doorkeeper 5.1.0 → 5.3.0

data/spec/controllers/authorizations_controller_spec.rb

@@ -14,23 +14,23 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
     end
   end
 
-  def translated_error_message(key)
-    I18n.translate key, scope: %i[doorkeeper errors messages]
-  end
-
   let(:client)        { FactoryBot.create :application }
   let(:user)          { User.create!(name: "Joe", password: "sekret") }
-  let(:access_token)  { FactoryBot.build :access_token, resource_owner_id: user.id, application_id: client.id }
+  let(:access_token)  { FactoryBot.build :access_token, resource_owner_id: user.id, application_id: client.id, scopes: "default" }
 
   before do
     Doorkeeper.configure do
+      default_scopes :default
+
       custom_access_token_expires_in(lambda do |context|
         context.grant_type == Doorkeeper::OAuth::IMPLICIT ? 1234 : nil
       end)
     end
 
-    allow(Doorkeeper.configuration).to receive(:grant_flows).and_return(["implicit"])
-    allow(controller).to receive(:current_resource_owner).and_return(user)
+    allow(Doorkeeper.config).to receive(:grant_flows).and_return(["implicit"])
+    allow(Doorkeeper.config).to receive(:authenticate_resource_owner).and_return(->(_) { authenticator_method })
+    allow(controller).to receive(:authenticator_method).and_return(user)
+    expect(controller).to receive(:authenticator_method).at_most(:once)
   end
 
   describe "POST #create" do
@@ -69,7 +69,7 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
 
   describe "POST #create in API mode" do
     before do
-      allow(Doorkeeper.configuration).to receive(:api_only).and_return(true)
+      allow(Doorkeeper.config).to receive(:api_only).and_return(true)
       post :create, params: { client_id: client.uid, response_type: "token", redirect_uri: client.redirect_uri }
     end
 
@@ -106,86 +106,152 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
   end
 
   describe "POST #create with errors" do
-    before do
-      default_scopes_exist :public
+    context "when missing client_id" do
+      before do
+        post :create, params: {
+          client_id: "",
+          response_type: "token",
+          redirect_uri: client.redirect_uri,
+        }
+      end
 
-      post :create, params: {
-        client_id: client.uid,
-        response_type: "token",
-        scope: "invalid",
-        redirect_uri: client.redirect_uri,
-      }
-    end
+      let(:response_json_body) { JSON.parse(response.body) }
 
-    it "redirects after authorization" do
-      expect(response).to be_redirect
-    end
+      it "renders 400 error" do
+        expect(response.status).to eq 400
+      end
 
-    it "redirects to client redirect uri" do
-      expect(response.location).to match(/^#{client.redirect_uri}/)
-    end
+      it "includes error name" do
+        expect(response_json_body["error"]).to eq("invalid_request")
+      end
 
-    it "does not include access token in fragment" do
-      expect(response.query_params["access_token"]).to be_nil
-    end
+      it "includes error description" do
+        expect(response_json_body["error_description"]).to eq(
+          translated_invalid_request_error_message(:missing_param, :client_id),
+        )
+      end
 
-    it "includes error in fragment" do
-      expect(response.query_params["error"]).to eq("invalid_scope")
+      it "does not issue any access token" do
+        expect(Doorkeeper::AccessToken.all).to be_empty
+      end
     end
 
-    it "includes error description in fragment" do
-      expect(response.query_params["error_description"]).to eq(translated_error_message(:invalid_scope))
-    end
+    context "when other error happens" do
+      before do
+        default_scopes_exist :public
+
+        post :create, params: {
+          client_id: client.uid,
+          response_type: "token",
+          scope: "invalid",
+          redirect_uri: client.redirect_uri,
+        }
+      end
+
+      it "redirects after authorization" do
+        expect(response).to be_redirect
+      end
+
+      it "redirects to client redirect uri" do
+        expect(response.location).to match(/^#{client.redirect_uri}/)
+      end
 
-    it "does not issue any access token" do
-      expect(Doorkeeper::AccessToken.all).to be_empty
+      it "does not include access token in fragment" do
+        expect(response.query_params["access_token"]).to be_nil
+      end
+
+      it "includes error in fragment" do
+        expect(response.query_params["error"]).to eq("invalid_scope")
+      end
+
+      it "includes error description in fragment" do
+        expect(response.query_params["error_description"]).to eq(translated_error_message(:invalid_scope))
+      end
+
+      it "does not issue any access token" do
+        expect(Doorkeeper::AccessToken.all).to be_empty
+      end
     end
   end
 
   describe "POST #create in API mode with errors" do
-    before do
-      allow(Doorkeeper.configuration).to receive(:api_only).and_return(true)
-      default_scopes_exist :public
+    context "when missing client_id" do
+      before do
+        allow(Doorkeeper.config).to receive(:api_only).and_return(true)
 
-      post :create, params: {
-        client_id: client.uid,
-        response_type: "token",
-        scope: "invalid",
-        redirect_uri: client.redirect_uri,
-      }
-    end
+        post :create, params: {
+          client_id: "",
+          response_type: "token",
+          redirect_uri: client.redirect_uri,
+        }
+      end
 
-    let(:response_json_body) { JSON.parse(response.body) }
-    let(:redirect_uri) { response_json_body["redirect_uri"] }
+      let(:response_json_body) { JSON.parse(response.body) }
 
-    it "renders 400 error" do
-      expect(response.status).to eq 400
-    end
+      it "renders 400 error" do
+        expect(response.status).to eq 400
+      end
 
-    it "includes correct redirect URI" do
-      expect(redirect_uri).to match(/^#{client.redirect_uri}/)
-    end
+      it "includes error name" do
+        expect(response_json_body["error"]).to eq("invalid_request")
+      end
 
-    it "does not include access token in fragment" do
-      expect(redirect_uri.match(/access_token=([a-f0-9]+)&?/)).to be_nil
-    end
+      it "includes error description" do
+        expect(response_json_body["error_description"]).to eq(
+          translated_invalid_request_error_message(:missing_param, :client_id),
+        )
+      end
 
-    it "includes error in redirect uri" do
-      expect(redirect_uri.match(/error=([a-z_]+)&?/)[1]).to eq "invalid_scope"
+      it "does not issue any access token" do
+        expect(Doorkeeper::AccessToken.all).to be_empty
+      end
     end
 
-    it "includes error description in redirect uri" do
-      expect(redirect_uri.match(/error_description=(.+)&?/)[1]).to_not be_nil
-    end
+    context "when other error happens" do
+      before do
+        allow(Doorkeeper.config).to receive(:api_only).and_return(true)
+        default_scopes_exist :public
+
+        post :create, params: {
+          client_id: client.uid,
+          response_type: "token",
+          scope: "invalid",
+          redirect_uri: client.redirect_uri,
+        }
+      end
 
-    it "does not issue any access token" do
-      expect(Doorkeeper::AccessToken.all).to be_empty
+      let(:response_json_body) { JSON.parse(response.body) }
+      let(:redirect_uri) { response_json_body["redirect_uri"] }
+
+      it "renders 400 error" do
+        expect(response.status).to eq 400
+      end
+
+      it "includes correct redirect URI" do
+        expect(redirect_uri).to match(/^#{client.redirect_uri}/)
+      end
+
+      it "does not include access token in fragment" do
+        expect(redirect_uri.match(/access_token=([a-f0-9]+)&?/)).to be_nil
+      end
+
+      it "includes error in redirect uri" do
+        expect(redirect_uri.match(/error=([a-z_]+)&?/)[1]).to eq "invalid_scope"
+      end
+
+      it "includes error description in redirect uri" do
+        expect(redirect_uri.match(/error_description=(.+)&?/)[1]).to_not be_nil
+      end
+
+      it "does not issue any access token" do
+        expect(Doorkeeper::AccessToken.all).to be_empty
+      end
     end
   end
 
   describe "POST #create with application already authorized" do
     before do
-      allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
+      allow(Doorkeeper.config).to receive(:reuse_access_token).and_return(true)
 
       access_token.save!
 
@@ -220,12 +286,12 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
       end
 
       it "should call :before_successful_authorization callback" do
-        expect(Doorkeeper.configuration)
+        expect(Doorkeeper.config)
           .to receive_message_chain(:before_successful_authorization, :call).with(instance_of(described_class))
       end
 
       it "should call :after_successful_authorization callback" do
-        expect(Doorkeeper.configuration)
+        expect(Doorkeeper.config)
           .to receive_message_chain(:after_successful_authorization, :call).with(instance_of(described_class))
       end
     end
@@ -236,18 +302,18 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
       end
 
       it "should not call :before_successful_authorization callback" do
-        expect(Doorkeeper.configuration).not_to receive(:before_successful_authorization)
+        expect(Doorkeeper.config).not_to receive(:before_successful_authorization)
       end
 
       it "should not call :after_successful_authorization callback" do
-        expect(Doorkeeper.configuration).not_to receive(:after_successful_authorization)
+        expect(Doorkeeper.config).not_to receive(:after_successful_authorization)
       end
     end
   end
 
   describe "GET #new token request with native url and skip_authorization true" do
     before do
-      allow(Doorkeeper.configuration).to receive(:skip_authorization).and_return(proc do
+      allow(Doorkeeper.config).to receive(:skip_authorization).and_return(proc do
         true
       end)
 
@@ -276,8 +342,8 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
 
   describe "GET #new code request with native url and skip_authorization true" do
     before do
-      allow(Doorkeeper.configuration).to receive(:grant_flows).and_return(%w[authorization_code])
-      allow(Doorkeeper.configuration).to receive(:skip_authorization).and_return(proc do
+      allow(Doorkeeper.config).to receive(:grant_flows).and_return(%w[authorization_code])
+      allow(Doorkeeper.config).to receive(:skip_authorization).and_return(proc do
         true
       end)
 
@@ -307,7 +373,7 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
 
   describe "GET #new with skip_authorization true" do
     before do
-      allow(Doorkeeper.configuration).to receive(:skip_authorization).and_return(proc do
+      allow(Doorkeeper.config).to receive(:skip_authorization).and_return(proc do
         true
       end)
 
@@ -346,7 +412,7 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
 
   describe "GET #new in API mode" do
     before do
-      allow(Doorkeeper.configuration).to receive(:api_only).and_return(true)
+      allow(Doorkeeper.config).to receive(:api_only).and_return(true)
 
       get :new, params: {
         client_id: client.uid,
@@ -368,7 +434,7 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
       expect(json_response["redirect_uri"]).to eq(client.redirect_uri)
       expect(json_response["state"]).to be_nil
       expect(json_response["response_type"]).to eq("token")
-      expect(json_response["scope"]).to eq("")
+      expect(json_response["scope"]).to eq("default")
     end
   end
 
@@ -402,7 +468,7 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
       expect(redirect_uri.match(/token_type=(\w+)&?/)[1]).to eq "Bearer"
       expect(redirect_uri.match(/expires_in=(\d+)&?/)[1].to_i).to eq 1234
       expect(
-        redirect_uri.match(/access_token=([a-zA-Z0-9\-_]+)&?/)[1]
+        redirect_uri.match(/access_token=([a-zA-Z0-9\-_]+)&?/)[1],
       ).to eq Doorkeeper::AccessToken.first.token
     end
 
@@ -445,12 +511,12 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
     end
 
     it "includes error in body" do
-      expect(response_json_body["error"]).to eq("unsupported_response_type")
+      expect(response_json_body["error"]).to eq("invalid_request")
     end
 
     it "includes error description in body" do
       expect(response_json_body["error_description"])
-        .to eq(translated_error_message(:unsupported_response_type))
+        .to eq(translated_invalid_request_error_message(:missing_param, :client_id))
     end
 
     it "does not issue any token" do
@@ -513,6 +579,8 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
 
   describe "authorize response memoization" do
     it "memoizes the result of the authorization" do
+      pre_auth = double(:pre_auth, authorizable?: true)
+      allow(controller).to receive(:pre_auth) { pre_auth }
       strategy = double(:strategy, authorize: true)
       expect(strategy).to receive(:authorize).once
       allow(controller).to receive(:strategy) { strategy }
@@ -524,4 +592,17 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
       post :create
     end
   end
+
+  describe "strong parameters" do
+    it "ignores non-scalar scope parameter" do
+      get :new, params: {
+        client_id: client.uid,
+        response_type: "token",
+        redirect_uri: client.redirect_uri,
+        scope: { "0" => "profile" },
+      }
+
+      expect(response).to be_successful
+    end
+  end
 end

data/spec/controllers/protected_resources_controller_spec.rb

@@ -28,9 +28,11 @@ describe "doorkeeper authorize filter" do
 
     let(:token_string) { "1A2BC3" }
     let(:token) do
-      double(Doorkeeper::AccessToken,
-             acceptable?: true, previous_refresh_token: "",
-             revoke_previous_refresh_token!: true)
+      double(
+        Doorkeeper::AccessToken,
+        acceptable?: true, previous_refresh_token: "",
+        revoke_previous_refresh_token!: true,
+      )
     end
 
     it "access_token param" do
@@ -108,13 +110,15 @@ describe "doorkeeper authorize filter" do
     let(:token_string) { "1A2DUWE" }
 
     it "allows if the token has particular scopes" do
-      token = double(Doorkeeper::AccessToken,
-                     accessible?: true, scopes: %w[write public],
-                     previous_refresh_token: "",
-                     revoke_previous_refresh_token!: true)
+      token = double(
+        Doorkeeper::AccessToken,
+        accessible?: true, scopes: %w[write public],
+        previous_refresh_token: "",
+        revoke_previous_refresh_token!: true,
+      )
       expect(token).to receive(:acceptable?).with([:write]).and_return(true)
       expect(
-        Doorkeeper::AccessToken
+        Doorkeeper::AccessToken,
       ).to receive(:by_token).with(token_string).and_return(token)
 
       get :index, params: { access_token: token_string }
@@ -122,12 +126,14 @@ describe "doorkeeper authorize filter" do
     end
 
     it "does not allow if the token does not include given scope" do
-      token = double(Doorkeeper::AccessToken,
-                     accessible?: true, scopes: ["public"], revoked?: false,
-                     expired?: false, previous_refresh_token: "",
-                     revoke_previous_refresh_token!: true)
+      token = double(
+        Doorkeeper::AccessToken,
+        accessible?: true, scopes: ["public"], revoked?: false,
+        expired?: false, previous_refresh_token: "",
+        revoke_previous_refresh_token!: true,
+      )
       expect(
-        Doorkeeper::AccessToken
+        Doorkeeper::AccessToken,
       ).to receive(:by_token).with(token_string).and_return(token)
       expect(token).to receive(:acceptable?).with([:write]).and_return(false)
 
@@ -166,7 +172,7 @@ describe "doorkeeper authorize filter" do
       it "it renders a custom JSON response", token: :invalid do
         get :index, params: { access_token: token_string }
         expect(response.status).to eq 401
-        expect(response.content_type).to eq("application/json")
+        expect(response.content_type).to include("application/json")
         expect(response.header["WWW-Authenticate"]).to match(/^Bearer/)
 
         expect(json_response).not_to be_nil
@@ -196,7 +202,7 @@ describe "doorkeeper authorize filter" do
       it "it renders a custom text response", token: :invalid do
         get :index, params: { access_token: token_string }
         expect(response.status).to eq 401
-        expect(response.content_type).to eq("text/plain")
+        expect(response.content_type).to include("text/plain")
         expect(response.header["WWW-Authenticate"]).to match(/^Bearer/)
         expect(response.body).to eq("Unauthorized")
       end
@@ -224,10 +230,12 @@ describe "doorkeeper authorize filter" do
     end
 
     let(:token) do
-      double(Doorkeeper::AccessToken,
-             accessible?: true, scopes: ["public"], revoked?: false,
-             expired?: false, previous_refresh_token: "",
-             revoke_previous_refresh_token!: true)
+      double(
+        Doorkeeper::AccessToken,
+        accessible?: true, scopes: ["public"], revoked?: false,
+        expired?: false, previous_refresh_token: "",
+        revoke_previous_refresh_token!: true,
+      )
     end
 
     let(:token_string) { "1A2DUWE" }
@@ -246,7 +254,7 @@ describe "doorkeeper authorize filter" do
       it "renders a custom JSON response" do
         get :index, params: { access_token: token_string }
         expect(response.header).to_not include("WWW-Authenticate")
-        expect(response.content_type).to eq("application/json")
+        expect(response.content_type).to include("application/json")
         expect(response.status).to eq 403
 
         expect(json_response).not_to be_nil

data/spec/controllers/token_info_controller_spec.rb

@@ -42,7 +42,7 @@ describe Doorkeeper::TokenInfoController do
         get :show
 
         expect(response.body).to eq(
-          Doorkeeper::OAuth::InvalidTokenResponse.new.body.to_json
+          Doorkeeper::OAuth::InvalidTokenResponse.new.body.to_json,
         )
       end
     end