doorkeeper 5.0.3 → 5.1.0

data/spec/lib/oauth/password_access_token_request_spec.rb

@@ -1,4 +1,6 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth
   describe PasswordAccessTokenRequest do
@@ -16,11 +18,15 @@ module Doorkeeper::OAuth
     let(:client) { FactoryBot.create(:application) }
     let(:owner)  { double :owner, id: 99 }
 
+    before do
+      allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
+    end
+
     subject do
       PasswordAccessTokenRequest.new(server, client, owner)
     end
 
-    it 'issues a new token for the client' do
+    it "issues a new token for the client" do
       expect do
         subject.authorize
       end.to change { client.reload.access_tokens.count }.by(1)
@@ -28,35 +34,35 @@ module Doorkeeper::OAuth
       expect(client.reload.access_tokens.max_by(&:created_at).expires_in).to eq(1234)
     end
 
-    it 'issues a new token without a client' do
+    it "issues a new token without a client" do
       expect do
         subject.client = nil
         subject.authorize
       end.to change { Doorkeeper::AccessToken.count }.by(1)
     end
 
-    it 'does not issue a new token with an invalid client' do
+    it "does not issue a new token with an invalid client" do
       expect do
         subject.client = nil
-        subject.parameters = { client_id: 'bad_id' }
+        subject.parameters = { client_id: "bad_id" }
         subject.authorize
       end.not_to(change { Doorkeeper::AccessToken.count })
 
       expect(subject.error).to eq(:invalid_client)
     end
 
-    it 'requires the owner' do
+    it "requires the owner" do
       subject.resource_owner = nil
       subject.validate
       expect(subject.error).to eq(:invalid_grant)
     end
 
-    it 'optionally accepts the client' do
+    it "optionally accepts the client" do
       subject.client = nil
       expect(subject).to be_valid
     end
 
-    it 'creates token even when there is already one (default)' do
+    it "creates token even when there is already one (default)" do
       FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
 
       expect do
@@ -64,7 +70,7 @@ module Doorkeeper::OAuth
       end.to change { Doorkeeper::AccessToken.count }.by(1)
     end
 
-    it 'skips token creation if there is already one' do
+    it "skips token creation if there is already one reusable" do
       allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
       FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
 
@@ -73,6 +79,16 @@ module Doorkeeper::OAuth
       end.not_to(change { Doorkeeper::AccessToken.count })
     end
 
+    it "creates token when there is already one but non reusable" do
+      allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
+      FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
+      allow_any_instance_of(Doorkeeper::AccessToken).to receive(:reusable?).and_return(false)
+
+      expect do
+        subject.authorize
+      end.to change { Doorkeeper::AccessToken.count }.by(1)
+    end
+
     it "calls configured request callback methods" do
       expect(Doorkeeper.configuration.before_successful_strategy_response)
         .to receive(:call).with(subject).once
@@ -83,28 +99,53 @@ module Doorkeeper::OAuth
       subject.authorize
     end
 
-    describe 'with scopes' do
+    describe "with scopes" do
       subject do
-        PasswordAccessTokenRequest.new(server, client, owner, scope: 'public')
+        PasswordAccessTokenRequest.new(server, client, owner, scope: "public")
       end
 
-      it 'validates the current scope' do
-        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('another'))
-        subject.validate
-        expect(subject.error).to eq(:invalid_scope)
+      context "when scopes_by_grant_type is not configured for grant_type" do
+        it "returns error when scopes are invalid" do
+          allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("another"))
+          subject.validate
+          expect(subject.error).to eq(:invalid_scope)
+        end
+
+        it "creates the token with scopes if scopes are valid" do
+          allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
+          expect do
+            subject.authorize
+          end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+          expect(Doorkeeper::AccessToken.last.scopes).to include("public")
+        end
       end
 
-      it 'creates the token with scopes' do
-        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('public'))
-        expect do
-          subject.authorize
-        end.to change { Doorkeeper::AccessToken.count }.by(1)
-
-        expect(Doorkeeper::AccessToken.last.scopes).to include('public')
+      context "when scopes_by_grant_type is configured for grant_type" do
+        it "returns error when scopes are valid but not permitted for grant_type" do
+          allow(server)
+            .to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
+          allow(Doorkeeper.configuration)
+            .to receive(:scopes_by_grant_type).and_return(password: "another")
+          subject.validate
+          expect(subject.error).to eq(:invalid_scope)
+        end
+
+        it "creates the token with scopes if scopes are valid and permitted for grant_type" do
+          allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
+          allow(Doorkeeper.configuration)
+            .to receive(:scopes_by_grant_type).and_return(password: [:public])
+
+          expect do
+            subject.authorize
+          end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+          expect(Doorkeeper::AccessToken.last.scopes).to include("public")
+        end
       end
     end
 
-    describe 'with custom expiry' do
+    describe "with custom expiry" do
       let(:server) do
         double(
           :server,
@@ -112,14 +153,22 @@ module Doorkeeper::OAuth
           access_token_expires_in: 2.hours,
           refresh_token_enabled?: false,
           custom_access_token_expires_in: lambda { |context|
-            context.scopes.exists?('public') ? 222 : nil
+            if context.scopes.exists?("public")
+              222
+            elsif context.scopes.exists?("magic")
+              Float::INFINITY
+            end
           }
         )
       end
 
-      it 'checks scopes' do
-        subject = PasswordAccessTokenRequest.new(server, client, owner, scope: 'public')
-        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('public'))
+      before do
+        allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
+      end
+
+      it "checks scopes" do
+        subject = PasswordAccessTokenRequest.new(server, client, owner, scope: "public")
+        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
 
         expect do
           subject.authorize
@@ -128,9 +177,9 @@ module Doorkeeper::OAuth
         expect(Doorkeeper::AccessToken.last.expires_in).to eq(222)
       end
 
-      it 'falls back to the default otherwise' do
-        subject = PasswordAccessTokenRequest.new(server, client, owner, scope: 'private')
-        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string('private'))
+      it "falls back to the default otherwise" do
+        subject = PasswordAccessTokenRequest.new(server, client, owner, scope: "private")
+        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("private"))
 
         expect do
           subject.authorize

data/spec/lib/oauth/pre_authorization_spec.rb

@@ -1,29 +1,31 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth
   describe PreAuthorization do
     let(:server) do
       server = Doorkeeper.configuration
       allow(server).to receive(:default_scopes).and_return(Scopes.new)
-      allow(server).to receive(:scopes).and_return(Scopes.from_string('public profile'))
+      allow(server).to receive(:scopes).and_return(Scopes.from_string("public profile"))
       server
     end
 
     let(:application) do
       application = double :application
-      allow(application).to receive(:scopes).and_return(Scopes.from_string(''))
+      allow(application).to receive(:scopes).and_return(Scopes.from_string(""))
       application
     end
 
     let(:client) do
-      double :client, redirect_uri: 'http://tst.com/auth', application: application
+      double :client, redirect_uri: "http://tst.com/auth", application: application
     end
 
     let :attributes do
       {
-        response_type: 'code',
-        redirect_uri: 'http://tst.com/auth',
-        state: 'save-this'
+        response_type: "code",
+        redirect_uri: "http://tst.com/auth",
+        state: "save-this",
       }
     end
 
@@ -31,133 +33,157 @@ module Doorkeeper::OAuth
       PreAuthorization.new(server, client, attributes)
     end
 
-    it 'is authorizable when request is valid' do
+    it "is authorizable when request is valid" do
       expect(subject).to be_authorizable
     end
 
-    it 'accepts code as response type' do
-      subject.response_type = 'code'
+    it "accepts code as response type" do
+      subject.response_type = "code"
       expect(subject).to be_authorizable
     end
 
-    it 'accepts token as response type' do
-      allow(server).to receive(:grant_flows).and_return(['implicit'])
-      subject.response_type = 'token'
+    it "accepts token as response type" do
+      allow(server).to receive(:grant_flows).and_return(["implicit"])
+      subject.response_type = "token"
       expect(subject).to be_authorizable
     end
 
-    context 'when using default grant flows' do
+    context "when using default grant flows" do
       it 'accepts "code" as response type' do
-        subject.response_type = 'code'
+        subject.response_type = "code"
         expect(subject).to be_authorizable
       end
 
       it 'accepts "token" as response type' do
-        allow(server).to receive(:grant_flows).and_return(['implicit'])
-        subject.response_type = 'token'
+        allow(server).to receive(:grant_flows).and_return(["implicit"])
+        subject.response_type = "token"
         expect(subject).to be_authorizable
       end
     end
 
-    context 'when authorization code grant flow is disabled' do
+    context "when authorization code grant flow is disabled" do
       before do
-        allow(server).to receive(:grant_flows).and_return(['implicit'])
+        allow(server).to receive(:grant_flows).and_return(["implicit"])
       end
 
       it 'does not accept "code" as response type' do
-        subject.response_type = 'code'
+        subject.response_type = "code"
         expect(subject).not_to be_authorizable
       end
     end
 
-    context 'when implicit grant flow is disabled' do
+    context "when implicit grant flow is disabled" do
       before do
-        allow(server).to receive(:grant_flows).and_return(['authorization_code'])
+        allow(server).to receive(:grant_flows).and_return(["authorization_code"])
       end
 
       it 'does not accept "token" as response type' do
-        subject.response_type = 'token'
+        subject.response_type = "token"
         expect(subject).not_to be_authorizable
       end
     end
 
-    context 'client application does not restrict valid scopes' do
-      it 'accepts valid scopes' do
-        subject.scope = 'public'
+    context "client application does not restrict valid scopes" do
+      it "accepts valid scopes" do
+        subject.scope = "public"
+        expect(subject).to be_authorizable
+      end
+
+      it "rejects (globally) non-valid scopes" do
+        subject.scope = "invalid"
+        expect(subject).not_to be_authorizable
+      end
+
+      it "accepts scopes which are permitted for grant_type" do
+        allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:public])
+        subject.scope = "public"
         expect(subject).to be_authorizable
       end
 
-      it 'rejects (globally) non-valid scopes' do
-        subject.scope = 'invalid'
+      it "rejects scopes which are not permitted for grant_type" do
+        allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:profile])
+        subject.scope = "public"
         expect(subject).not_to be_authorizable
       end
     end
 
-    context 'client application restricts valid scopes' do
+    context "client application restricts valid scopes" do
       let(:application) do
         application = double :application
-        allow(application).to receive(:scopes).and_return(Scopes.from_string('public nonsense'))
+        allow(application).to receive(:scopes).and_return(Scopes.from_string("public nonsense"))
         application
       end
 
-      it 'accepts valid scopes' do
-        subject.scope = 'public'
+      it "accepts valid scopes" do
+        subject.scope = "public"
         expect(subject).to be_authorizable
       end
 
-      it 'rejects (globally) non-valid scopes' do
-        subject.scope = 'invalid'
+      it "rejects (globally) non-valid scopes" do
+        subject.scope = "invalid"
         expect(subject).not_to be_authorizable
       end
 
-      it 'rejects (application level) non-valid scopes' do
-        subject.scope = 'profile'
+      it "rejects (application level) non-valid scopes" do
+        subject.scope = "profile"
         expect(subject).to_not be_authorizable
       end
+
+      it "accepts scopes which are permitted for grant_type" do
+        allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:public])
+        subject.scope = "public"
+        expect(subject).to be_authorizable
+      end
+
+      it "rejects scopes which are not permitted for grant_type" do
+        allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:profile])
+        subject.scope = "public"
+        expect(subject).not_to be_authorizable
+      end
     end
 
-    it 'uses default scopes when none is required' do
-      allow(server).to receive(:default_scopes).and_return(Scopes.from_string('default'))
+    it "uses default scopes when none is required" do
+      allow(server).to receive(:default_scopes).and_return(Scopes.from_string("default"))
       subject.scope = nil
-      expect(subject.scope).to eq('default')
-      expect(subject.scopes).to eq(Scopes.from_string('default'))
+      expect(subject.scope).to eq("default")
+      expect(subject.scopes).to eq(Scopes.from_string("default"))
     end
 
-    context 'with native redirect uri' do
-      let(:native_redirect_uri) { 'urn:ietf:wg:oauth:2.0:oob' }
+    context "with native redirect uri" do
+      let(:native_redirect_uri) { "urn:ietf:wg:oauth:2.0:oob" }
 
-      it 'accepts redirect_uri when it matches with the client' do
+      it "accepts redirect_uri when it matches with the client" do
         subject.redirect_uri = native_redirect_uri
         allow(subject.client).to receive(:redirect_uri) { native_redirect_uri }
         expect(subject).to be_authorizable
       end
 
-      it 'invalidates redirect_uri when it does\'n match with the client' do
-        subject.redirect_uri = 'urn:ietf:wg:oauth:2.0:oob'
+      it "invalidates redirect_uri when it does'n match with the client" do
+        subject.redirect_uri = "urn:ietf:wg:oauth:2.0:oob"
         expect(subject).not_to be_authorizable
       end
     end
 
-    it 'matches the redirect uri against client\'s one' do
-      subject.redirect_uri = 'http://nothesame.com'
+    it "matches the redirect uri against client's one" do
+      subject.redirect_uri = "http://nothesame.com"
       expect(subject).not_to be_authorizable
     end
 
-    it 'stores the state' do
-      expect(subject.state).to eq('save-this')
+    it "stores the state" do
+      expect(subject.state).to eq("save-this")
     end
 
-    it 'rejects if response type is not allowed' do
-      subject.response_type = 'whops'
+    it "rejects if response type is not allowed" do
+      subject.response_type = "whops"
       expect(subject).not_to be_authorizable
     end
 
-    it 'requires an existing client' do
+    it "requires an existing client" do
       subject.client = nil
       expect(subject).not_to be_authorizable
     end
 
-    it 'requires a redirect uri' do
+    it "requires a redirect uri" do
       subject.redirect_uri = nil
       expect(subject).not_to be_authorizable
     end
@@ -182,7 +208,7 @@ module Doorkeeper::OAuth
         expect(json[:response_type]).to eq subject.response_type
         expect(json[:scope]).to eq subject.scope
         expect(json[:client_name]).to eq client_name
-        expect(json[:status]).to eq I18n.t('doorkeeper.pre_authorization.status')
+        expect(json[:status]).to eq I18n.t("doorkeeper.pre_authorization.status")
       end
     end
   end

data/spec/lib/oauth/refresh_token_request_spec.rb

@@ -1,15 +1,12 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper::OAuth
   describe RefreshTokenRequest do
-    before do
-      allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(false)
-    end
-
     let(:server) do
       double :server,
-             access_token_expires_in: 2.minutes,
-             custom_access_token_expires_in: ->(_context) { nil }
+             access_token_expires_in: 2.minutes
     end
 
     let(:refresh_token) do
@@ -19,21 +16,27 @@ module Doorkeeper::OAuth
     let(:client) { refresh_token.application }
     let(:credentials) { Client::Credentials.new(client.uid, client.secret) }
 
+    before do
+      allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(false)
+      allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(false)
+    end
+
     subject { RefreshTokenRequest.new server, refresh_token, credentials }
 
-    it 'issues a new token for the client' do
+    it "issues a new token for the client" do
       expect { subject.authorize }.to change { client.reload.access_tokens.count }.by(1)
       # #sort_by used for MongoDB ORM extensions for valid ordering
       expect(client.reload.access_tokens.max_by(&:created_at).expires_in).to eq(120)
     end
 
-    it 'issues a new token for the client with custom expires_in' do
+    it "issues a new token for the client with custom expires_in" do
       server = double :server,
                       access_token_expires_in: 2.minutes,
                       custom_access_token_expires_in: lambda { |context|
                         context.grant_type == Doorkeeper::OAuth::REFRESH_TOKEN ? 1234 : nil
                       }
 
+      allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
       allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(false)
 
       RefreshTokenRequest.new(server, refresh_token, credentials).authorize
@@ -42,7 +45,7 @@ module Doorkeeper::OAuth
       expect(client.reload.access_tokens.max_by(&:created_at).expires_in).to eq(1234)
     end
 
-    it 'revokes the previous token' do
+    it "revokes the previous token" do
       expect { subject.authorize }.to change { refresh_token.revoked? }.from(false).to(true)
     end
 
@@ -56,13 +59,13 @@ module Doorkeeper::OAuth
       subject.authorize
     end
 
-    it 'requires the refresh token' do
+    it "requires the refresh token" do
       subject.refresh_token = nil
       subject.validate
       expect(subject.error).to eq(:invalid_request)
     end
 
-    it 'requires credentials to be valid if provided' do
+    it "requires credentials to be valid if provided" do
       subject.client = nil
       subject.validate
       expect(subject.error).to eq(:invalid_client)
@@ -74,20 +77,20 @@ module Doorkeeper::OAuth
       expect(subject.error).to eq(:invalid_grant)
     end
 
-    it 'rejects revoked tokens' do
+    it "rejects revoked tokens" do
       refresh_token.revoke
       subject.validate
       expect(subject.error).to eq(:invalid_grant)
     end
 
-    it 'accepts expired tokens' do
+    it "accepts expired tokens" do
       refresh_token.expires_in = -1
       refresh_token.save
       subject.validate
       expect(subject).to be_valid
     end
 
-    context 'refresh tokens expire on access token use' do
+    context "refresh tokens expire on access token use" do
       let(:server) do
         double :server,
                access_token_expires_in: 2.minutes,
@@ -100,16 +103,16 @@ module Doorkeeper::OAuth
         allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(true)
       end
 
-      it 'issues a new token for the client' do
+      it "issues a new token for the client" do
         expect { subject.authorize }.to change { client.reload.access_tokens.count }.by(1)
       end
 
-      it 'does not revoke the previous token' do
+      it "does not revoke the previous token" do
         subject.authorize
         expect(refresh_token).not_to be_revoked
       end
 
-      it 'sets the previous refresh token in the new access token' do
+      it "sets the previous refresh token in the new access token" do
         subject.authorize
         expect(
           # #sort_by used for MongoDB ORM extensions for valid ordering
@@ -118,53 +121,53 @@ module Doorkeeper::OAuth
       end
     end
 
-    context 'clientless access tokens' do
+    context "clientless access tokens" do
       let!(:refresh_token) { FactoryBot.create(:clientless_access_token, use_refresh_token: true) }
 
       subject { RefreshTokenRequest.new server, refresh_token, nil }
 
-      it 'issues a new token without a client' do
+      it "issues a new token without a client" do
         expect { subject.authorize }.to change { Doorkeeper::AccessToken.count }.by(1)
       end
     end
 
-    context 'with scopes' do
+    context "with scopes" do
       let(:refresh_token) do
         FactoryBot.create :access_token,
                           use_refresh_token: true,
-                          scopes: 'public write'
+                          scopes: "public write"
       end
       let(:parameters) { {} }
       subject { RefreshTokenRequest.new server, refresh_token, credentials, parameters }
 
-      it 'transfers scopes from the old token to the new token' do
+      it "transfers scopes from the old token to the new token" do
         subject.authorize
         expect(Doorkeeper::AccessToken.last.scopes).to eq(%i[public write])
       end
 
-      it 'reduces scopes to the provided scopes' do
-        parameters[:scopes] = 'public'
+      it "reduces scopes to the provided scopes" do
+        parameters[:scopes] = "public"
         subject.authorize
         expect(Doorkeeper::AccessToken.last.scopes).to eq(%i[public])
       end
 
-      it 'validates that scopes are included in the original access token' do
-        parameters[:scopes] = 'public update'
+      it "validates that scopes are included in the original access token" do
+        parameters[:scopes] = "public update"
 
         subject.validate
         expect(subject.error).to eq(:invalid_scope)
       end
 
-      it 'uses params[:scope] in favor of scopes if present (valid)' do
-        parameters[:scopes] = 'public update'
-        parameters[:scope] = 'public'
+      it "uses params[:scope] in favor of scopes if present (valid)" do
+        parameters[:scopes] = "public update"
+        parameters[:scope] = "public"
         subject.authorize
         expect(Doorkeeper::AccessToken.last.scopes).to eq(%i[public])
       end
 
-      it 'uses params[:scope] in favor of scopes if present (invalid)' do
-        parameters[:scopes] = 'public'
-        parameters[:scope] = 'public update'
+      it "uses params[:scope] in favor of scopes if present (invalid)" do
+        parameters[:scopes] = "public"
+        parameters[:scope] = "public update"
 
         subject.validate
         expect(subject.error).to eq(:invalid_scope)