doorkeeper 5.1.0 → 5.3.0

data/spec/controllers/tokens_controller_spec.rb

@@ -3,38 +3,146 @@
 require "spec_helper"
 
 describe Doorkeeper::TokensController do
-  describe "when authorization has succeeded" do
-    let(:token) { double(:token, authorize: true) }
+  let(:client) { FactoryBot.create :application }
+  let!(:user)  { User.create!(name: "Joe", password: "sekret") }
 
-    it "returns the authorization" do
-      skip "verify need of these specs"
+  before do
+    Doorkeeper.configure do
+      resource_owner_from_credentials do
+        User.first
+      end
+    end
 
-      expect(token).to receive(:authorization)
+    allow(Doorkeeper.configuration).to receive(:grant_flows).and_return(["password"])
+  end
 
-      post :create
+  subject { JSON.parse(response.body) }
+
+  describe "POST #create" do
+    before do
+      post :create, params: {
+        client_id: client.uid,
+        client_secret: client.secret,
+        grant_type: "password",
+      }
+    end
+
+    it "responds after authorization" do
+      expect(response).to be_successful
+    end
+
+    it "includes access token in response" do
+      expect(subject["access_token"]).to eq(Doorkeeper::AccessToken.first.token)
+    end
+
+    it "includes token type in response" do
+      expect(subject["token_type"]).to eq("Bearer")
+    end
+
+    it "includes token expiration in response" do
+      expect(subject["expires_in"].to_i).to eq(Doorkeeper.configuration.access_token_expires_in)
+    end
+
+    it "issues the token for the current client" do
+      expect(Doorkeeper::AccessToken.first.application_id).to eq(client.id)
+    end
+
+    it "issues the token for the current resource owner" do
+      expect(Doorkeeper::AccessToken.first.resource_owner_id).to eq(user.id)
     end
   end
 
-  describe "when authorization has failed" do
-    it "returns the error response" do
-      token = double(:token, authorize: false)
-      allow(controller).to receive(:token) { token }
+  describe "POST #create with errors" do
+    before do
+      post :create, params: {
+        client_id: client.uid,
+        client_secret: "invalid",
+        grant_type: "password",
+      }
+    end
 
-      post :create
+    it "responds after authorization" do
+      expect(response).to be_unauthorized
+    end
 
-      expect(response.status).to eq 400
-      expect(response.headers["WWW-Authenticate"]).to match(/Bearer/)
+    it "include error in response" do
+      expect(subject["error"]).to eq("invalid_client")
+    end
+
+    it "include error_description in response" do
+      expect(subject["error_description"]).to be
+    end
+
+    it "does not include access token in response" do
+      expect(subject["access_token"]).to be_nil
+    end
+
+    it "does not include token type in response" do
+      expect(subject["token_type"]).to be_nil
+    end
+
+    it "does not include token expiration in response" do
+      expect(subject["expires_in"]).to be_nil
+    end
+
+    it "does not issue any access token" do
+      expect(Doorkeeper::AccessToken.all).to be_empty
+    end
+  end
+
+  describe "POST #create with callbacks" do
+    after do
+      client.update_attribute :redirect_uri, "urn:ietf:wg:oauth:2.0:oob"
+    end
+
+    describe "when successful" do
+      after do
+        post :create, params: {
+          client_id: client.uid,
+          client_secret: client.secret,
+          grant_type: "password",
+        }
+      end
+
+      it "should call :before_successful_authorization callback" do
+        expect(Doorkeeper.configuration)
+          .to receive_message_chain(:before_successful_authorization, :call).with(instance_of(described_class))
+      end
+
+      it "should call :after_successful_authorization callback" do
+        expect(Doorkeeper.configuration)
+          .to receive_message_chain(:after_successful_authorization, :call).with(instance_of(described_class))
+      end
+    end
+
+    describe "with errors" do
+      after do
+        post :create, params: {
+          client_id: client.uid,
+          client_secret: "invalid",
+          grant_type: "password",
+        }
+      end
+
+      it "should call :before_successful_authorization callback" do
+        expect(Doorkeeper.configuration)
+          .to receive_message_chain(:before_successful_authorization, :call).with(instance_of(described_class))
+      end
+
+      it "should not call :after_successful_authorization callback" do
+        expect(Doorkeeper.configuration).not_to receive(:after_successful_authorization)
+      end
     end
   end
 
-  describe "when there is a failure due to a custom error" do
+  describe "POST #create with custom error" do
     it "returns the error response with a custom message" do
       # I18n looks for `doorkeeper.errors.messages.custom_message` in locale files
       custom_message = "my_message"
       allow(I18n).to receive(:translate)
         .with(
           custom_message,
-          hash_including(scope: %i[doorkeeper errors messages])
+          hash_including(scope: %i[doorkeeper errors messages]),
         )
         .and_return("Authorization custom message")
 
@@ -58,7 +166,7 @@ describe Doorkeeper::TokensController do
   end
 
   # http://tools.ietf.org/html/rfc7009#section-2.2
-  describe "revoking tokens" do
+  describe "POST #revoke" do
     let(:client) { FactoryBot.create(:application) }
     let(:access_token) { FactoryBot.create(:access_token, application: client) }
 
@@ -102,10 +210,10 @@ describe Doorkeeper::TokensController do
         let(:some_other_client) { FactoryBot.create(:application, confidential: true) }
         let(:oauth_client) { Doorkeeper::OAuth::Client.new(some_other_client) }
 
-        it "returns 200" do
+        it "returns 403" do
           post :revoke, params: { token: access_token.token }
 
-          expect(response.status).to eq 200
+          expect(response.status).to eq 403
         end
 
         it "does not revoke the access token" do
@@ -117,21 +225,7 @@ describe Doorkeeper::TokensController do
     end
   end
 
-  describe "authorize response memoization" do
-    it "memoizes the result of the authorization" do
-      strategy = double(:strategy, authorize: true)
-      expect(strategy).to receive(:authorize).once
-      allow(controller).to receive(:strategy) { strategy }
-      allow(controller).to receive(:create) do
-        2.times { controller.send :authorize_response }
-        controller.render json: {}, status: :ok
-      end
-
-      post :create
-    end
-  end
-
-  describe "when requested token introspection" do
+  describe "POST #introspect" do
     let(:client) { FactoryBot.create(:application) }
     let(:access_token) { FactoryBot.create(:access_token, application: client) }
     let(:token_for_introspection) { FactoryBot.create(:access_token, application: client) }
@@ -147,7 +241,7 @@ describe Doorkeeper::TokensController do
       end
     end
 
-    context "authorized using valid Client Authentication" do
+    context "authorized using Client Credentials of the client that token is issued to" do
       it "responds with full token introspection" do
         request.headers["Authorization"] = basic_auth_header_for_client(client)
 
@@ -159,6 +253,26 @@ describe Doorkeeper::TokensController do
       end
     end
 
+    context "configured token introspection disabled" do
+      before do
+        Doorkeeper.configure do
+          orm DOORKEEPER_ORM
+          allow_token_introspection false
+        end
+      end
+
+      it "responds with invalid_token error" do
+        request.headers["Authorization"] = "Bearer #{access_token.token}"
+
+        post :introspect, params: { token: token_for_introspection.token }
+
+        response_status_should_be 401
+
+        should_not_have_json "active"
+        should_have_json "error", "invalid_token"
+      end
+    end
+
     context "using custom introspection response" do
       before do
         Doorkeeper.configure do
@@ -212,12 +326,64 @@ describe Doorkeeper::TokensController do
       end
     end
 
+    context "introspection request authorized by a client and allow_token_introspection is true" do
+      let(:different_client) { FactoryBot.create(:application) }
+
+      before do
+        allow(Doorkeeper.configuration).to receive(:allow_token_introspection).and_return(proc do
+          true
+        end)
+      end
+
+      it "responds with full token introspection" do
+        request.headers["Authorization"] = basic_auth_header_for_client(different_client)
+
+        post :introspect, params: { token: token_for_introspection.token }
+
+        should_have_json "active", true
+        expect(json_response).to include("client_id", "token_type", "exp", "iat")
+        should_have_json "client_id", client.uid
+      end
+    end
+
+    context "allow_token_introspection requires authorized token with special scope" do
+      let(:access_token) { FactoryBot.create(:access_token, scopes: "introspection") }
+
+      before do
+        allow(Doorkeeper.configuration).to receive(:allow_token_introspection).and_return(proc do |_token, _client, authorized_token|
+          authorized_token.scopes.include?("introspection")
+        end)
+      end
+
+      it "responds with full token introspection if authorized token has introspection scope" do
+        request.headers["Authorization"] = "Bearer #{access_token.token}"
+
+        post :introspect, params: { token: token_for_introspection.token }
+
+        should_have_json "active", true
+        expect(json_response).to include("client_id", "token_type", "exp", "iat")
+      end
+
+      it "responds with invalid_token error if authorized token doesn't have introspection scope" do
+        access_token.update(scopes: "read write")
+
+        request.headers["Authorization"] = "Bearer #{access_token.token}"
+
+        post :introspect, params: { token: token_for_introspection.token }
+
+        response_status_should_be 401
+
+        should_not_have_json "active"
+        should_have_json "error", "invalid_token"
+      end
+    end
+
     context "authorized using invalid Bearer token" do
       let(:access_token) do
         FactoryBot.create(:access_token, application: client, revoked_at: 1.day.ago)
       end
 
-      it "responds with invalid token error" do
+      it "responds with invalid_token error" do
         request.headers["Authorization"] = "Bearer #{access_token.token}"
 
         post :introspect, params: { token: token_for_introspection.token }
@@ -272,13 +438,15 @@ describe Doorkeeper::TokensController do
       end
 
       context "authorized using valid Bearer token" do
-        it "responds with only active state" do
+        it "responds with invalid_token error" do
           request.headers["Authorization"] = "Bearer #{access_token.token}"
 
           post :introspect, params: { token: SecureRandom.hex(16) }
 
-          should_have_json "active", false
-          expect(json_response).not_to include("client_id", "token_type", "exp", "iat")
+          response_status_should_be 401
+
+          should_not_have_json "active"
+          should_have_json "error", "invalid_token"
         end
       end
     end

data/spec/dummy/config/application.rb

@@ -5,11 +5,13 @@ require "rails"
 %w[
   action_controller/railtie
   action_view/railtie
+  action_cable/engine
   sprockets/railtie
 ].each do |railtie|
   begin
     require railtie
-  rescue LoadError
+  rescue LoadError => e
+    puts "Error loading '#{railtie}' (#{e.message})"
   end
 end
 

data/spec/dummy/config/initializers/doorkeeper.rb

@@ -65,15 +65,6 @@ Doorkeeper.configure do
   # Check out the wiki for more information on customization
   # access_token_methods :from_bearer_authorization, :from_access_token_param, :from_bearer_param
 
-  # Change the native redirect uri for client apps
-  # When clients register with the following redirect uri, they won't be redirected to any server and
-  # the authorization code will be displayed within the provider
-  # The value can be any string. Use nil to disable this feature.
-  # When disabled, clients must provide a valid URL
-  # (Similar behaviour: https://developers.google.com/accounts/docs/OAuth2InstalledApp#choosingredirecturi)
-  #
-  # native_redirect_uri 'urn:ietf:wg:oauth:2.0:oob'
-
   # Forces the usage of the HTTPS protocol in non-native redirect uris (enabled
   # by default in non-development environments). OAuth2 delegates security in
   # communication to the HTTPS protocol so it is wise to keep this enabled.
@@ -116,6 +107,60 @@ Doorkeeper.configure do
   #   client.superapp? or resource_owner.admin?
   # end
 
+  # Configure custom constraints for the Token Introspection request.
+  # By default this configuration option allows to introspect a token by another
+  # token of the same application, OR to introspect the token that belongs to
+  # authorized client (from authenticated client) OR when token doesn't
+  # belong to any client (public token). Otherwise requester has no access to the
+  # introspection and it will return response as stated in the RFC.
+  #
+  # Block arguments:
+  #
+  # @param token [Doorkeeper::AccessToken]
+  #   token to be introspected
+  #
+  # @param authorized_client [Doorkeeper::Application]
+  #   authorized client (if request is authorized using Basic auth with
+  #   Client Credentials for example)
+  #
+  # @param authorized_token [Doorkeeper::AccessToken]
+  #   Bearer token used to authorize the request
+  #
+  # In case the block returns `nil` or `false` introspection responses with 401 status code
+  # when using authorized token to introspect, or you'll get 200 with { "active": false } body
+  # when using authorized client to introspect as stated in the
+  # RFC 7662 section 2.2. Introspection Response.
+  #
+  # Using with caution:
+  # Keep in mind that these three parameters pass to block can be nil as following case:
+  #  `authorized_client` is nil if and only if `authorized_token` is present, and vice versa.
+  #  `token` will be nil if and only if `authorized_token` is present.
+  # So remember to use `&` or check if it is present before calling method on
+  # them to make sure you doesn't get NoMethodError exception.
+  #
+  # You can define your custom check:
+  #
+  # allow_token_introspection do |token, authorized_client, authorized_token|
+  #   if authorized_token
+  #     # customize: require `introspection` scope
+  #     authorized_token.application == token&.application ||
+  #       authorized_token.scopes.include?("introspection")
+  #   elsif token.application
+  #     # `protected_resource` is a new database boolean column, for example
+  #     authorized_client == token.application || authorized_client.protected_resource?
+  #   else
+  #     # public token (when token.application is nil, token doesn't belong to any application)
+  #     true
+  #   end
+  # end
+  #
+  # Or you can completely disable any token introspection:
+  #
+  # allow_token_introspection false
+  #
+  # If you need to block the request at all, then configure your routes.rb or web-server
+  # like nginx to forbid the request.
+
   # WWW-Authenticate Realm (default "Doorkeeper").
   realm "Doorkeeper"
 end

data/spec/dummy/db/migrate/20151223192035_create_doorkeeper_tables.rb

@@ -25,14 +25,14 @@ class CreateDoorkeeperTables < ActiveRecord::Migration[4.2]
       t.text     :redirect_uri,      null: false
       t.datetime :created_at,        null: false
       t.datetime :revoked_at
-      t.string   :scopes
+      t.string   :scopes, null: false, default: ""
     end
 
     add_index :oauth_access_grants, :token, unique: true
     add_foreign_key(
       :oauth_access_grants,
       :oauth_applications,
-      column: :application_id
+      column: :application_id,
     )
 
     create_table :oauth_access_tokens do |t|
@@ -59,7 +59,7 @@ class CreateDoorkeeperTables < ActiveRecord::Migration[4.2]
     add_foreign_key(
       :oauth_access_tokens,
       :oauth_applications,
-      column: :application_id
+      column: :application_id,
     )
 
     # Uncomment below to ensure a valid reference to the resource owner's table

data/spec/dummy/db/migrate/20160320211015_add_previous_refresh_token_to_access_tokens.rb

@@ -7,7 +7,7 @@ class AddPreviousRefreshTokenToAccessTokens < ActiveRecord::Migration[4.2]
       :previous_refresh_token,
       :string,
       default: "",
-      null: false
+      null: false,
     )
   end
 end

data/spec/dummy/db/migrate/20180210183654_add_confidential_to_applications.rb

@@ -7,7 +7,7 @@ class AddConfidentialToApplications < ActiveRecord::Migration[5.1]
       :confidential,
       :boolean,
       null: false,
-      default: true # maintaining backwards compatibility: require secrets
+      default: true, # maintaining backwards compatibility: require secrets
     )
   end
 end

data/spec/generators/install_generator_spec.rb

@@ -16,7 +16,7 @@ describe "Doorkeeper::InstallGenerator" do
       FileUtils.mkdir(::File.expand_path("db", Pathname(destination_root)))
       FileUtils.copy_file(
         ::File.expand_path("../templates/routes.rb", __FILE__),
-        ::File.expand_path("config/routes.rb", Pathname.new(destination_root))
+        ::File.expand_path("config/routes.rb", Pathname.new(destination_root)),
       )
       run_generator
     end

data/spec/generators/previous_refresh_token_generator_spec.rb

@@ -14,7 +14,7 @@ describe "Doorkeeper::PreviousRefreshTokenGenerator" do
       prepare_destination
 
       allow_any_instance_of(Doorkeeper::PreviousRefreshTokenGenerator).to(
-        receive(:no_previous_refresh_token_column?).and_return(true)
+        receive(:no_previous_refresh_token_column?).and_return(true),
       )
     end
 
@@ -32,7 +32,7 @@ describe "Doorkeeper::PreviousRefreshTokenGenerator" do
     context "already exist" do
       it "does not create a migration" do
         allow_any_instance_of(Doorkeeper::PreviousRefreshTokenGenerator).to(
-          receive(:no_previous_refresh_token_column?).and_call_original
+          receive(:no_previous_refresh_token_column?).and_call_original,
         )
 
         run_generator

data/spec/helpers/doorkeeper/dashboard_helper_spec.rb

@@ -11,7 +11,7 @@ describe Doorkeeper::DashboardHelper do
       it "returns error messages" do
         messages.each do |message|
           expect(helper.doorkeeper_errors_for(object, :method)).to include(
-            message.capitalize
+            message.capitalize,
           )
         end
       end

data/spec/lib/config_spec.rb

@@ -22,7 +22,7 @@ describe Doorkeeper, "configuration" do
       end
 
       expect(Rails.logger).to receive(:warn).with(
-        I18n.t("doorkeeper.errors.messages.resource_owner_authenticator_not_configured")
+        I18n.t("doorkeeper.errors.messages.resource_owner_authenticator_not_configured"),
       )
       subject.authenticate_resource_owner.call(nil)
     end
@@ -45,7 +45,7 @@ describe Doorkeeper, "configuration" do
       end
 
       expect(Rails.logger).to receive(:warn).with(
-        I18n.t("doorkeeper.errors.messages.credential_flow_not_configured")
+        I18n.t("doorkeeper.errors.messages.credential_flow_not_configured"),
       )
       subject.resource_owner_from_credentials.call(nil)
     end
@@ -471,7 +471,7 @@ describe Doorkeeper, "configuration" do
   describe "access_token_generator" do
     it "is 'Doorkeeper::OAuth::Helpers::UniqueToken' by default" do
       expect(Doorkeeper.configuration.access_token_generator).to(
-        eq("Doorkeeper::OAuth::Helpers::UniqueToken")
+        eq("Doorkeeper::OAuth::Helpers::UniqueToken"),
       )
     end
 
@@ -502,7 +502,21 @@ describe Doorkeeper, "configuration" do
 
   describe "base_controller" do
     context "default" do
-      it { expect(Doorkeeper.configuration.base_controller).to eq("ActionController::Base") }
+      it { expect(Doorkeeper.configuration.base_controller).to be_an_instance_of(Proc) }
+
+      it "resolves to a ApplicationController::Base in default mode" do
+        expect(Doorkeeper.configuration.resolve_controller(:base))
+          .to eq(ActionController::Base)
+      end
+
+      it "resolves to a ApplicationController::API in api_only mode" do
+        Doorkeeper.configure do
+          api_only
+        end
+
+        expect(Doorkeeper.configuration.resolve_controller(:base))
+          .to eq(ActionController::API)
+      end
     end
 
     context "custom" do
@@ -517,7 +531,26 @@ describe Doorkeeper, "configuration" do
     end
   end
 
+  describe "base_metal_controller" do
+    context "default" do
+      it { expect(Doorkeeper.configuration.base_metal_controller).to eq("ActionController::API") }
+    end
+
+    context "custom" do
+      before do
+        Doorkeeper.configure do
+          orm DOORKEEPER_ORM
+          base_metal_controller { "ApplicationController" }
+        end
+      end
+
+      it { expect(Doorkeeper.configuration.resolve_controller(:base_metal)).to eq(ApplicationController) }
+    end
+  end
+
   if DOORKEEPER_ORM == :active_record
+    class FakeCustomModel; end
+
     describe "active_record_options" do
       let(:models) { [Doorkeeper::AccessGrant, Doorkeeper::AccessToken, Doorkeeper::Application] }
 
@@ -535,11 +568,62 @@ describe Doorkeeper, "configuration" do
         Doorkeeper.configure do
           orm DOORKEEPER_ORM
           active_record_options(
-            establish_connection: Rails.configuration.database_configuration[Rails.env]
+            establish_connection: Rails.configuration.database_configuration[Rails.env],
           )
         end
       end
     end
+
+    describe "access_token_class" do
+      it "uses default doorkeeper value" do
+        expect(subject.access_token_class).to eq("Doorkeeper::AccessToken")
+        expect(subject.access_token_model).to be(Doorkeeper::AccessToken)
+      end
+
+      it "can change the value" do
+        Doorkeeper.configure do
+          orm DOORKEEPER_ORM
+          access_token_class "FakeCustomModel"
+        end
+
+        expect(subject.access_token_class).to eq("FakeCustomModel")
+        expect(subject.access_token_model).to be(FakeCustomModel)
+      end
+    end
+
+    describe "access_grant_class" do
+      it "uses default doorkeeper value" do
+        expect(subject.access_grant_class).to eq("Doorkeeper::AccessGrant")
+        expect(subject.access_grant_model).to be(Doorkeeper::AccessGrant)
+      end
+
+      it "can change the value" do
+        Doorkeeper.configure do
+          orm DOORKEEPER_ORM
+          access_grant_class "FakeCustomModel"
+        end
+
+        expect(subject.access_grant_class).to eq("FakeCustomModel")
+        expect(subject.access_grant_model).to be(FakeCustomModel)
+      end
+    end
+
+    describe "application_class" do
+      it "uses default doorkeeper value" do
+        expect(subject.application_class).to eq("Doorkeeper::Application")
+        expect(subject.application_model).to be(Doorkeeper::Application)
+      end
+
+      it "can change the value" do
+        Doorkeeper.configure do
+          orm DOORKEEPER_ORM
+          application_class "FakeCustomModel"
+        end
+
+        expect(subject.application_class).to eq("FakeCustomModel")
+        expect(subject.application_model).to be(FakeCustomModel)
+      end
+    end
   end
 
   describe "api_only" do
@@ -620,8 +704,10 @@ describe Doorkeeper, "configuration" do
           Doorkeeper.configure do
             hash_token_secrets using: "Doorkeeper::SecretStoring::BCrypt"
           end
-        end.to raise_error(ArgumentError,
-                           /can only be used for storing application secrets/)
+        end.to raise_error(
+          ArgumentError,
+          /can only be used for storing application secrets/,
+        )
       end
     end
 
@@ -694,4 +780,15 @@ describe Doorkeeper, "configuration" do
       end
     end
   end
+
+  describe "options deprecation" do
+    it "prints a warning message when an option is deprecated" do
+      expect(Kernel).to receive(:warn).with(
+        "[DOORKEEPER] native_redirect_uri has been deprecated and will soon be removed",
+      )
+      Doorkeeper.configure do
+        native_redirect_uri "urn:ietf:wg:oauth:2.0:oob"
+      end
+    end
+  end
 end

data/spec/lib/doorkeeper_spec.rb

@@ -7,7 +7,7 @@ describe Doorkeeper do
     let(:request) { double }
 
     it "calls OAuth::Token#authenticate" do
-      token_strategies = Doorkeeper.configuration.access_token_methods
+      token_strategies = Doorkeeper.config.access_token_methods
 
       expect(Doorkeeper::OAuth::Token).to receive(:authenticate)
         .with(request, *token_strategies)