doorkeeper 5.1.0 → 5.3.0

data/spec/lib/oauth/pre_authorization_spec.rb

@@ -2,213 +2,221 @@
 
 require "spec_helper"
 
-module Doorkeeper::OAuth
-  describe PreAuthorization do
-    let(:server) do
-      server = Doorkeeper.configuration
-      allow(server).to receive(:default_scopes).and_return(Scopes.new)
-      allow(server).to receive(:scopes).and_return(Scopes.from_string("public profile"))
-      server
-    end
+describe Doorkeeper::OAuth::PreAuthorization do
+  let(:server) do
+    server = Doorkeeper.configuration
+    allow(server).to receive(:default_scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("default"))
+    allow(server).to receive(:optional_scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public profile"))
+    server
+  end
 
-    let(:application) do
-      application = double :application
-      allow(application).to receive(:scopes).and_return(Scopes.from_string(""))
-      application
-    end
+  let(:application) { FactoryBot.create(:application, redirect_uri: "https://app.com/callback") }
+  let(:client) { Doorkeeper::OAuth::Client.find(application.uid) }
 
-    let(:client) do
-      double :client, redirect_uri: "http://tst.com/auth", application: application
-    end
+  let :attributes do
+    {
+      client_id: client.uid,
+      response_type: "code",
+      redirect_uri: "https://app.com/callback",
+      state: "save-this",
+    }
+  end
 
-    let :attributes do
-      {
-        response_type: "code",
-        redirect_uri: "http://tst.com/auth",
-        state: "save-this",
-      }
-    end
+  subject do
+    described_class.new(server, attributes)
+  end
 
-    subject do
-      PreAuthorization.new(server, client, attributes)
-    end
+  it "is authorizable when request is valid" do
+    expect(subject).to be_authorizable
+  end
 
-    it "is authorizable when request is valid" do
+  it "accepts code as response type" do
+    attributes[:response_type] = "code"
+    expect(subject).to be_authorizable
+  end
+
+  it "accepts token as response type" do
+    allow(server).to receive(:grant_flows).and_return(["implicit"])
+    attributes[:response_type] = "token"
+    expect(subject).to be_authorizable
+  end
+
+  context "when using default grant flows" do
+    it 'accepts "code" as response type' do
+      attributes[:response_type] = "code"
       expect(subject).to be_authorizable
     end
 
-    it "accepts code as response type" do
-      subject.response_type = "code"
+    it 'accepts "token" as response type' do
+      allow(server).to receive(:grant_flows).and_return(["implicit"])
+      attributes[:response_type] = "token"
       expect(subject).to be_authorizable
     end
+  end
 
-    it "accepts token as response type" do
+  context "when authorization code grant flow is disabled" do
+    before do
       allow(server).to receive(:grant_flows).and_return(["implicit"])
-      subject.response_type = "token"
-      expect(subject).to be_authorizable
     end
 
-    context "when using default grant flows" do
-      it 'accepts "code" as response type' do
-        subject.response_type = "code"
-        expect(subject).to be_authorizable
-      end
+    it 'does not accept "code" as response type' do
+      attributes[:response_type] = "code"
+      expect(subject).not_to be_authorizable
+    end
+  end
 
-      it 'accepts "token" as response type' do
-        allow(server).to receive(:grant_flows).and_return(["implicit"])
-        subject.response_type = "token"
-        expect(subject).to be_authorizable
-      end
+  context "when implicit grant flow is disabled" do
+    before do
+      allow(server).to receive(:grant_flows).and_return(["authorization_code"])
     end
 
-    context "when authorization code grant flow is disabled" do
-      before do
-        allow(server).to receive(:grant_flows).and_return(["implicit"])
-      end
+    it 'does not accept "token" as response type' do
+      attributes[:response_type] = "token"
+      expect(subject).not_to be_authorizable
+    end
+  end
 
-      it 'does not accept "code" as response type' do
-        subject.response_type = "code"
-        expect(subject).not_to be_authorizable
-      end
+  context "client application does not restrict valid scopes" do
+    it "accepts valid scopes" do
+      attributes[:scope] = "public"
+      expect(subject).to be_authorizable
     end
 
-    context "when implicit grant flow is disabled" do
-      before do
-        allow(server).to receive(:grant_flows).and_return(["authorization_code"])
-      end
+    it "rejects (globally) non-valid scopes" do
+      attributes[:scope] = "invalid"
+      expect(subject).not_to be_authorizable
+    end
 
-      it 'does not accept "token" as response type' do
-        subject.response_type = "token"
-        expect(subject).not_to be_authorizable
-      end
+    it "accepts scopes which are permitted for grant_type" do
+      allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:public])
+      attributes[:scope] = "public"
+      expect(subject).to be_authorizable
     end
 
-    context "client application does not restrict valid scopes" do
-      it "accepts valid scopes" do
-        subject.scope = "public"
-        expect(subject).to be_authorizable
-      end
+    it "rejects scopes which are not permitted for grant_type" do
+      allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:profile])
+      attributes[:scope] = "public"
+      expect(subject).not_to be_authorizable
+    end
+  end
 
-      it "rejects (globally) non-valid scopes" do
-        subject.scope = "invalid"
-        expect(subject).not_to be_authorizable
-      end
+  context "client application restricts valid scopes" do
+    let(:application) do
+      FactoryBot.create(:application, scopes: Doorkeeper::OAuth::Scopes.from_string("public nonsense"))
+    end
 
-      it "accepts scopes which are permitted for grant_type" do
-        allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:public])
-        subject.scope = "public"
-        expect(subject).to be_authorizable
-      end
+    it "accepts valid scopes" do
+      attributes[:scope] = "public"
+      expect(subject).to be_authorizable
+    end
 
-      it "rejects scopes which are not permitted for grant_type" do
-        allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:profile])
-        subject.scope = "public"
-        expect(subject).not_to be_authorizable
-      end
+    it "rejects (globally) non-valid scopes" do
+      attributes[:scope] = "invalid"
+      expect(subject).not_to be_authorizable
     end
 
-    context "client application restricts valid scopes" do
-      let(:application) do
-        application = double :application
-        allow(application).to receive(:scopes).and_return(Scopes.from_string("public nonsense"))
-        application
-      end
+    it "rejects (application level) non-valid scopes" do
+      attributes[:scope] = "profile"
+      expect(subject).to_not be_authorizable
+    end
 
-      it "accepts valid scopes" do
-        subject.scope = "public"
-        expect(subject).to be_authorizable
-      end
+    it "accepts scopes which are permitted for grant_type" do
+      allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:public])
+      attributes[:scope] = "public"
+      expect(subject).to be_authorizable
+    end
 
-      it "rejects (globally) non-valid scopes" do
-        subject.scope = "invalid"
-        expect(subject).not_to be_authorizable
-      end
+    it "rejects scopes which are not permitted for grant_type" do
+      allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:profile])
+      attributes[:scope] = "public"
+      expect(subject).not_to be_authorizable
+    end
+  end
 
-      it "rejects (application level) non-valid scopes" do
-        subject.scope = "profile"
-        expect(subject).to_not be_authorizable
-      end
+  context "when scope is not provided to pre_authorization" do
+    before { attributes[:scope] = nil }
 
-      it "accepts scopes which are permitted for grant_type" do
-        allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:public])
-        subject.scope = "public"
+    context "when default scopes is provided" do
+      it "uses default scopes" do
+        allow(server).to receive(:default_scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("default_scope"))
         expect(subject).to be_authorizable
+        expect(subject.scope).to eq("default_scope")
+        expect(subject.scopes).to eq(Doorkeeper::OAuth::Scopes.from_string("default_scope"))
       end
+    end
 
-      it "rejects scopes which are not permitted for grant_type" do
-        allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:profile])
-        subject.scope = "public"
+    context "when default scopes is none" do
+      it "not be authorizable when none default scope" do
+        allow(server).to receive(:default_scopes).and_return(Doorkeeper::OAuth::Scopes.new)
         expect(subject).not_to be_authorizable
       end
     end
+  end
 
-    it "uses default scopes when none is required" do
-      allow(server).to receive(:default_scopes).and_return(Scopes.from_string("default"))
-      subject.scope = nil
-      expect(subject.scope).to eq("default")
-      expect(subject.scopes).to eq(Scopes.from_string("default"))
-    end
+  it "matches the redirect uri against client's one" do
+    attributes[:redirect_uri] = "http://nothesame.com"
+    expect(subject).not_to be_authorizable
+  end
 
-    context "with native redirect uri" do
-      let(:native_redirect_uri) { "urn:ietf:wg:oauth:2.0:oob" }
+  it "stores the state" do
+    expect(subject.state).to eq("save-this")
+  end
 
-      it "accepts redirect_uri when it matches with the client" do
-        subject.redirect_uri = native_redirect_uri
-        allow(subject.client).to receive(:redirect_uri) { native_redirect_uri }
-        expect(subject).to be_authorizable
-      end
+  it "rejects if response type is not allowed" do
+    attributes[:response_type] = "whops"
+    expect(subject).not_to be_authorizable
+  end
 
-      it "invalidates redirect_uri when it does'n match with the client" do
-        subject.redirect_uri = "urn:ietf:wg:oauth:2.0:oob"
-        expect(subject).not_to be_authorizable
-      end
-    end
+  it "requires an existing client" do
+    attributes[:client_id] = nil
+    expect(subject).not_to be_authorizable
+  end
 
-    it "matches the redirect uri against client's one" do
-      subject.redirect_uri = "http://nothesame.com"
-      expect(subject).not_to be_authorizable
-    end
+  it "requires a redirect uri" do
+    attributes[:redirect_uri] = nil
+    expect(subject).not_to be_authorizable
+  end
 
-    it "stores the state" do
-      expect(subject.state).to eq("save-this")
-    end
+  describe "as_json" do
+    before { subject.authorizable? }
 
-    it "rejects if response type is not allowed" do
-      subject.response_type = "whops"
-      expect(subject).not_to be_authorizable
-    end
+    it { is_expected.to respond_to :as_json }
 
-    it "requires an existing client" do
-      subject.client = nil
-      expect(subject).not_to be_authorizable
+    shared_examples "returns the pre authorization" do
+      it "returns the pre authorization" do
+        expect(json[:client_id]).to eq client.uid
+        expect(json[:redirect_uri]).to eq subject.redirect_uri
+        expect(json[:state]).to eq subject.state
+        expect(json[:response_type]).to eq subject.response_type
+        expect(json[:scope]).to eq subject.scope
+        expect(json[:client_name]).to eq client.name
+        expect(json[:status]).to eq I18n.t("doorkeeper.pre_authorization.status")
+      end
     end
 
-    it "requires a redirect uri" do
-      subject.redirect_uri = nil
-      expect(subject).not_to be_authorizable
+    context "when attributes param is not passed" do
+      let(:json) { subject.as_json }
+
+      include_examples "returns the pre authorization"
     end
 
-    describe "as_json" do
-      let(:client_id) { "client_uid_123" }
-      let(:client_name) { "Acme Co." }
+    context "when attributes param is passed" do
+      context "when attributes is a hash" do
+        let(:custom_attributes) { { custom_id: "1234", custom_name: "a pretty good name" } }
+        let(:json) { subject.as_json(custom_attributes) }
 
-      before do
-        allow(client).to receive(:uid).and_return client_id
-        allow(client).to receive(:name).and_return client_name
-      end
+        include_examples "returns the pre authorization"
 
-      let(:json) { subject.as_json({}) }
+        it "merges the attributes in params" do
+          expect(json[:custom_id]).to eq custom_attributes[:custom_id]
+          expect(json[:custom_name]).to eq custom_attributes[:custom_name]
+        end
+      end
 
-      it { is_expected.to respond_to :as_json }
+      context "when attributes is not a hash" do
+        let(:json) { subject.as_json(nil) }
 
-      it "returns correct values" do
-        expect(json[:client_id]).to eq client_id
-        expect(json[:redirect_uri]).to eq subject.redirect_uri
-        expect(json[:state]).to eq subject.state
-        expect(json[:response_type]).to eq subject.response_type
-        expect(json[:scope]).to eq subject.scope
-        expect(json[:client_name]).to eq client_name
-        expect(json[:status]).to eq I18n.t("doorkeeper.pre_authorization.status")
+        include_examples "returns the pre authorization"
       end
     end
   end