
 
-    describe '.query_matches?' do
-      it 'is true if no queries' do
-        expect(URIChecker.query_matches?('', '')).to be_truthy
+    describe ".query_matches?" do
+      it "is true if no queries" do
+        expect(URIChecker.query_matches?("", "")).to be_truthy
         expect(URIChecker.query_matches?(nil, nil)).to be_truthy
       end
 
-      it 'is true if same query' do
-        expect(URIChecker.query_matches?('foo', 'foo')).to be_truthy
+      it "is true if same query" do
+        expect(URIChecker.query_matches?("foo", "foo")).to be_truthy
       end
 
-      it 'is false if different query' do
-        expect(URIChecker.query_matches?('foo', 'bar')).to be_falsey
+      it "is false if different query" do
+        expect(URIChecker.query_matches?("foo", "bar")).to be_falsey
       end
 
-      it 'is true if same queries' do
-        expect(URIChecker.query_matches?('foo&bar', 'foo&bar')).to be_truthy
+      it "is true if same queries" do
+        expect(URIChecker.query_matches?("foo&bar", "foo&bar")).to be_truthy
       end
 
-      it 'is true if same queries, different order' do
-        expect(URIChecker.query_matches?('foo&bar', 'bar&foo')).to be_truthy
+      it "is true if same queries, different order" do
+        expect(URIChecker.query_matches?("foo&bar", "bar&foo")).to be_truthy
       end
 
-      it 'is false if one different query' do
-        expect(URIChecker.query_matches?('foo&bang', 'foo&bing')).to be_falsey
+      it "is false if one different query" do
+        expect(URIChecker.query_matches?("foo&bang", "foo&bing")).to be_falsey
       end
 
-      it 'is true if same query with same value' do
-        expect(URIChecker.query_matches?('foo=bar', 'foo=bar')).to be_truthy
+      it "is true if same query with same value" do
+        expect(URIChecker.query_matches?("foo=bar", "foo=bar")).to be_truthy
       end
 
-      it 'is true if same queries with same values' do
-        expect(URIChecker.query_matches?('foo=bar&bing=bang', 'foo=bar&bing=bang')).to be_truthy
+      it "is true if same queries with same values" do
+        expect(URIChecker.query_matches?("foo=bar&bing=bang", "foo=bar&bing=bang")).to be_truthy
       end
 
-      it 'is true if same queries with same values, different order' do
-        expect(URIChecker.query_matches?('foo=bar&bing=bang', 'bing=bang&foo=bar')).to be_truthy
+      it "is true if same queries with same values, different order" do
+        expect(URIChecker.query_matches?("foo=bar&bing=bang", "bing=bang&foo=bar")).to be_truthy
       end
 
-      it 'is false if same query with different value' do
-        expect(URIChecker.query_matches?('foo=bar', 'foo=bang')).to be_falsey
+      it "is false if same query with different value" do
+        expect(URIChecker.query_matches?("foo=bar", "foo=bang")).to be_falsey
       end
 
-      it 'is false if some queries missing' do
-        expect(URIChecker.query_matches?('foo=bar', 'foo=bar&bing=bang')).to be_falsey
+      it "is false if some queries missing" do
+        expect(URIChecker.query_matches?("foo=bar", "foo=bar&bing=bang")).to be_falsey
       end
 
-      it 'is false if some queries different value' do
-        expect(URIChecker.query_matches?('foo=bar&bing=bang', 'foo=bar&bing=banana')).to be_falsey
+      it "is false if some queries different value" do
+        expect(URIChecker.query_matches?("foo=bar&bing=bang", "foo=bar&bing=banana")).to be_falsey
       end
     end
   end

data/spec/lib/oauth/invalid_token_response_spec.rb

@@ -1,4 +1,6 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth
   describe InvalidTokenResponse do