doorkeeper 5.1.0 → 5.3.0

data/spec/lib/oauth/code_response_spec.rb

@@ -2,34 +2,30 @@
 
 require "spec_helper"
 
-module Doorkeeper
-  module OAuth
-    describe CodeResponse do
-      describe ".redirect_uri" do
-        context "when generating the redirect URI for an implicit grant" do
-          let :pre_auth do
-            double(
-              :pre_auth,
-              client: double(:application, id: 1),
-              redirect_uri: "http://tst.com/cb",
-              state: nil,
-              scopes: Scopes.from_string("public")
-            )
-          end
+describe Doorkeeper::OAuth::CodeResponse do
+  describe "#redirect_uri" do
+    context "when generating the redirect URI for an implicit grant" do
+      let :pre_auth do
+        double(
+          :pre_auth,
+          client: double(:application, id: 1),
+          redirect_uri: "http://tst.com/cb",
+          state: nil,
+          scopes: Doorkeeper::OAuth::Scopes.from_string("public"),
+        )
+      end
 
-          let :auth do
-            Authorization::Token.new(pre_auth, double(id: 1)).tap do |c|
-              c.issue_token
-              allow(c.token).to receive(:expires_in_seconds).and_return(3600)
-            end
-          end
+      let :auth do
+        Doorkeeper::OAuth::Authorization::Token.new(pre_auth, double(id: 1)).tap do |c|
+          c.issue_token
+          allow(c.token).to receive(:expires_in_seconds).and_return(3600)
+        end
+      end
 
-          subject { CodeResponse.new(pre_auth, auth, response_on_fragment: true).redirect_uri }
+      subject { described_class.new(pre_auth, auth, response_on_fragment: true).redirect_uri }
 
-          it "includes the remaining TTL of the token relative to the time the token was generated" do
-            expect(subject).to include("expires_in=3600")
-          end
-        end
+      it "includes the remaining TTL of the token relative to the time the token was generated" do
+        expect(subject).to include("expires_in=3600")
       end
     end
   end

data/spec/lib/oauth/error_response_spec.rb

@@ -2,65 +2,63 @@
 
 require "spec_helper"
 
-module Doorkeeper::OAuth
-  describe ErrorResponse do
-    describe "#status" do
-      it "should have a status of bad_request" do
-        expect(subject.status).to eq(:bad_request)
-      end
+describe Doorkeeper::OAuth::ErrorResponse do
+  describe "#status" do
+    it "should have a status of bad_request" do
+      expect(subject.status).to eq(:bad_request)
+    end
 
-      it "should have a status of unauthorized for an invalid_client error" do
-        subject = described_class.new(name: :invalid_client)
+    it "should have a status of unauthorized for an invalid_client error" do
+      subject = described_class.new(name: :invalid_client)
 
-        expect(subject.status).to eq(:unauthorized)
-      end
+      expect(subject.status).to eq(:unauthorized)
     end
+  end
 
-    describe :from_request do
-      it "has the error from request" do
-        error = ErrorResponse.from_request double(error: :some_error)
-        expect(error.name).to eq(:some_error)
-      end
-
-      it "ignores state if request does not respond to state" do
-        error = ErrorResponse.from_request double(error: :some_error)
-        expect(error.state).to be_nil
-      end
+  describe ".from_request" do
+    it "has the error from request" do
+      error = described_class.from_request double(error: :some_error)
+      expect(error.name).to eq(:some_error)
+    end
 
-      it "has state if request responds to state" do
-        error = ErrorResponse.from_request double(error: :some_error, state: :hello)
-        expect(error.state).to eq(:hello)
-      end
+    it "ignores state if request does not respond to state" do
+      error = described_class.from_request double(error: :some_error)
+      expect(error.state).to be_nil
     end
 
-    it "ignores empty error values" do
-      subject = ErrorResponse.new(error: :some_error, state: nil)
-      expect(subject.body).not_to have_key(:state)
+    it "has state if request responds to state" do
+      error = described_class.from_request double(error: :some_error, state: :hello)
+      expect(error.state).to eq(:hello)
     end
+  end
+
+  it "ignores empty error values" do
+    subject = described_class.new(error: :some_error, state: nil)
+    expect(subject.body).not_to have_key(:state)
+  end
 
-    describe ".body" do
-      subject { ErrorResponse.new(name: :some_error, state: :some_state).body }
+  describe ".body" do
+    subject { described_class.new(name: :some_error, state: :some_state).body }
 
-      describe "#body" do
-        it { expect(subject).to have_key(:error) }
-        it { expect(subject).to have_key(:error_description) }
-        it { expect(subject).to have_key(:state) }
-      end
+    describe "#body" do
+      it { expect(subject).to have_key(:error) }
+      it { expect(subject).to have_key(:error_description) }
+      it { expect(subject).to have_key(:state) }
     end
+  end
 
-    describe ".headers" do
-      let(:error_response) { ErrorResponse.new(name: :some_error, state: :some_state) }
-      subject { error_response.headers }
+  describe ".headers" do
+    let(:error_response) { described_class.new(name: :some_error, state: :some_state) }
+    subject { error_response.headers }
 
-      it { expect(subject).to include "WWW-Authenticate" }
+    it { expect(subject).to include "WWW-Authenticate" }
 
-      describe "WWW-Authenticate header" do
-        subject { error_response.headers["WWW-Authenticate"] }
+    describe "WWW-Authenticate header" do
+      subject { error_response.headers["WWW-Authenticate"] }
 
-        it { expect(subject).to include("realm=\"#{error_response.realm}\"") }
-        it { expect(subject).to include("error=\"#{error_response.name}\"") }
-        it { expect(subject).to include("error_description=\"#{error_response.description}\"") }
-      end
+      it { expect(subject).to include("realm=\"#{error_response.realm}\"") }
+      it { expect(subject).to include("error=\"#{error_response.name}\"") }
+      it { expect(subject).to include("error_description=\"#{error_response.description}\"") }
     end
   end
 end

data/spec/lib/oauth/error_spec.rb

@@ -2,22 +2,20 @@
 
 require "spec_helper"
 
-module Doorkeeper::OAuth
-  describe Error do
-    subject(:error) { Error.new(:some_error, :some_state) }
+describe Doorkeeper::OAuth::Error do
+  subject(:error) { described_class.new(:some_error, :some_state) }
 
-    it { expect(subject).to respond_to(:name) }
-    it { expect(subject).to respond_to(:state) }
+  it { expect(subject).to respond_to(:name) }
+  it { expect(subject).to respond_to(:state) }
 
-    describe :description do
-      it "is translated from translation messages" do
-        expect(I18n).to receive(:translate).with(
-          :some_error,
-          scope: %i[doorkeeper errors messages],
-          default: :server_error
-        )
-        error.description
-      end
+  describe "#description" do
+    it "is translated from translation messages" do
+      expect(I18n).to receive(:translate).with(
+        :some_error,
+        scope: %i[doorkeeper errors messages],
+        default: :server_error,
+      )
+      error.description
     end
   end
 end

data/spec/lib/oauth/forbidden_token_response_spec.rb

@@ -2,21 +2,19 @@
 
 require "spec_helper"
 
-module Doorkeeper::OAuth
-  describe ForbiddenTokenResponse do
-    describe "#name" do
-      it { expect(subject.name).to eq(:invalid_scope) }
-    end
+describe Doorkeeper::OAuth::ForbiddenTokenResponse do
+  describe "#name" do
+    it { expect(subject.name).to eq(:invalid_scope) }
+  end
 
-    describe "#status" do
-      it { expect(subject.status).to eq(:forbidden) }
-    end
+  describe "#status" do
+    it { expect(subject.status).to eq(:forbidden) }
+  end
 
-    describe :from_scopes do
-      it "should have a list of acceptable scopes" do
-        response = ForbiddenTokenResponse.from_scopes(["public"])
-        expect(response.description).to include("public")
-      end
+  describe ".from_scopes" do
+    it "should have a list of acceptable scopes" do
+      response = described_class.from_scopes(["public"])
+      expect(response.description).to include("public")
     end
   end
 end

data/spec/lib/oauth/helpers/scope_checker_spec.rb

@@ -44,15 +44,19 @@ module Doorkeeper::OAuth::Helpers
       end
 
       it "is valid if scope is included in the application scope list" do
-        expect(ScopeChecker.valid?(scope_str: "app123",
-                                   server_scopes: server_scopes,
-                                   app_scopes: application_scopes)).to be_truthy
+        expect(ScopeChecker.valid?(
+                 scope_str: "app123",
+                 server_scopes: server_scopes,
+                 app_scopes: application_scopes,
+               )).to be_truthy
       end
 
       it "is invalid if any scope is not included in the application" do
-        expect(ScopeChecker.valid?(scope_str: "svr",
-                                   server_scopes: server_scopes,
-                                   app_scopes: application_scopes)).to be_falsey
+        expect(ScopeChecker.valid?(
+                 scope_str: "svr",
+                 server_scopes: server_scopes,
+                 app_scopes: application_scopes,
+               )).to be_falsey
       end
     end
 
@@ -63,15 +67,19 @@ module Doorkeeper::OAuth::Helpers
 
       context "with scopes_by_grant_type not configured for grant_type" do
         it "is valid if the scope is in server scopes" do
-          expect(ScopeChecker.valid?(scope_str: "scope1",
-                                     server_scopes: server_scopes,
-                                     grant_type: Doorkeeper::OAuth::PASSWORD)).to be_truthy
+          expect(ScopeChecker.valid?(
+                   scope_str: "scope1",
+                   server_scopes: server_scopes,
+                   grant_type: Doorkeeper::OAuth::PASSWORD,
+                 )).to be_truthy
         end
 
         it "is invalid if the scope is not in server scopes" do
-          expect(ScopeChecker.valid?(scope_str: "unknown",
-                                     server_scopes: server_scopes,
-                                     grant_type: Doorkeeper::OAuth::PASSWORD)).to be_falsey
+          expect(ScopeChecker.valid?(
+                   scope_str: "unknown",
+                   server_scopes: server_scopes,
+                   grant_type: Doorkeeper::OAuth::PASSWORD,
+                 )).to be_falsey
         end
       end
 
@@ -82,15 +90,19 @@ module Doorkeeper::OAuth::Helpers
         end
 
         it "is valid if the scope is permitted for grant_type" do
-          expect(ScopeChecker.valid?(scope_str: "scope1",
-                                     server_scopes: server_scopes,
-                                     grant_type: Doorkeeper::OAuth::PASSWORD)).to be_truthy
+          expect(ScopeChecker.valid?(
+                   scope_str: "scope1",
+                   server_scopes: server_scopes,
+                   grant_type: Doorkeeper::OAuth::PASSWORD,
+                 )).to be_truthy
         end
 
         it "is invalid if the scope is permitted for grant_type" do
-          expect(ScopeChecker.valid?(scope_str: "scope2",
-                                     server_scopes: server_scopes,
-                                     grant_type: Doorkeeper::OAuth::PASSWORD)).to be_falsey
+          expect(ScopeChecker.valid?(
+                   scope_str: "scope2",
+                   server_scopes: server_scopes,
+                   grant_type: Doorkeeper::OAuth::PASSWORD,
+                 )).to be_falsey
         end
       end
     end

data/spec/lib/oauth/helpers/uri_checker_spec.rb

@@ -40,13 +40,28 @@ module Doorkeeper::OAuth::Helpers
         expect(URIChecker.valid?(uri)).to be_falsey
       end
 
+      it "is invalid if localhost is resolved as as scheme (no scheme specified)" do
+        uri = "localhost:8080"
+        expect(URIChecker.valid?(uri)).to be_falsey
+      end
+
+      it "is invalid if scheme is missing #2" do
+        uri = "app.co:80"
+        expect(URIChecker.valid?(uri)).to be_falsey
+      end
+
       it "is invalid if is not an uri" do
         uri = "   "
         expect(URIChecker.valid?(uri)).to be_falsey
       end
 
-      it "is valid for native uris" do
-        uri = "urn:ietf:wg:oauth:2.0:oob"
+      it "is valid for custom schemes" do
+        uri = "com.example.app:/test"
+        expect(URIChecker.valid?(uri)).to be_truthy
+      end
+
+      it "is valid for custom schemes with authority marker (common misconfiguration)" do
+        uri = "com.example.app://test"
         expect(URIChecker.valid?(uri)).to be_truthy
       end
     end

data/spec/lib/oauth/invalid_request_response_spec.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+describe Doorkeeper::OAuth::InvalidRequestResponse do
+  describe "#name" do
+    it { expect(subject.name).to eq(:invalid_request) }
+  end
+
+  describe "#status" do
+    it { expect(subject.status).to eq(:bad_request) }
+  end
+
+  describe ".from_request" do
+    let(:response) { described_class.from_request(request) }
+
+    context "missing param" do
+      let(:request) { double(missing_param: "some_param") }
+
+      it "sets a description" do
+        expect(response.description).to eq(
+          I18n.t(:missing_param, scope: %i[doorkeeper errors messages invalid_request], value: "some_param"),
+        )
+      end
+
+      it "sets the reason" do
+        expect(response.reason).to eq(:missing_param)
+      end
+    end
+
+    context "server doesn't support_pkce" do
+      let(:request) { double(invalid_request_reason: :not_support_pkce) }
+
+      it "sets a description" do
+        expect(response.description).to eq(
+          I18n.t(:not_support_pkce, scope: %i[doorkeeper errors messages invalid_request]),
+        )
+      end
+
+      it "sets the reason" do
+        expect(response.reason).to eq(:not_support_pkce)
+      end
+    end
+
+    context "request is not authorized" do
+      let(:request) { double(invalid_request_reason: :request_not_authorized) }
+
+      it "sets a description" do
+        expect(response.description).to eq(
+          I18n.t(:request_not_authorized, scope: %i[doorkeeper errors messages invalid_request]),
+        )
+      end
+
+      it "sets the reason" do
+        expect(response.reason).to eq(:request_not_authorized)
+      end
+    end
+
+    context "unknown reason" do
+      let(:request) { double(invalid_request_reason: :unknown_reason) }
+
+      it "sets a description" do
+        expect(response.description).to eq(
+          I18n.t(:unknown, scope: %i[doorkeeper errors messages invalid_request]),
+        )
+      end
+
+      it "unknown reason" do
+        expect(response.reason).to eq(:unknown_reason)
+      end
+    end
+  end
+end

data/spec/lib/oauth/invalid_token_response_spec.rb

@@ -2,53 +2,51 @@
 
 require "spec_helper"
 
-module Doorkeeper::OAuth
-  describe InvalidTokenResponse do
-    describe "#name" do
-      it { expect(subject.name).to eq(:invalid_token) }
-    end
+describe Doorkeeper::OAuth::InvalidTokenResponse do
+  describe "#name" do
+    it { expect(subject.name).to eq(:invalid_token) }
+  end
 
-    describe "#status" do
-      it { expect(subject.status).to eq(:unauthorized) }
-    end
+  describe "#status" do
+    it { expect(subject.status).to eq(:unauthorized) }
+  end
 
-    describe :from_access_token do
-      let(:response) { InvalidTokenResponse.from_access_token(access_token) }
+  describe ".from_access_token" do
+    let(:response) { described_class.from_access_token(access_token) }
 
-      context "revoked" do
-        let(:access_token) { double(revoked?: true, expired?: true) }
+    context "revoked" do
+      let(:access_token) { double(revoked?: true, expired?: true) }
 
-        it "sets a description" do
-          expect(response.description).to include("revoked")
-        end
+      it "sets a description" do
+        expect(response.description).to include("revoked")
+      end
 
-        it "sets the reason" do
-          expect(response.reason).to eq(:revoked)
-        end
+      it "sets the reason" do
+        expect(response.reason).to eq(:revoked)
       end
+    end
 
-      context "expired" do
-        let(:access_token) { double(revoked?: false, expired?: true) }
+    context "expired" do
+      let(:access_token) { double(revoked?: false, expired?: true) }
 
-        it "sets a description" do
-          expect(response.description).to include("expired")
-        end
+      it "sets a description" do
+        expect(response.description).to include("expired")
+      end
 
-        it "sets the reason" do
-          expect(response.reason).to eq(:expired)
-        end
+      it "sets the reason" do
+        expect(response.reason).to eq(:expired)
       end
+    end
 
-      context "unknown" do
-        let(:access_token) { double(revoked?: false, expired?: false) }
+    context "unknown" do
+      let(:access_token) { double(revoked?: false, expired?: false) }
 
-        it "sets a description" do
-          expect(response.description).to include("invalid")
-        end
+      it "sets a description" do
+        expect(response.description).to include("invalid")
+      end
 
-        it "sets the reason" do
-          expect(response.reason).to eq(:unknown)
-        end
+      it "sets the reason" do
+        expect(response.reason).to eq(:unknown)
       end
     end
   end