doorkeeper 5.1.0 → 5.3.0

data/spec/lib/oauth/base_response_spec.rb

@@ -2,46 +2,44 @@
 
 require "spec_helper"
 
-module Doorkeeper::OAuth
-  describe BaseResponse do
-    subject do
-      BaseResponse.new
-    end
+describe Doorkeeper::OAuth::BaseResponse do
+  subject do
+    Doorkeeper::OAuth::BaseResponse.new
+  end
 
-    describe "#body" do
-      it "returns an empty Hash" do
-        expect(subject.body).to eq({})
-      end
+  describe "#body" do
+    it "returns an empty Hash" do
+      expect(subject.body).to eq({})
     end
+  end
 
-    describe "#description" do
-      it "returns an empty String" do
-        expect(subject.description).to eq("")
-      end
+  describe "#description" do
+    it "returns an empty String" do
+      expect(subject.description).to eq("")
     end
+  end
 
-    describe "#headers" do
-      it "returns an empty Hash" do
-        expect(subject.headers).to eq({})
-      end
+  describe "#headers" do
+    it "returns an empty Hash" do
+      expect(subject.headers).to eq({})
     end
+  end
 
-    describe "#redirectable?" do
-      it "returns false" do
-        expect(subject.redirectable?).to eq(false)
-      end
+  describe "#redirectable?" do
+    it "returns false" do
+      expect(subject.redirectable?).to eq(false)
     end
+  end
 
-    describe "#redirect_uri" do
-      it "returns an empty String" do
-        expect(subject.redirect_uri).to eq("")
-      end
+  describe "#redirect_uri" do
+    it "returns an empty String" do
+      expect(subject.redirect_uri).to eq("")
     end
+  end
 
-    describe "#status" do
-      it "returns :ok" do
-        expect(subject.status).to eq(:ok)
-      end
+  describe "#status" do
+    it "returns :ok" do
+      expect(subject.status).to eq(:ok)
     end
   end
 end

data/spec/lib/oauth/client/credentials_spec.rb

@@ -14,7 +14,7 @@ class Doorkeeper::OAuth::Client
       expect(Credentials.new("something", "something")).to be_present
     end
 
-    describe :from_request do
+    describe ".from_request" do
       let(:request) { double.as_null_object }
 
       let(:method) do

data/spec/lib/oauth/client_credentials/creator_spec.rb

@@ -31,17 +31,31 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
       end
 
       context "when existing token has not crossed token_reuse_limit" do
-        it "returns the existing valid token" do
+        let!(:existing_token) { subject.call(client, scopes, expires_in: 1000) }
+
+        before do
           allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
           allow(Doorkeeper.configuration).to receive(:token_reuse_limit).and_return(50)
-          existing_token = subject.call(client, scopes, expires_in: 1000)
-
           allow_any_instance_of(Doorkeeper::AccessToken).to receive(:expires_in_seconds).and_return(600)
+        end
+
+        it "returns the existing valid token" do
           result = subject.call(client, scopes, expires_in: 1000)
 
           expect(Doorkeeper::AccessToken.count).to eq(1)
           expect(result).to eq(existing_token)
         end
+
+        context "and when revoke_previous_client_credentials_token is true" do
+          before do
+            allow(Doorkeeper.configuration).to receive(:revoke_previous_client_credentials_token).and_return(false)
+          end
+
+          it "does not revoke the existing valid token" do
+            subject.call(client, scopes, expires_in: 1000)
+            expect(existing_token.reload).not_to be_revoked
+          end
+        end
       end
 
       context "when existing token has crossed token_reuse_limit" do
@@ -85,6 +99,32 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
       end
     end
 
+    context "when revoke_previous_client_credentials_token is true" do
+      let!(:existing_token) { subject.call(client, scopes, expires_in: 1000) }
+
+      before do
+        allow(Doorkeeper.configuration).to receive(:revoke_previous_client_credentials_token).and_return(true)
+      end
+
+      it "revokes the existing token" do
+        subject.call(client, scopes, expires_in: 1000)
+        expect(existing_token.reload).to be_revoked
+      end
+    end
+
+    context "when revoke_previous_client_credentials_token is false" do
+      let!(:existing_token) { subject.call(client, scopes, expires_in: 1000) }
+
+      before do
+        allow(Doorkeeper.configuration).to receive(:revoke_previous_client_credentials_token).and_return(false)
+      end
+
+      it "does not revoke the existing token" do
+        subject.call(client, scopes, expires_in: 1000)
+        expect(existing_token.reload).not_to be_revoked
+      end
+    end
+
     it "returns false if creation fails" do
       expect(Doorkeeper::AccessToken).to receive(:find_or_create_for).and_return(false)
       created = subject.call(client, scopes)

data/spec/lib/oauth/client_credentials/issuer_spec.rb

@@ -8,16 +8,16 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
     let(:server) do
       double(
         :server,
-        access_token_expires_in: 100
+        access_token_expires_in: 100,
       )
     end
-    let(:validation) { double :validation, valid?: true }
+    let(:validator) { double :validator, valid?: true }
 
     before do
       allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(false)
     end
 
-    subject { Issuer.new(server, validation) }
+    subject { Issuer.new(server, validator) }
 
     describe :create do
       let(:client) { double :client, id: "some-id" }
@@ -35,7 +35,7 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
           client,
           scopes,
           expires_in: 100,
-          use_refresh_token: false
+          use_refresh_token: false,
         )
 
         subject.create client, scopes, creator
@@ -48,14 +48,14 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
         expect(subject.error).to eq(:server_error)
       end
 
-      context "when validation fails" do
+      context "when validator fails" do
         before do
-          allow(validation).to receive(:valid?).and_return(false)
-          allow(validation).to receive(:error).and_return(:validation_error)
+          allow(validator).to receive(:valid?).and_return(false)
+          allow(validator).to receive(:error).and_return(:validation_error)
           expect(creator).not_to receive(:create)
         end
 
-        it "has error set from validation" do
+        it "has error set from validator" do
           subject.create client, scopes, creator
           expect(subject.error).to eq(:validation_error)
         end
@@ -65,7 +65,7 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
         end
       end
 
-      context "with custom expirations" do
+      context "with custom expiration" do
         let(:custom_ttl_grant) { 1234 }
         let(:custom_ttl_scope) { 1235 }
         let(:custom_scope) { "special" }
@@ -79,7 +79,7 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
               elsif context.grant_type == Doorkeeper::OAuth::CLIENT_CREDENTIALS
                 custom_ttl_grant
               end
-            }
+            },
           )
         end
 
@@ -92,7 +92,7 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
             client,
             scopes,
             expires_in: custom_ttl_grant,
-            use_refresh_token: false
+            use_refresh_token: false,
           )
           subject.create client, scopes, creator
         end
@@ -102,7 +102,7 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
             client,
             custom_scope,
             expires_in: custom_ttl_scope,
-            use_refresh_token: false
+            use_refresh_token: false,
           )
           subject.create client, custom_scope, creator
         end

data/spec/lib/oauth/client_credentials/validation_spec.rb

@@ -3,13 +3,13 @@
 require "spec_helper"
 
 class Doorkeeper::OAuth::ClientCredentialsRequest
-  describe Validation do
+  describe Validator do
     let(:server)      { double :server, scopes: nil }
     let(:application) { double scopes: nil }
     let(:client)      { double application: application }
     let(:request)     { double :request, client: client, scopes: nil }
 
-    subject { Validation.new(server, request) }
+    subject { described_class.new(server, request) }
 
     it "is valid with valid request" do
       expect(subject).to be_valid
@@ -26,7 +26,7 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
         allow(request).to receive(:grant_type).and_return(Doorkeeper::OAuth::CLIENT_CREDENTIALS)
         allow(server).to receive(:scopes).and_return(server_scopes)
         allow(request).to receive(:scopes).and_return(
-          Doorkeeper::OAuth::Scopes.from_string("invalid")
+          Doorkeeper::OAuth::Scopes.from_string("invalid"),
         )
         expect(subject).not_to be_valid
       end
@@ -49,7 +49,7 @@ class Doorkeeper::OAuth::ClientCredentialsRequest
           allow(request).to receive(:grant_type).and_return(Doorkeeper::OAuth::CLIENT_CREDENTIALS)
           allow(server).to receive(:scopes).and_return(server_scopes)
           allow(request).to receive(:scopes).and_return(
-            Doorkeeper::OAuth::Scopes.from_string("email")
+            Doorkeeper::OAuth::Scopes.from_string("email"),
           )
           expect(subject).not_to be_valid
         end

data/spec/lib/oauth/client_credentials_integration_spec.rb

@@ -2,28 +2,26 @@
 
 require "spec_helper"
 
-module Doorkeeper::OAuth
-  describe ClientCredentialsRequest do
-    let(:server) { Doorkeeper.configuration }
+describe Doorkeeper::OAuth::ClientCredentialsRequest do
+  let(:server) { Doorkeeper.configuration }
 
-    context "with a valid request" do
-      let(:client) { FactoryBot.create :application }
+  context "with a valid request" do
+    let(:client) { FactoryBot.create :application }
 
-      it "issues an access token" do
-        request = ClientCredentialsRequest.new(server, client, {})
-        expect do
-          request.authorize
-        end.to change { Doorkeeper::AccessToken.count }.by(1)
-      end
+    it "issues an access token" do
+      request = Doorkeeper::OAuth::ClientCredentialsRequest.new(server, client, {})
+      expect do
+        request.authorize
+      end.to change { Doorkeeper::AccessToken.count }.by(1)
     end
+  end
 
-    describe "with an invalid request" do
-      it "does not issue an access token" do
-        request = ClientCredentialsRequest.new(server, nil, {})
-        expect do
-          request.authorize
-        end.to_not(change { Doorkeeper::AccessToken.count })
-      end
+  describe "with an invalid request" do
+    it "does not issue an access token" do
+      request = Doorkeeper::OAuth::ClientCredentialsRequest.new(server, nil, {})
+      expect do
+        request.authorize
+      end.to_not(change { Doorkeeper::AccessToken.count })
     end
   end
 end

data/spec/lib/oauth/client_credentials_request_spec.rb

@@ -2,108 +2,106 @@
 
 require "spec_helper"
 
-module Doorkeeper::OAuth
-  describe ClientCredentialsRequest do
-    let(:server) do
-      double(
-        default_scopes: nil,
-        access_token_expires_in: 2.hours,
-        custom_access_token_expires_in: ->(_context) { nil }
-      )
-    end
+describe Doorkeeper::OAuth::ClientCredentialsRequest do
+  let(:server) do
+    double(
+      default_scopes: nil,
+      access_token_expires_in: 2.hours,
+      custom_access_token_expires_in: ->(_context) { nil },
+    )
+  end
 
-    let(:application)   { FactoryBot.create(:application, scopes: "") }
-    let(:client)        { double :client, application: application }
-    let(:token_creator) { double :issuer, create: true, token: double }
+  let(:application)   { FactoryBot.create(:application, scopes: "") }
+  let(:client)        { double :client, application: application }
+  let(:token_creator) { double :issuer, create: true, token: double }
 
-    before do
-      allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
-    end
+  before do
+    allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
+  end
+
+  subject { Doorkeeper::OAuth::ClientCredentialsRequest.new(server, client) }
+
+  before do
+    subject.issuer = token_creator
+  end
+
+  it "issues an access token for the current client" do
+    expect(token_creator).to receive(:create).with(client, nil)
+    subject.authorize
+  end
 
-    subject { ClientCredentialsRequest.new(server, client) }
+  it "has successful response when issue was created" do
+    subject.authorize
+    expect(subject.response).to be_a(Doorkeeper::OAuth::TokenResponse)
+  end
 
+  context "if issue was not created" do
     before do
-      subject.issuer = token_creator
+      subject.issuer = double create: false, error: :invalid
     end
 
-    it "issues an access token for the current client" do
-      expect(token_creator).to receive(:create).with(client, nil)
+    it "has an error response" do
       subject.authorize
+      expect(subject.response).to be_a(Doorkeeper::OAuth::ErrorResponse)
     end
 
-    it "has successful response when issue was created" do
+    it "delegates the error to issuer" do
       subject.authorize
-      expect(subject.response).to be_a(TokenResponse)
+      expect(subject.error).to eq(:invalid)
     end
+  end
 
-    context "if issue was not created" do
-      before do
-        subject.issuer = double create: false, error: :invalid
-      end
+  context "with scopes" do
+    let(:default_scopes) { Doorkeeper::OAuth::Scopes.from_string("public email") }
 
-      it "has an error response" do
-        subject.authorize
-        expect(subject.response).to be_a(Doorkeeper::OAuth::ErrorResponse)
-      end
+    before do
+      allow(server).to receive(:default_scopes).and_return(default_scopes)
+    end
 
-      it "delegates the error to issuer" do
-        subject.authorize
-        expect(subject.error).to eq(:invalid)
-      end
+    it "issues an access token with default scopes if none was requested" do
+      expect(token_creator).to receive(:create).with(client, default_scopes)
+      subject.authorize
     end
 
-    context "with scopes" do
-      let(:default_scopes) { Doorkeeper::OAuth::Scopes.from_string("public email") }
+    it "issues an access token with requested scopes" do
+      subject = Doorkeeper::OAuth::ClientCredentialsRequest.new(server, client, scope: "email")
+      subject.issuer = token_creator
+      expect(token_creator).to receive(:create).with(client, Doorkeeper::OAuth::Scopes.from_string("email"))
+      subject.authorize
+    end
+  end
 
-      before do
-        allow(server).to receive(:default_scopes).and_return(default_scopes)
-      end
+  context "with restricted client" do
+    let(:default_scopes) do
+      Doorkeeper::OAuth::Scopes.from_string("public email")
+    end
+    let(:server_scopes) do
+      Doorkeeper::OAuth::Scopes.from_string("public email phone")
+    end
+    let(:client_scopes) do
+      Doorkeeper::OAuth::Scopes.from_string("public phone")
+    end
 
-      it "issues an access token with default scopes if none was requested" do
-        expect(token_creator).to receive(:create).with(client, default_scopes)
-        subject.authorize
-      end
+    before do
+      allow(server).to receive(:default_scopes).and_return(default_scopes)
+      allow(server).to receive(:scopes).and_return(server_scopes)
+      allow(server).to receive(:access_token_expires_in).and_return(100)
+      allow(application).to receive(:scopes).and_return(client_scopes)
+      allow(client).to receive(:id).and_return(nil)
+    end
 
-      it "issues an access token with requested scopes" do
-        subject = ClientCredentialsRequest.new(server, client, scope: "email")
-        subject.issuer = token_creator
-        expect(token_creator).to receive(:create).with(client, Doorkeeper::OAuth::Scopes.from_string("email"))
-        subject.authorize
-      end
+    it "delegates the error to issuer if no scope was requested" do
+      subject = Doorkeeper::OAuth::ClientCredentialsRequest.new(server, client)
+      subject.authorize
+      expect(subject.response).to be_a(Doorkeeper::OAuth::ErrorResponse)
+      expect(subject.error).to eq(:invalid_scope)
     end
 
-    context "with restricted client" do
-      let(:default_scopes) do
-        Doorkeeper::OAuth::Scopes.from_string("public email")
-      end
-      let(:server_scopes) do
-        Doorkeeper::OAuth::Scopes.from_string("public email phone")
-      end
-      let(:client_scopes) do
-        Doorkeeper::OAuth::Scopes.from_string("public phone")
-      end
-
-      before do
-        allow(server).to receive(:default_scopes).and_return(default_scopes)
-        allow(server).to receive(:scopes).and_return(server_scopes)
-        allow(server).to receive(:access_token_expires_in).and_return(100)
-        allow(application).to receive(:scopes).and_return(client_scopes)
-        allow(client).to receive(:id).and_return(nil)
-      end
-
-      it "delegates the error to issuer if no scope was requested" do
-        subject = ClientCredentialsRequest.new(server, client)
-        subject.authorize
-        expect(subject.response).to be_a(Doorkeeper::OAuth::ErrorResponse)
-        expect(subject.error).to eq(:invalid_scope)
-      end
-
-      it "issues an access token with requested scopes" do
-        subject = ClientCredentialsRequest.new(server, client, scope: "phone")
-        subject.authorize
-        expect(subject.response).to be_a(Doorkeeper::OAuth::TokenResponse)
-        expect(subject.response.token.scopes_string).to eq("phone")
-      end
+    it "issues an access token with requested scopes" do
+      subject = Doorkeeper::OAuth::ClientCredentialsRequest.new(server, client, scope: "phone")
+      subject.authorize
+      expect(subject.response).to be_a(Doorkeeper::OAuth::TokenResponse)
+      expect(subject.response.token.scopes_string).to eq("phone")
     end
   end
 end

data/spec/lib/oauth/client_spec.rb

@@ -2,37 +2,37 @@
 
 require "spec_helper"
 
-module Doorkeeper::OAuth
-  describe Client do
-    describe :find do
-      let(:method) { double }
+describe Doorkeeper::OAuth::Client do
+  describe :find do
+    let(:method) { double }
 
-      it "finds the client via uid" do
-        client = double
-        expect(method).to receive(:call).with("uid").and_return(client)
-        expect(Client.find("uid", method)).to be_a(Client)
-      end
+    it "finds the client via uid" do
+      client = double
+      expect(method).to receive(:call).with("uid").and_return(client)
+      expect(Doorkeeper::OAuth::Client.find("uid", method))
+        .to be_a(Doorkeeper::OAuth::Client)
+    end
 
-      it "returns nil if client was not found" do
-        expect(method).to receive(:call).with("uid").and_return(nil)
-        expect(Client.find("uid", method)).to be_nil
-      end
+    it "returns nil if client was not found" do
+      expect(method).to receive(:call).with("uid").and_return(nil)
+      expect(Doorkeeper::OAuth::Client.find("uid", method)).to be_nil
     end
+  end
 
-    describe :authenticate do
-      it "returns the authenticated client via credentials" do
-        credentials = Client::Credentials.new("some-uid", "some-secret")
-        authenticator = double
-        expect(authenticator).to receive(:call).with("some-uid", "some-secret").and_return(double)
-        expect(Client.authenticate(credentials, authenticator)).to be_a(Client)
-      end
+  describe ".authenticate" do
+    it "returns the authenticated client via credentials" do
+      credentials = Doorkeeper::OAuth::Client::Credentials.new("some-uid", "some-secret")
+      authenticator = double
+      expect(authenticator).to receive(:call).with("some-uid", "some-secret").and_return(double)
+      expect(Doorkeeper::OAuth::Client.authenticate(credentials, authenticator))
+        .to be_a(Doorkeeper::OAuth::Client)
+    end
 
-      it "returns nil if client was not authenticated" do
-        credentials = Client::Credentials.new("some-uid", "some-secret")
-        authenticator = double
-        expect(authenticator).to receive(:call).with("some-uid", "some-secret").and_return(nil)
-        expect(Client.authenticate(credentials, authenticator)).to be_nil
-      end
+    it "returns nil if client was not authenticated" do
+      credentials = Doorkeeper::OAuth::Client::Credentials.new("some-uid", "some-secret")
+      authenticator = double
+      expect(authenticator).to receive(:call).with("some-uid", "some-secret").and_return(nil)
+      expect(Doorkeeper::OAuth::Client.authenticate(credentials, authenticator)).to be_nil
     end
   end
 end

data/spec/lib/oauth/code_request_spec.rb

@@ -2,46 +2,45 @@
 
 require "spec_helper"
 
-module Doorkeeper::OAuth
-  describe CodeRequest do
-    let(:pre_auth) do
-      double(
-        :pre_auth,
-        client: double(:application, id: 9990),
-        redirect_uri: "http://tst.com/cb",
-        scopes: nil,
-        state: nil,
-        error: nil,
-        authorizable?: true,
-        code_challenge: nil,
-        code_challenge_method: nil
-      )
-    end
+describe Doorkeeper::OAuth::CodeRequest do
+  let(:pre_auth) do
+    server = Doorkeeper.configuration
+    allow(server)
+      .to receive(:default_scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
+    allow(server)
+      .to receive(:grant_flows).and_return(Doorkeeper::OAuth::Scopes.from_string("authorization_code"))
+
+    application = FactoryBot.create(:application, scopes: "public")
+    client = Doorkeeper::OAuth::Client.new(application)
+
+    attributes = {
+      client_id: client.uid,
+      response_type: "code",
+      redirect_uri: "https://app.com/callback",
+    }
+
+    pre_auth = Doorkeeper::OAuth::PreAuthorization.new(server, attributes)
+    pre_auth.authorizable?
+    pre_auth
+  end
 
-    let(:owner) { double :owner, id: 8900 }
+  let(:owner) { double :owner, id: 8900 }
 
-    subject do
-      CodeRequest.new(pre_auth, owner)
-    end
-
-    it "creates an access grant" do
-      expect do
-        subject.authorize
-      end.to change { Doorkeeper::AccessGrant.count }.by(1)
-    end
-
-    it "returns a code response" do
-      expect(subject.authorize).to be_a(CodeResponse)
-    end
+  subject do
+    described_class.new(pre_auth, owner)
+  end
 
-    it "does not create grant when not authorizable" do
-      allow(pre_auth).to receive(:authorizable?).and_return(false)
-      expect { subject.authorize }.not_to(change { Doorkeeper::AccessGrant.count })
+  context "when pre_auth is authorized" do
+    it "creates an access grant and returns a code response" do
+      expect { subject.authorize }.to change { Doorkeeper::AccessGrant.count }.by(1)
+      expect(subject.authorize).to be_a(Doorkeeper::OAuth::CodeResponse)
     end
+  end
 
-    it "returns a error response" do
-      allow(pre_auth).to receive(:authorizable?).and_return(false)
-      expect(subject.authorize).to be_a(ErrorResponse)
+  context "when pre_auth is denied" do
+    it "does not create access grant and returns a error response" do
+      expect { subject.deny }.not_to(change { Doorkeeper::AccessGrant.count })
+      expect(subject.deny).to be_a(Doorkeeper::OAuth::ErrorResponse)
     end
   end
 end