doorkeeper 5.0.3 → 5.1.0

data/spec/requests/applications/applications_request_spec.rb

@@ -1,25 +1,27 @@
-require 'spec_helper'
+# frozen_string_literal: true
 
-feature 'Adding applications' do
-  context 'in application form' do
+require "spec_helper"
+
+feature "Adding applications" do
+  context "in application form" do
     background do
       i_am_logged_in
-      visit '/oauth/applications/new'
+      visit "/oauth/applications/new"
     end
 
-    scenario 'adding a valid app' do
-      fill_in 'doorkeeper_application[name]', with: 'My Application'
-      fill_in 'doorkeeper_application[redirect_uri]',
-              with: 'https://example.com'
+    scenario "adding a valid app" do
+      fill_in "doorkeeper_application[name]", with: "My Application"
+      fill_in "doorkeeper_application[redirect_uri]",
+              with: "https://example.com"
 
-      click_button 'Submit'
-      i_should_see 'Application created'
-      i_should_see 'My Application'
+      click_button "Submit"
+      i_should_see "Application created"
+      i_should_see "My Application"
     end
 
-    scenario 'adding invalid app' do
-      click_button 'Submit'
-      i_should_see 'Whoops! Check your form for possible errors'
+    scenario "adding invalid app" do
+      click_button "Submit"
+      i_should_see "Whoops! Check your form for possible errors"
     end
 
     scenario "adding app ignoring bad scope" do
@@ -88,63 +90,93 @@ feature 'Adding applications' do
       click_button "Submit"
       i_should_see "Whoops! Check your form for possible errors"
       i_should_see Regexp.new(
-        I18n.t('activerecord.errors.models.doorkeeper/application.attributes.scopes.not_match_configured'),
+        I18n.t("activerecord.errors.models.doorkeeper/application.attributes.scopes.not_match_configured"),
         true
       )
     end
+
+    context "redirect URI" do
+      scenario "adding app with blank redirect URI when configured flows requires redirect uri" do
+        config_is_set("grant_flows", %w[authorization_code implicit client_credentials])
+
+        fill_in "doorkeeper_application[name]", with: "My Application"
+        fill_in "doorkeeper_application[redirect_uri]",
+                with: ""
+
+        click_button "Submit"
+        i_should_see "Whoops! Check your form for possible errors"
+      end
+
+      scenario "adding app with blank redirect URI when configured flows without redirect uri" do
+        config_is_set("grant_flows", %w[client_credentials password])
+
+        # Visit it once again to consider grant flows
+        visit "/oauth/applications/new"
+
+        i_should_see I18n.t("doorkeeper.applications.help.blank_redirect_uri")
+
+        fill_in "doorkeeper_application[name]", with: "My Application"
+        fill_in "doorkeeper_application[redirect_uri]",
+                with: ""
+
+        click_button "Submit"
+        i_should_see "Application created"
+        i_should_see "My Application"
+      end
+    end
   end
 end
 
-feature 'Listing applications' do
+feature "Listing applications" do
   background do
     i_am_logged_in
 
-    FactoryBot.create :application, name: 'Oauth Dude'
-    FactoryBot.create :application, name: 'Awesome App'
+    FactoryBot.create :application, name: "Oauth Dude"
+    FactoryBot.create :application, name: "Awesome App"
   end
 
-  scenario 'application list' do
-    visit '/oauth/applications'
+  scenario "application list" do
+    visit "/oauth/applications"
 
-    i_should_see 'Awesome App'
-    i_should_see 'Oauth Dude'
+    i_should_see "Awesome App"
+    i_should_see "Oauth Dude"
   end
 end
 
-feature 'Renders assets' do
-  scenario 'admin stylesheets' do
-    visit '/assets/doorkeeper/admin/application.css'
+feature "Renders assets" do
+  scenario "admin stylesheets" do
+    visit "/assets/doorkeeper/admin/application.css"
 
-    i_should_see 'Bootstrap'
-    i_should_see '.doorkeeper-admin'
+    i_should_see "Bootstrap"
+    i_should_see ".doorkeeper-admin"
   end
 
-  scenario 'application stylesheets' do
-    visit '/assets/doorkeeper/application.css'
+  scenario "application stylesheets" do
+    visit "/assets/doorkeeper/application.css"
 
-    i_should_see 'Bootstrap'
-    i_should_see '#oauth-permissions'
-    i_should_see '#container'
+    i_should_see "Bootstrap"
+    i_should_see "#oauth-permissions"
+    i_should_see "#container"
   end
 end
 
-feature 'Show application' do
+feature "Show application" do
   given :app do
     i_am_logged_in
 
-    FactoryBot.create :application, name: 'Just another oauth app'
+    FactoryBot.create :application, name: "Just another oauth app"
   end
 
-  scenario 'visiting application page' do
+  scenario "visiting application page" do
     visit "/oauth/applications/#{app.id}"
 
-    i_should_see 'Just another oauth app'
+    i_should_see "Just another oauth app"
   end
 end
 
-feature 'Edit application' do
+feature "Edit application" do
   let :app do
-    FactoryBot.create :application, name: 'OMG my app'
+    FactoryBot.create :application, name: "OMG my app"
   end
 
   background do
@@ -153,72 +185,72 @@ feature 'Edit application' do
     visit "/oauth/applications/#{app.id}/edit"
   end
 
-  scenario 'updating a valid app' do
-    fill_in 'doorkeeper_application[name]', with: 'Serious app'
-    click_button 'Submit'
+  scenario "updating a valid app" do
+    fill_in "doorkeeper_application[name]", with: "Serious app"
+    click_button "Submit"
 
-    i_should_see 'Application updated'
-    i_should_see 'Serious app'
-    i_should_not_see 'OMG my app'
+    i_should_see "Application updated"
+    i_should_see "Serious app"
+    i_should_not_see "OMG my app"
   end
 
-  scenario 'updating an invalid app' do
-    fill_in 'doorkeeper_application[name]', with: ''
-    click_button 'Submit'
+  scenario "updating an invalid app" do
+    fill_in "doorkeeper_application[name]", with: ""
+    click_button "Submit"
 
-    i_should_see 'Whoops! Check your form for possible errors'
+    i_should_see "Whoops! Check your form for possible errors"
   end
 end
 
-feature 'Remove application' do
+feature "Remove application" do
   background do
     i_am_logged_in
 
     @app = FactoryBot.create :application
   end
 
-  scenario 'deleting an application from list' do
-    visit '/oauth/applications'
+  scenario "deleting an application from list" do
+    visit "/oauth/applications"
 
     i_should_see @app.name
 
     within(:css, "tr#application_#{@app.id}") do
-      click_button 'Destroy'
+      click_button "Destroy"
     end
 
-    i_should_see 'Application deleted'
+    i_should_see "Application deleted"
     i_should_not_see @app.name
   end
 
-  scenario 'deleting an application from show' do
+  scenario "deleting an application from show" do
     visit "/oauth/applications/#{@app.id}"
-    click_button 'Destroy'
+    click_button "Destroy"
 
-    i_should_see 'Application deleted'
+    i_should_see "Application deleted"
   end
 end
 
-context 'when admin authenticator block is default' do
-  let(:app) { FactoryBot.create :application, name: 'app' }
+context "when admin authenticator block is default" do
+  let(:app) { FactoryBot.create :application, name: "app" }
 
-  feature 'application list' do
-    scenario 'fails with forbidden' do
-      visit '/oauth/applications'
+  feature "application list" do
+    scenario "fails with forbidden" do
+      visit "/oauth/applications"
 
       should_have_status 403
     end
   end
 
-  feature 'adding an app' do
-    scenario 'fails with forbidden' do
-      visit '/oauth/applications/new'
+  feature "adding an app" do
+    scenario "fails with forbidden" do
+      visit "/oauth/applications/new"
 
       should_have_status 403
     end
   end
 
-  feature 'editing an app' do
-    scenario 'fails with forbidden' do
+  feature "editing an app" do
+    scenario "fails with forbidden" do
       visit "/oauth/applications/#{app.id}/edit"
 
       should_have_status 403

data/spec/requests/applications/authorized_applications_spec.rb

@@ -1,30 +1,32 @@
-require 'spec_helper'
+# frozen_string_literal: true
 
-feature 'Authorized applications' do
+require "spec_helper"
+
+feature "Authorized applications" do
   background do
-    @user   = User.create!(name: 'Joe', password: 'sekret')
-    @client = client_exists(name: 'Amazing Client App')
+    @user   = User.create!(name: "Joe", password: "sekret")
+    @client = client_exists(name: "Amazing Client App")
     resource_owner_is_authenticated @user
     client_is_authorized @client, @user
   end
 
-  scenario 'display user\'s authorized applications' do
-    visit '/oauth/authorized_applications'
-    i_should_see 'Amazing Client App'
+  scenario "display user's authorized applications" do
+    visit "/oauth/authorized_applications"
+    i_should_see "Amazing Client App"
   end
 
-  scenario 'do not display other user\'s authorized applications' do
-    client = client_exists(name: 'Another Client App')
-    client_is_authorized client, User.create!(name: 'Joe', password: 'sekret')
-    visit '/oauth/authorized_applications'
-    i_should_not_see 'Another Client App'
+  scenario "do not display other user's authorized applications" do
+    client = client_exists(name: "Another Client App")
+    client_is_authorized client, User.create!(name: "Joe", password: "sekret")
+    visit "/oauth/authorized_applications"
+    i_should_not_see "Another Client App"
   end
 
-  scenario 'user revoke access to application' do
-    visit '/oauth/authorized_applications'
-    i_should_see 'Amazing Client App'
-    click_on 'Revoke'
-    i_should_see 'Application revoked'
-    i_should_not_see 'Amazing Client App'
+  scenario "user revoke access to application" do
+    visit "/oauth/authorized_applications"
+    i_should_see "Amazing Client App"
+    click_on "Revoke"
+    i_should_see "Application revoked"
+    i_should_not_see "Amazing Client App"
   end
 end

data/spec/requests/endpoints/authorization_spec.rb

@@ -1,69 +1,71 @@
-require 'spec_helper'
+# frozen_string_literal: true
 
-feature 'Authorization endpoint' do
+require "spec_helper"
+
+feature "Authorization endpoint" do
   background do
-    config_is_set(:authenticate_resource_owner) { User.first || redirect_to('/sign_in') }
-    client_exists(name: 'MyApp')
+    config_is_set(:authenticate_resource_owner) { User.first || redirect_to("/sign_in") }
+    client_exists(name: "MyApp")
   end
 
-  scenario 'requires resource owner to be authenticated' do
+  scenario "requires resource owner to be authenticated" do
     visit authorization_endpoint_url(client: @client)
-    i_should_see 'Sign in'
-    i_should_be_on '/'
+    i_should_see "Sign in"
+    i_should_be_on "/"
   end
 
-  context 'with authenticated resource owner' do
+  context "with authenticated resource owner" do
     background do
       create_resource_owner
       sign_in
     end
 
-    scenario 'displays the authorization form' do
+    scenario "displays the authorization form" do
       visit authorization_endpoint_url(client: @client)
-      i_should_see 'Authorize MyApp to use your account?'
+      i_should_see "Authorize MyApp to use your account?"
     end
 
-    scenario 'displays all requested scopes' do
+    scenario "displays all requested scopes" do
       default_scopes_exist :public
       optional_scopes_exist :write
-      visit authorization_endpoint_url(client: @client, scope: 'public write')
-      i_should_see 'Access your public data'
-      i_should_see 'Update your data'
+      visit authorization_endpoint_url(client: @client, scope: "public write")
+      i_should_see "Access your public data"
+      i_should_see "Update your data"
     end
   end
 
-  context 'with a invalid request' do
+  context "with a invalid request" do
     background do
       create_resource_owner
       sign_in
     end
 
-    scenario 'displays the related error' do
-      visit authorization_endpoint_url(client: @client, response_type: '')
-      i_should_not_see 'Authorize'
+    scenario "displays the related error" do
+      visit authorization_endpoint_url(client: @client, response_type: "")
+      i_should_not_see "Authorize"
       i_should_see_translated_error_message :unsupported_response_type
     end
 
     scenario "displays unsupported_response_type error when using a disabled response type" do
-      config_is_set(:grant_flows, ['implicit'])
-      visit authorization_endpoint_url(client: @client, response_type: 'code')
+      config_is_set(:grant_flows, ["implicit"])
+      visit authorization_endpoint_url(client: @client, response_type: "code")
       i_should_not_see "Authorize"
       i_should_see_translated_error_message :unsupported_response_type
     end
   end
 
-  context 'forgery protection enabled' do
+  context "forgery protection enabled" do
     background do
       create_resource_owner
       sign_in
     end
 
-    scenario 'raises exception on forged requests' do
+    scenario "raises exception on forged requests" do
       allowing_forgery_protection do
         expect do
           page.driver.post authorization_endpoint_url(client_id: @client.uid,
                                                       redirect_uri: @client.redirect_uri,
-                                                      response_type:  'code')
+                                                      response_type: "code")
         end.to raise_error(ActionController::InvalidAuthenticityToken)
       end
     end

data/spec/requests/endpoints/token_spec.rb

@@ -1,73 +1,75 @@
-require 'spec_helper'
+# frozen_string_literal: true
 
-describe 'Token endpoint' do
+require "spec_helper"
+
+describe "Token endpoint" do
   before do
     client_exists
-    authorization_code_exists application: @client, scopes: 'public'
+    authorization_code_exists application: @client, scopes: "public"
   end
 
-  it 'respond with correct headers' do
+  it "respond with correct headers" do
     post token_endpoint_url(code: @authorization.token, client: @client)
-    should_have_header 'Pragma', 'no-cache'
+    should_have_header "Pragma", "no-cache"
 
     # Rails 5.2 changed headers
     if ::Rails::VERSION::MAJOR >= 5 && ::Rails::VERSION::MINOR >= 2 || ::Rails::VERSION::MAJOR >= 6
-      should_have_header 'Cache-Control', 'private, no-store'
+      should_have_header "Cache-Control", "private, no-store"
     else
-      should_have_header 'Cache-Control', 'no-store'
+      should_have_header "Cache-Control", "no-store"
     end
 
-    should_have_header 'Content-Type', 'application/json; charset=utf-8'
+    should_have_header "Content-Type", "application/json; charset=utf-8"
   end
 
-  it 'accepts client credentials with basic auth header' do
+  it "accepts client credentials with basic auth header" do
     post token_endpoint_url,
          params: {
            code: @authorization.token,
-           redirect_uri: @client.redirect_uri
+           redirect_uri: @client.redirect_uri,
          },
-         headers: { 'HTTP_AUTHORIZATION' => basic_auth_header_for_client(@client) }
+         headers: { "HTTP_AUTHORIZATION" => basic_auth_header_for_client(@client) }
 
-    should_have_json 'access_token', Doorkeeper::AccessToken.first.token
+    should_have_json "access_token", Doorkeeper::AccessToken.first.token
   end
 
-  it 'returns null for expires_in when a permanent token is set' do
+  it "returns null for expires_in when a permanent token is set" do
     config_is_set(:access_token_expires_in, nil)
     post token_endpoint_url(code: @authorization.token, client: @client)
-    should_have_json 'access_token', Doorkeeper::AccessToken.first.token
-    should_not_have_json 'expires_in'
+    should_have_json "access_token", Doorkeeper::AccessToken.first.token
+    should_not_have_json "expires_in"
   end
 
-  it 'returns unsupported_grant_type for invalid grant_type param' do
-    post token_endpoint_url(code: @authorization.token, client: @client, grant_type: 'nothing')
+  it "returns unsupported_grant_type for invalid grant_type param" do
+    post token_endpoint_url(code: @authorization.token, client: @client, grant_type: "nothing")
 
-    should_not_have_json 'access_token'
-    should_have_json 'error', 'unsupported_grant_type'
-    should_have_json 'error_description', translated_error_message('unsupported_grant_type')
+    should_not_have_json "access_token"
+    should_have_json "error", "unsupported_grant_type"
+    should_have_json "error_description", translated_error_message("unsupported_grant_type")
   end
 
-  it 'returns unsupported_grant_type for disabled grant flows' do
-    config_is_set(:grant_flows, ['implicit'])
-    post token_endpoint_url(code: @authorization.token, client: @client, grant_type: 'authorization_code')
+  it "returns unsupported_grant_type for disabled grant flows" do
+    config_is_set(:grant_flows, ["implicit"])
+    post token_endpoint_url(code: @authorization.token, client: @client, grant_type: "authorization_code")
 
-    should_not_have_json 'access_token'
-    should_have_json 'error', 'unsupported_grant_type'
-    should_have_json 'error_description', translated_error_message('unsupported_grant_type')
+    should_not_have_json "access_token"
+    should_have_json "error", "unsupported_grant_type"
+    should_have_json "error_description", translated_error_message("unsupported_grant_type")
   end
 
-  it 'returns unsupported_grant_type when refresh_token is not in use' do
-    post token_endpoint_url(code: @authorization.token, client: @client, grant_type: 'refresh_token')
+  it "returns unsupported_grant_type when refresh_token is not in use" do
+    post token_endpoint_url(code: @authorization.token, client: @client, grant_type: "refresh_token")
 
-    should_not_have_json 'access_token'
-    should_have_json 'error', 'unsupported_grant_type'
-    should_have_json 'error_description', translated_error_message('unsupported_grant_type')
+    should_not_have_json "access_token"
+    should_have_json "error", "unsupported_grant_type"
+    should_have_json "error_description", translated_error_message("unsupported_grant_type")
   end
 
-  it 'returns invalid_request if grant_type is missing' do
-    post token_endpoint_url(code: @authorization.token, client: @client, grant_type: '')
+  it "returns invalid_request if grant_type is missing" do
+    post token_endpoint_url(code: @authorization.token, client: @client, grant_type: "")
 
-    should_not_have_json 'access_token'
-    should_have_json 'error', 'invalid_request'
-    should_have_json 'error_description', translated_error_message('invalid_request')
+    should_not_have_json "access_token"
+    should_have_json "error", "invalid_request"
+    should_have_json "error_description", translated_error_message("invalid_request")
   end
 end

data/spec/requests/flows/authorization_code_errors_spec.rb

@@ -1,9 +1,11 @@
-require 'spec_helper'
+# frozen_string_literal: true
 
-feature 'Authorization Code Flow Errors' do
+require "spec_helper"
+
+feature "Authorization Code Flow Errors" do
   let(:client_params) { {} }
   background do
-    config_is_set(:authenticate_resource_owner) { User.first || redirect_to('/sign_in') }
+    config_is_set(:authenticate_resource_owner) { User.first || redirect_to("/sign_in") }
     client_exists client_params
     create_resource_owner
     sign_in
@@ -22,35 +24,35 @@ feature 'Authorization Code Flow Errors' do
     end
   end
 
-  context 'when access was denied' do
-    scenario 'redirects with error' do
+  context "when access was denied" do
+    scenario "redirects with error" do
       visit authorization_endpoint_url(client: @client)
-      click_on 'Deny'
+      click_on "Deny"
 
       i_should_be_on_client_callback @client
-      url_should_not_have_param 'code'
-      url_should_have_param 'error', 'access_denied'
-      url_should_have_param 'error_description', translated_error_message(:access_denied)
+      url_should_not_have_param "code"
+      url_should_have_param "error", "access_denied"
+      url_should_have_param "error_description", translated_error_message(:access_denied)
     end
 
-    scenario 'redirects with state parameter' do
-      visit authorization_endpoint_url(client: @client, state: 'return-this')
-      click_on 'Deny'
+    scenario "redirects with state parameter" do
+      visit authorization_endpoint_url(client: @client, state: "return-this")
+      click_on "Deny"
 
       i_should_be_on_client_callback @client
-      url_should_not_have_param 'code'
-      url_should_have_param 'state', 'return-this'
+      url_should_not_have_param "code"
+      url_should_have_param "state", "return-this"
     end
   end
 end
 
-describe 'Authorization Code Flow Errors', 'after authorization' do
+describe "Authorization Code Flow Errors", "after authorization" do
   before do
     client_exists
     authorization_code_exists application: @client
   end
 
-  it 'returns :invalid_grant error when posting an already revoked grant code' do
+  it "returns :invalid_grant error when posting an already revoked grant code" do
     # First successful request
     post token_endpoint_url(code: @authorization.token, client: @client)
 
@@ -59,18 +61,18 @@ describe 'Authorization Code Flow Errors', 'after authorization' do
       post token_endpoint_url(code: @authorization.token, client: @client)
     end.to_not(change { Doorkeeper::AccessToken.count })
 
-    should_not_have_json 'access_token'
-    should_have_json 'error', 'invalid_grant'
-    should_have_json 'error_description', translated_error_message('invalid_grant')
+    should_not_have_json "access_token"
+    should_have_json "error", "invalid_grant"
+    should_have_json "error_description", translated_error_message("invalid_grant")
   end
 
-  it 'returns :invalid_grant error for invalid grant code' do
-    post token_endpoint_url(code: 'invalid', client: @client)
+  it "returns :invalid_grant error for invalid grant code" do
+    post token_endpoint_url(code: "invalid", client: @client)
 
     access_token_should_not_exist
 
-    should_not_have_json 'access_token'
-    should_have_json 'error', 'invalid_grant'
-    should_have_json 'error_description', translated_error_message('invalid_grant')
+    should_not_have_json "access_token"
+    should_have_json "error", "invalid_grant"
+    should_have_json "error_description", translated_error_message("invalid_grant")
   end
 end