doorkeeper 5.1.0 → 5.3.0

data/spec/lib/models/revocable_spec.rb

@@ -40,15 +40,15 @@ describe "Revocable" do
       `previous_refresh_token` attribute" do
       previous_token = FactoryBot.create(
         :access_token,
-        refresh_token: "refresh_token"
+        refresh_token: "refresh_token",
       )
       current_token = FactoryBot.create(
         :access_token,
-        previous_refresh_token: previous_token.refresh_token
+        previous_refresh_token: previous_token.refresh_token,
       )
 
       expect_any_instance_of(
-        Doorkeeper::AccessToken
+        Doorkeeper::AccessToken,
       ).to receive(:revoke).and_call_original
       current_token.revoke_previous_refresh_token!
 

data/spec/lib/oauth/authorization_code_request_spec.rb

@@ -2,155 +2,169 @@
 
 require "spec_helper"
 
-module Doorkeeper::OAuth
-  describe AuthorizationCodeRequest do
-    let(:server) do
-      double :server,
-             access_token_expires_in: 2.days,
-             refresh_token_enabled?: false,
-             custom_access_token_expires_in: lambda { |context|
-               context.grant_type == Doorkeeper::OAuth::AUTHORIZATION_CODE ? 1234 : nil
-             }
-    end
+describe Doorkeeper::OAuth::AuthorizationCodeRequest do
+  let(:server) do
+    double :server,
+           access_token_expires_in: 2.days,
+           refresh_token_enabled?: false,
+           custom_access_token_expires_in: lambda { |context|
+             context.grant_type == Doorkeeper::OAuth::AUTHORIZATION_CODE ? 1234 : nil
+           }
+  end
 
-    let(:grant)  { FactoryBot.create :access_grant }
-    let(:client) { grant.application }
-    let(:redirect_uri) { client.redirect_uri }
-    let(:params) { { redirect_uri: redirect_uri } }
+  let(:grant)  { FactoryBot.create :access_grant }
+  let(:client) { grant.application }
+  let(:redirect_uri) { client.redirect_uri }
+  let(:params) { { redirect_uri: redirect_uri } }
 
-    before do
-      allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
-    end
+  before do
+    allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
+  end
 
-    subject do
-      AuthorizationCodeRequest.new server, grant, client, params
-    end
+  subject do
+    described_class.new(server, grant, client, params)
+  end
 
-    it "issues a new token for the client" do
-      expect do
-        subject.authorize
-      end.to change { client.reload.access_tokens.count }.by(1)
+  it "issues a new token for the client" do
+    expect do
+      subject.authorize
+    end.to change { client.reload.access_tokens.count }.by(1)
 
-      expect(client.reload.access_tokens.max_by(&:created_at).expires_in).to eq(1234)
-    end
+    expect(client.reload.access_tokens.max_by(&:created_at).expires_in).to eq(1234)
+  end
 
-    it "issues the token with same grant's scopes" do
-      subject.authorize
-      expect(Doorkeeper::AccessToken.last.scopes).to eq(grant.scopes)
-    end
+  it "issues the token with same grant's scopes" do
+    subject.authorize
+    expect(Doorkeeper::AccessToken.last.scopes).to eq(grant.scopes)
+  end
 
-    it "revokes the grant" do
-      expect { subject.authorize }.to(change { grant.reload.accessible? })
-    end
+  it "revokes the grant" do
+    expect { subject.authorize }.to(change { grant.reload.accessible? })
+  end
 
-    it "requires the grant to be accessible" do
-      grant.revoke
-      subject.validate
-      expect(subject.error).to eq(:invalid_grant)
-    end
+  it "requires the grant to be accessible" do
+    grant.revoke
+    subject.validate
+    expect(subject.error).to eq(:invalid_grant)
+  end
 
-    it "requires the grant" do
-      subject.grant = nil
-      subject.validate
-      expect(subject.error).to eq(:invalid_grant)
-    end
+  it "requires the grant" do
+    subject.grant = nil
+    subject.validate
+    expect(subject.error).to eq(:invalid_grant)
+  end
 
-    it "requires the client" do
-      subject.client = nil
-      subject.validate
-      expect(subject.error).to eq(:invalid_client)
-    end
+  it "requires the client" do
+    subject.client = nil
+    subject.validate
+    expect(subject.error).to eq(:invalid_client)
+  end
 
-    it "requires the redirect_uri" do
-      subject.redirect_uri = nil
-      subject.validate
-      expect(subject.error).to eq(:invalid_request)
-    end
+  it "requires the redirect_uri" do
+    subject.redirect_uri = nil
+    subject.validate
+    expect(subject.error).to eq(:invalid_request)
+    expect(subject.missing_param).to eq(:redirect_uri)
+  end
 
-    it "matches the redirect_uri with grant's one" do
-      subject.redirect_uri = "http://other.com"
-      subject.validate
-      expect(subject.error).to eq(:invalid_grant)
-    end
+  it "invalid code_verifier param because server does not support pkce" do
+    # Some other ORMs work relies on #respond_to? so it's not a good idea to stub it :\
+    allow_any_instance_of(Doorkeeper::AccessGrant).to receive(:respond_to?).with(anything).and_call_original
+    allow_any_instance_of(Doorkeeper::AccessGrant).to receive(:respond_to?).with(:code_challenge).and_return(false)
 
-    it "matches the client with grant's one" do
-      subject.client = FactoryBot.create :application
-      subject.validate
-      expect(subject.error).to eq(:invalid_grant)
-    end
+    subject.code_verifier = "a45a9fea-0676-477e-95b1-a40f72ac3cfb"
+    subject.validate
+    expect(subject.error).to eq(:invalid_request)
+    expect(subject.invalid_request_reason).to eq(:not_support_pkce)
+  end
 
-    it "skips token creation if there is a matching one reusable" do
-      scopes = grant.scopes
+  it "matches the redirect_uri with grant's one" do
+    subject.redirect_uri = "http://other.com"
+    subject.validate
+    expect(subject.error).to eq(:invalid_grant)
+  end
 
-      Doorkeeper.configure do
-        orm DOORKEEPER_ORM
-        reuse_access_token
-        default_scopes(*scopes)
-      end
+  it "matches the client with grant's one" do
+    subject.client = FactoryBot.create :application
+    subject.validate
+    expect(subject.error).to eq(:invalid_grant)
+  end
 
-      FactoryBot.create(:access_token, application_id: client.id,
-                                       resource_owner_id: grant.resource_owner_id, scopes: grant.scopes.to_s)
+  it "skips token creation if there is a matching one reusable" do
+    scopes = grant.scopes
 
-      expect { subject.authorize }.to_not(change { Doorkeeper::AccessToken.count })
+    Doorkeeper.configure do
+      orm DOORKEEPER_ORM
+      reuse_access_token
+      default_scopes(*scopes)
     end
 
-    it "creates token if there is a matching one but non reusable" do
-      scopes = grant.scopes
+    FactoryBot.create(
+      :access_token, application_id: client.id,
+                     resource_owner_id: grant.resource_owner_id, scopes: grant.scopes.to_s,
+    )
 
-      Doorkeeper.configure do
-        orm DOORKEEPER_ORM
-        reuse_access_token
-        default_scopes(*scopes)
-      end
-
-      FactoryBot.create(:access_token, application_id: client.id,
-                                       resource_owner_id: grant.resource_owner_id, scopes: grant.scopes.to_s)
+    expect { subject.authorize }.to_not(change { Doorkeeper::AccessToken.count })
+  end
 
-      allow_any_instance_of(Doorkeeper::AccessToken).to receive(:reusable?).and_return(false)
+  it "creates token if there is a matching one but non reusable" do
+    scopes = grant.scopes
 
-      expect { subject.authorize }.to change { Doorkeeper::AccessToken.count }.by(1)
+    Doorkeeper.configure do
+      orm DOORKEEPER_ORM
+      reuse_access_token
+      default_scopes(*scopes)
     end
 
-    it "calls configured request callback methods" do
-      expect(Doorkeeper.configuration.before_successful_strategy_response)
-        .to receive(:call).with(subject).once
-      expect(Doorkeeper.configuration.after_successful_strategy_response)
-        .to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
+    FactoryBot.create(
+      :access_token, application_id: client.id,
+                     resource_owner_id: grant.resource_owner_id, scopes: grant.scopes.to_s,
+    )
 
-      subject.authorize
-    end
+    allow_any_instance_of(Doorkeeper::AccessToken).to receive(:reusable?).and_return(false)
 
-    context "when redirect_uri contains some query params" do
-      let(:redirect_uri) { client.redirect_uri + "?query=q" }
+    expect { subject.authorize }.to change { Doorkeeper::AccessToken.count }.by(1)
+  end
 
-      it "compares only host part with grant's redirect_uri" do
-        subject.validate
-        expect(subject.error).to eq(nil)
-      end
+  it "calls configured request callback methods" do
+    expect(Doorkeeper.configuration.before_successful_strategy_response)
+      .to receive(:call).with(subject).once
+    expect(Doorkeeper.configuration.after_successful_strategy_response)
+      .to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
+
+    subject.authorize
+  end
+
+  context "when redirect_uri contains some query params" do
+    let(:redirect_uri) { client.redirect_uri + "?query=q" }
+
+    it "compares only host part with grant's redirect_uri" do
+      subject.validate
+      expect(subject.error).to eq(nil)
     end
+  end
 
-    context "when redirect_uri is not an URI" do
-      let(:redirect_uri) { "123d#!s" }
+  context "when redirect_uri is not an URI" do
+    let(:redirect_uri) { "123d#!s" }
 
-      it "responds with invalid_grant" do
-        subject.validate
-        expect(subject.error).to eq(:invalid_grant)
-      end
+    it "responds with invalid_grant" do
+      subject.validate
+      expect(subject.error).to eq(:invalid_grant)
     end
+  end
 
-    context "when redirect_uri is the native one" do
-      let(:redirect_uri) { "urn:ietf:wg:oauth:2.0:oob" }
+  context "when redirect_uri is the native one" do
+    let(:redirect_uri) { "urn:ietf:wg:oauth:2.0:oob" }
 
-      it "invalidates when redirect_uri of the grant is not native" do
-        subject.validate
-        expect(subject.error).to eq(:invalid_grant)
-      end
+    it "invalidates when redirect_uri of the grant is not native" do
+      subject.validate
+      expect(subject.error).to eq(:invalid_grant)
+    end
 
-      it "validates when redirect_uri of the grant is also native" do
-        allow(grant).to receive(:redirect_uri) { redirect_uri }
-        subject.validate
-        expect(subject.error).to eq(nil)
-      end
+    it "validates when redirect_uri of the grant is also native" do
+      allow(grant).to receive(:redirect_uri) { redirect_uri }
+      subject.validate
+      expect(subject.error).to eq(nil)
     end
   end
 end

data/spec/lib/oauth/base_request_spec.rb

@@ -2,203 +2,222 @@
 
 require "spec_helper"
 
-module Doorkeeper::OAuth
-  describe BaseRequest do
-    let(:access_token) do
-      double :access_token,
-             plaintext_token: "some-token",
-             expires_in: "3600",
-             expires_in_seconds: "300",
-             scopes_string: "two scopes",
-             plaintext_refresh_token: "some-refresh-token",
-             token_type: "bearer",
-             created_at: 0
-    end
+describe Doorkeeper::OAuth::BaseRequest do
+  let(:access_token) do
+    double :access_token,
+           plaintext_token: "some-token",
+           expires_in: "3600",
+           expires_in_seconds: "300",
+           scopes_string: "two scopes",
+           plaintext_refresh_token: "some-refresh-token",
+           token_type: "bearer",
+           created_at: 0
+  end
 
-    let(:client) { double :client, id: "1" }
+  let(:client) { double :client, id: "1" }
 
-    let(:scopes_array) { %w[public write] }
+  let(:scopes_array) { %w[public write] }
 
-    let(:server) do
-      double :server,
-             access_token_expires_in: 100,
-             custom_access_token_expires_in: ->(_context) { nil },
-             refresh_token_enabled?: false
-    end
+  let(:server) do
+    double :server,
+           access_token_expires_in: 100,
+           custom_access_token_expires_in: ->(_context) { nil },
+           refresh_token_enabled?: false
+  end
+
+  before do
+    allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
+  end
+
+  subject do
+    described_class.new
+  end
 
+  describe "#authorize" do
     before do
-      allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
+      allow(subject).to receive(:access_token).and_return(access_token)
     end
 
-    subject do
-      BaseRequest.new
+    it "validates itself" do
+      expect(subject).to receive(:validate).once
+      subject.authorize
     end
 
-    describe "#authorize" do
+    context "valid" do
       before do
-        allow(subject).to receive(:access_token).and_return(access_token)
+        allow(subject).to receive(:valid?).and_return(true)
       end
 
-      it "validates itself" do
-        expect(subject).to receive(:validate).once
+      it "calls callback methods" do
+        expect(subject).to receive(:before_successful_response).once
+        expect(subject).to receive(:after_successful_response).once
         subject.authorize
       end
 
-      context "valid" do
-        before do
-          allow(subject).to receive(:valid?).and_return(true)
-        end
+      it "returns a TokenResponse object" do
+        result = subject.authorize
 
-        it "calls callback methods" do
-          expect(subject).to receive(:before_successful_response).once
-          expect(subject).to receive(:after_successful_response).once
-          subject.authorize
+        expect(result).to be_an_instance_of(Doorkeeper::OAuth::TokenResponse)
+        expect(result.body).to eq(
+          Doorkeeper::OAuth::TokenResponse.new(access_token).body,
+        )
+      end
+    end
+
+    context "invalid" do
+      context "with error other than invalid_request" do
+        before do
+          allow(subject).to receive(:valid?).and_return(false)
+          allow(subject).to receive(:error).and_return(:server_error)
+          allow(subject).to receive(:state).and_return("hello")
         end
 
-        it "returns a TokenResponse object" do
+        it "returns an ErrorResponse object" do
           result = subject.authorize
 
-          expect(result).to be_an_instance_of(TokenResponse)
+          expect(result).to be_an_instance_of(Doorkeeper::OAuth::ErrorResponse)
+
           expect(result.body).to eq(
-            TokenResponse.new(access_token).body
+            error: :server_error,
+            error_description: translated_error_message(:server_error),
+            state: "hello",
           )
         end
       end
 
-      context "invalid" do
+      context "with invalid_request error" do
         before do
           allow(subject).to receive(:valid?).and_return(false)
-          allow(subject).to receive(:error).and_return("server_error")
+          allow(subject).to receive(:error).and_return(:invalid_request)
           allow(subject).to receive(:state).and_return("hello")
         end
 
-        it "returns an ErrorResponse object" do
-          error_description = I18n.translate(
-            "server_error",
-            scope: %i[doorkeeper errors messages]
-          )
-
+        it "returns an InvalidRequestResponse object" do
           result = subject.authorize
 
-          expect(result).to be_an_instance_of(ErrorResponse)
+          expect(result).to be_an_instance_of(Doorkeeper::OAuth::InvalidRequestResponse)
 
           expect(result.body).to eq(
-            error: "server_error",
-            error_description: error_description,
-            state: "hello"
+            error: :invalid_request,
+            error_description: translated_invalid_request_error_message(:unknown, :unknown),
+            state: "hello",
           )
         end
       end
     end
+  end
 
-    describe "#default_scopes" do
-      it "delegates to the server" do
-        expect(subject).to receive(:server).and_return(server).once
-        expect(server).to receive(:default_scopes).once
+  describe "#default_scopes" do
+    it "delegates to the server" do
+      expect(subject).to receive(:server).and_return(server).once
+      expect(server).to receive(:default_scopes).once
 
-        subject.default_scopes
-      end
+      subject.default_scopes
     end
+  end
 
-    describe "#find_or_create_access_token" do
-      it "returns an instance of AccessToken" do
-        result = subject.find_or_create_access_token(
-          client,
-          "1",
-          "public",
-          server
-        )
+  describe "#find_or_create_access_token" do
+    it "returns an instance of AccessToken" do
+      result = subject.find_or_create_access_token(
+        client,
+        "1",
+        "public",
+        server,
+      )
 
-        expect(result).to be_an_instance_of(Doorkeeper::AccessToken)
-      end
+      expect(result).to be_an_instance_of(Doorkeeper::AccessToken)
+    end
 
-      it "respects custom_access_token_expires_in" do
-        server = double(:server,
-                        access_token_expires_in: 100,
-                        custom_access_token_expires_in: ->(context) { context.scopes == "public" ? 500 : nil },
-                        refresh_token_enabled?: false)
+    it "respects custom_access_token_expires_in" do
+      server = double(
+        :server,
+        access_token_expires_in: 100,
+        custom_access_token_expires_in: ->(context) { context.scopes == "public" ? 500 : nil },
+        refresh_token_enabled?: false,
+      )
 
-        allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
+      allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
 
-        result = subject.find_or_create_access_token(
-          client,
-          "1",
-          "public",
-          server
-        )
-        expect(result.expires_in).to eql(500)
-      end
+      result = subject.find_or_create_access_token(
+        client,
+        "1",
+        "public",
+        server,
+      )
+      expect(result.expires_in).to eql(500)
+    end
 
-      it "respects use_refresh_token with a block" do
-        server = double(:server,
-                        access_token_expires_in: 100,
-                        custom_access_token_expires_in: ->(_context) { nil },
-                        refresh_token_enabled?: lambda { |context|
-                          context.scopes == "public"
-                        })
-
-        allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
-
-        result = subject.find_or_create_access_token(
-          client,
-          "1",
-          "public",
-          server
-        )
-        expect(result.refresh_token).to_not be_nil
+    it "respects use_refresh_token with a block" do
+      server = double(
+        :server,
+        access_token_expires_in: 100,
+        custom_access_token_expires_in: ->(_context) { nil },
+        refresh_token_enabled?: lambda { |context|
+          context.scopes == "public"
+        },
+      )
 
-        result = subject.find_or_create_access_token(
-          client,
-          "1",
-          "private",
-          server
-        )
-        expect(result.refresh_token).to be_nil
-      end
+      allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
+
+      result = subject.find_or_create_access_token(
+        client,
+        "1",
+        "public",
+        server,
+      )
+      expect(result.refresh_token).to_not be_nil
+
+      result = subject.find_or_create_access_token(
+        client,
+        "1",
+        "private",
+        server,
+      )
+      expect(result.refresh_token).to be_nil
     end
+  end
 
-    describe "#scopes" do
-      context "@original_scopes is present" do
-        before do
-          subject.instance_variable_set(:@original_scopes, "public write")
-        end
+  describe "#scopes" do
+    context "@original_scopes is present" do
+      before do
+        subject.instance_variable_set(:@original_scopes, "public write")
+      end
 
-        it "returns array of @original_scopes" do
-          result = subject.scopes
+      it "returns array of @original_scopes" do
+        result = subject.scopes
 
-          expect(result).to eq(scopes_array)
-        end
+        expect(result).to eq(scopes_array)
       end
+    end
 
-      context "@original_scopes is not present" do
-        before do
-          subject.instance_variable_set(:@original_scopes, "")
-        end
+    context "@original_scopes is not present" do
+      before do
+        subject.instance_variable_set(:@original_scopes, "")
+      end
 
-        it "calls #default_scopes" do
-          allow(subject).to receive(:server).and_return(server).once
-          allow(server).to receive(:default_scopes).and_return(scopes_array).once
+      it "calls #default_scopes" do
+        allow(subject).to receive(:server).and_return(server).once
+        allow(server).to receive(:default_scopes).and_return(scopes_array).once
 
-          result = subject.scopes
+        result = subject.scopes
 
-          expect(result).to eq(scopes_array)
-        end
+        expect(result).to eq(scopes_array)
       end
     end
+  end
 
-    describe "#valid?" do
-      context "error is nil" do
-        it "returns true" do
-          allow(subject).to receive(:error).and_return(nil).once
-          expect(subject.valid?).to eq(true)
-        end
+  describe "#valid?" do
+    context "error is nil" do
+      it "returns true" do
+        allow(subject).to receive(:error).and_return(nil).once
+        expect(subject.valid?).to eq(true)
       end
+    end
 
-      context "error is not nil" do
-        it "returns false" do
-          allow(subject).to receive(:error).and_return(Object.new).once
-          expect(subject.valid?).to eq(false)
-        end
+    context "error is not nil" do
+      it "returns false" do
+        allow(subject).to receive(:error).and_return(Object.new).once
+        expect(subject.valid?).to eq(false)
       end
     end
   end