doorkeeper 5.1.0 → 5.3.0

data/spec/requests/flows/refresh_token_spec.rb

@@ -44,17 +44,17 @@ describe "Refresh Token Flow" do
         :access_token,
         application: @client,
         resource_owner_id: 1,
-        use_refresh_token: true
+        use_refresh_token: true,
       )
     end
 
     context "refresh_token revoked on use" do
       it "client request a token with refresh token" do
         post refresh_token_endpoint_url(
-          client: @client, refresh_token: @token.refresh_token
+          client: @client, refresh_token: @token.refresh_token,
         )
         should_have_json(
-          "refresh_token", Doorkeeper::AccessToken.last.refresh_token
+          "refresh_token", Doorkeeper::AccessToken.last.refresh_token,
         )
         expect(@token.reload).not_to be_revoked
       end
@@ -62,10 +62,10 @@ describe "Refresh Token Flow" do
       it "client request a token with expired access token" do
         @token.update_attribute :expires_in, -100
         post refresh_token_endpoint_url(
-          client: @client, refresh_token: @token.refresh_token
+          client: @client, refresh_token: @token.refresh_token,
         )
         should_have_json(
-          "refresh_token", Doorkeeper::AccessToken.last.refresh_token
+          "refresh_token", Doorkeeper::AccessToken.last.refresh_token,
         )
         expect(@token.reload).not_to be_revoked
       end
@@ -78,10 +78,10 @@ describe "Refresh Token Flow" do
 
       it "client request a token with refresh token" do
         post refresh_token_endpoint_url(
-          client: @client, refresh_token: @token.refresh_token
+          client: @client, refresh_token: @token.refresh_token,
         )
         should_have_json(
-          "refresh_token", Doorkeeper::AccessToken.last.refresh_token
+          "refresh_token", Doorkeeper::AccessToken.last.refresh_token,
         )
         expect(@token.reload).to be_revoked
       end
@@ -89,10 +89,10 @@ describe "Refresh Token Flow" do
       it "client request a token with expired access token" do
         @token.update_attribute :expires_in, -100
         post refresh_token_endpoint_url(
-          client: @client, refresh_token: @token.refresh_token
+          client: @client, refresh_token: @token.refresh_token,
         )
         should_have_json(
-          "refresh_token", Doorkeeper::AccessToken.last.refresh_token
+          "refresh_token", Doorkeeper::AccessToken.last.refresh_token,
         )
         expect(@token.reload).to be_revoked
       end
@@ -102,7 +102,7 @@ describe "Refresh Token Flow" do
       let(:public_client) do
         FactoryBot.create(
           :application,
-          confidential: false
+          confidential: false,
         )
       end
 
@@ -111,7 +111,7 @@ describe "Refresh Token Flow" do
           :access_token,
           application: @client,
           resource_owner_id: 1,
-          use_refresh_token: true
+          use_refresh_token: true,
         )
       end
 
@@ -120,14 +120,14 @@ describe "Refresh Token Flow" do
           :access_token,
           application: public_client,
           resource_owner_id: 1,
-          use_refresh_token: true
+          use_refresh_token: true,
         )
       end
 
       it "issues a new token without client_secret when refresh token was issued to a public client" do
         post refresh_token_endpoint_url(
           client_id: public_client.uid,
-          refresh_token: token_for_public_client.refresh_token
+          refresh_token: token_for_public_client.refresh_token,
         )
 
         new_token = Doorkeeper::AccessToken.last
@@ -146,7 +146,7 @@ describe "Refresh Token Flow" do
         post refresh_token_endpoint_url(
           client_id: "1",
           client_secret: "1",
-          refresh_token: token_for_private_client.refresh_token
+          refresh_token: token_for_private_client.refresh_token,
         )
 
         should_not_have_json "refresh_token"
@@ -172,7 +172,7 @@ describe "Refresh Token Flow" do
       post refresh_token_endpoint_url(client: @client, refresh_token: @token.refresh_token)
 
       should_not_have_json "refresh_token"
-      should_have_json "error", "invalid_request"
+      should_have_json "error", "invalid_grant"
     end
   end
 
@@ -185,7 +185,7 @@ describe "Refresh Token Flow" do
       end
       create_resource_owner
       _another_token = post password_token_endpoint_url(
-        client: @client, resource_owner: @resource_owner
+        client: @client, resource_owner: @resource_owner,
       )
       last_token.update_attribute :created_at, 5.seconds.ago
 
@@ -193,7 +193,7 @@ describe "Refresh Token Flow" do
         :access_token,
         application: @client,
         resource_owner_id: @resource_owner.id,
-        use_refresh_token: true
+        use_refresh_token: true,
       )
       @token.update_attribute :expires_in, -100
     end
@@ -201,7 +201,7 @@ describe "Refresh Token Flow" do
     context "refresh_token revoked on use" do
       it "client request a token after creating another token with the same user" do
         post refresh_token_endpoint_url(
-          client: @client, refresh_token: @token.refresh_token
+          client: @client, refresh_token: @token.refresh_token,
         )
 
         should_have_json "refresh_token", last_token.refresh_token
@@ -216,7 +216,7 @@ describe "Refresh Token Flow" do
 
       it "client request a token after creating another token with the same user" do
         post refresh_token_endpoint_url(
-          client: @client, refresh_token: @token.refresh_token
+          client: @client, refresh_token: @token.refresh_token,
         )
 
         should_have_json "refresh_token", last_token.refresh_token
@@ -226,7 +226,7 @@ describe "Refresh Token Flow" do
 
     def last_token
       Doorkeeper::AccessToken.last_authorized_token_for(
-        @client.id, @resource_owner.id
+        @client.id, @resource_owner.id,
       )
     end
   end

data/spec/requests/flows/revoke_token_spec.rb

@@ -11,10 +11,12 @@ describe "Revoke Token Flow" do
     let(:client_application) { FactoryBot.create :application }
     let(:resource_owner) { User.create!(name: "John", password: "sekret") }
     let(:access_token) do
-      FactoryBot.create(:access_token,
-                        application: client_application,
-                        resource_owner_id: resource_owner.id,
-                        use_refresh_token: true)
+      FactoryBot.create(
+        :access_token,
+        application: client_application,
+        resource_owner_id: resource_owner.id,
+        use_refresh_token: true,
+      )
     end
 
     context "with authenticated, confidential OAuth 2.0 client/application" do
@@ -40,16 +42,14 @@ describe "Revoke Token Flow" do
       end
 
       context "with invalid token to revoke" do
-        it "should not revoke any tokens and respond successfully" do
+        it "should not revoke any tokens and respond with forbidden" do
           expect do
             post revocation_token_endpoint_url,
                  params: { token: "I_AM_AN_INVALID_TOKEN" },
                  headers: headers
           end.not_to(change { Doorkeeper::AccessToken.where(revoked_at: nil).count })
 
-          # The authorization server responds with HTTP status code 200 even if
-          # token is invalid
-          expect(response).to be_successful
+          expect(response).to be_forbidden
         end
       end
 
@@ -59,19 +59,23 @@ describe "Revoke Token Flow" do
           credentials = Base64.encode64("#{client_id}:poop")
           { "HTTP_AUTHORIZATION" => "Basic #{credentials}" }
         end
-        it "should not revoke any tokens and respond successfully" do
+        it "should not revoke any tokens and respond with forbidden" do
           post revocation_token_endpoint_url, params: { token: access_token.token }, headers: headers
 
-          expect(response).to be_successful
+          expect(response).to be_forbidden
+          expect(response.body).to include("unauthorized_client")
+          expect(response.body).to include(I18n.t("doorkeeper.errors.messages.revoke.unauthorized"))
           expect(access_token.reload.revoked?).to be_falsey
         end
       end
 
       context "with no credentials and a valid token" do
-        it "should not revoke any tokens and respond successfully" do
+        it "should not revoke any tokens and respond with forbidden" do
           post revocation_token_endpoint_url, params: { token: access_token.token }
 
-          expect(response).to be_successful
+          expect(response).to be_forbidden
+          expect(response.body).to include("unauthorized_client")
+          expect(response.body).to include(I18n.t("doorkeeper.errors.messages.revoke.unauthorized"))
           expect(access_token.reload.revoked?).to be_falsey
         end
       end
@@ -88,7 +92,9 @@ describe "Revoke Token Flow" do
         it "should not revoke the token as its unauthorized" do
           post revocation_token_endpoint_url, params: { token: access_token.token }, headers: headers
 
-          expect(response).to be_successful
+          expect(response).to be_forbidden
+          expect(response.body).to include("unauthorized_client")
+          expect(response.body).to include(I18n.t("doorkeeper.errors.messages.revoke.unauthorized"))
           expect(access_token.reload.revoked?).to be_falsey
         end
       end
@@ -96,10 +102,12 @@ describe "Revoke Token Flow" do
 
     context "with public OAuth 2.0 client/application" do
       let(:access_token) do
-        FactoryBot.create(:access_token,
-                          application: nil,
-                          resource_owner_id: resource_owner.id,
-                          use_refresh_token: true)
+        FactoryBot.create(
+          :access_token,
+          application: nil,
+          resource_owner_id: resource_owner.id,
+          use_refresh_token: true,
+        )
       end
 
       it "should revoke the access token provided" do
@@ -118,23 +126,29 @@ describe "Revoke Token Flow" do
 
       context "with a valid token issued for a confidential client" do
         let(:access_token) do
-          FactoryBot.create(:access_token,
-                            application: client_application,
-                            resource_owner_id: resource_owner.id,
-                            use_refresh_token: true)
+          FactoryBot.create(
+            :access_token,
+            application: client_application,
+            resource_owner_id: resource_owner.id,
+            use_refresh_token: true,
+          )
         end
 
         it "should not revoke the access token provided" do
           post revocation_token_endpoint_url, params: { token: access_token.token }
 
-          expect(response).to be_successful
+          expect(response).to be_forbidden
+          expect(response.body).to include("unauthorized_client")
+          expect(response.body).to include(I18n.t("doorkeeper.errors.messages.revoke.unauthorized"))
           expect(access_token.reload.revoked?).to be_falsey
         end
 
         it "should not revoke the refresh token provided" do
           post revocation_token_endpoint_url, params: { token: access_token.token }
 
-          expect(response).to be_successful
+          expect(response).to be_forbidden
+          expect(response.body).to include("unauthorized_client")
+          expect(response.body).to include(I18n.t("doorkeeper.errors.messages.revoke.unauthorized"))
           expect(access_token.reload.revoked?).to be_falsey
         end
       end

data/spec/spec_helper.rb

@@ -29,12 +29,9 @@ end
 
 Doorkeeper::RSpec.print_configuration_info
 
-# Remove after dropping support of Rails 4.2
-require "#{File.dirname(__FILE__)}/support/http_method_shim"
-
 require "support/orm/#{DOORKEEPER_ORM}"
 
-Dir["#{File.dirname(__FILE__)}/support/{dependencies,helpers,shared}/*.rb"].each { |file| require file }
+Dir["#{File.dirname(__FILE__)}/support/{dependencies,helpers,shared}/*.rb"].sort.each { |file| require file }
 
 RSpec.configure do |config|
   config.infer_spec_type_from_file_location!

data/spec/support/doorkeeper_rspec.rb

@@ -16,7 +16,7 @@ module Doorkeeper
     # Tries to find ORM from the Gemfile used to run test suite
     def self.detect_orm
       orm = (ENV["BUNDLE_GEMFILE"] || "").match(/Gemfile\.(.+)\.rb/)
-      (orm && orm[1] || :active_record).to_sym
+      (orm && orm[1] || ENV["ORM"] || :active_record).to_sym
     end
   end
 end

data/spec/support/helpers/request_spec_helper.rb

@@ -54,7 +54,7 @@ module RequestSpecHelper
   end
 
   def with_header(header, value)
-    page.driver.header header, value
+    page.driver.header(header, value)
   end
 
   def basic_auth_header_for_client(client)
@@ -86,8 +86,20 @@ module RequestSpecHelper
     i_should_see translated_error_message(key)
   end
 
+  def i_should_not_see_translated_error_message(key)
+    i_should_not_see translated_error_message(key)
+  end
+
   def translated_error_message(key)
-    I18n.translate key, scope: %i[doorkeeper errors messages]
+    I18n.translate(key, scope: %i[doorkeeper errors messages])
+  end
+
+  def i_should_see_translated_invalid_request_error_message(key, value)
+    i_should_see translated_invalid_request_error_message(key, value)
+  end
+
+  def translated_invalid_request_error_message(key, value)
+    I18n.translate key, scope: %i[doorkeeper errors messages invalid_request], value: value
   end
 
   def response_status_should_be(status)

data/spec/support/shared/controllers_shared_context.rb

@@ -4,14 +4,16 @@ shared_context "valid token", token: :valid do
   let(:token_string) { "1A2B3C4D" }
 
   let :token do
-    double(Doorkeeper::AccessToken,
-           accessible?: true, includes_scope?: true, acceptable?: true,
-           previous_refresh_token: "", revoke_previous_refresh_token!: true)
+    double(
+      Doorkeeper::AccessToken,
+      accessible?: true, includes_scope?: true, acceptable?: true,
+      previous_refresh_token: "", revoke_previous_refresh_token!: true,
+    )
   end
 
   before :each do
     allow(
-      Doorkeeper::AccessToken
+      Doorkeeper::AccessToken,
     ).to receive(:by_token).with(token_string).and_return(token)
   end
 end
@@ -20,15 +22,17 @@ shared_context "invalid token", token: :invalid do
   let(:token_string) { "1A2B3C4D" }
 
   let :token do
-    double(Doorkeeper::AccessToken,
-           accessible?: false, revoked?: false, expired?: false,
-           includes_scope?: false, acceptable?: false,
-           previous_refresh_token: "", revoke_previous_refresh_token!: true)
+    double(
+      Doorkeeper::AccessToken,
+      accessible?: false, revoked?: false, expired?: false,
+      includes_scope?: false, acceptable?: false,
+      previous_refresh_token: "", revoke_previous_refresh_token!: true,
+    )
   end
 
   before :each do
     allow(
-      Doorkeeper::AccessToken
+      Doorkeeper::AccessToken,
     ).to receive(:by_token).with(token_string).and_return(token)
   end
 end
@@ -72,15 +76,17 @@ shared_context "expired token", token: :expired do
   end
 
   let :token do
-    double(Doorkeeper::AccessToken,
-           accessible?: false, revoked?: false, expired?: true,
-           includes_scope?: false, acceptable?: false,
-           previous_refresh_token: "", revoke_previous_refresh_token!: true)
+    double(
+      Doorkeeper::AccessToken,
+      accessible?: false, revoked?: false, expired?: true,
+      includes_scope?: false, acceptable?: false,
+      previous_refresh_token: "", revoke_previous_refresh_token!: true,
+    )
   end
 
   before :each do
     allow(
-      Doorkeeper::AccessToken
+      Doorkeeper::AccessToken,
     ).to receive(:by_token).with(token_string).and_return(token)
   end
 end
@@ -91,15 +97,17 @@ shared_context "revoked token", token: :revoked do
   end
 
   let :token do
-    double(Doorkeeper::AccessToken,
-           accessible?: false, revoked?: true, expired?: false,
-           includes_scope?: false, acceptable?: false,
-           previous_refresh_token: "", revoke_previous_refresh_token!: true)
+    double(
+      Doorkeeper::AccessToken,
+      accessible?: false, revoked?: true, expired?: false,
+      includes_scope?: false, acceptable?: false,
+      previous_refresh_token: "", revoke_previous_refresh_token!: true,
+    )
   end
 
   before :each do
     allow(
-      Doorkeeper::AccessToken
+      Doorkeeper::AccessToken,
     ).to receive(:by_token).with(token_string).and_return(token)
   end
 end
@@ -110,14 +118,16 @@ shared_context "forbidden token", token: :forbidden do
   end
 
   let :token do
-    double(Doorkeeper::AccessToken,
-           accessible?: true, includes_scope?: true, acceptable?: false,
-           previous_refresh_token: "", revoke_previous_refresh_token!: true)
+    double(
+      Doorkeeper::AccessToken,
+      accessible?: true, includes_scope?: true, acceptable?: false,
+      previous_refresh_token: "", revoke_previous_refresh_token!: true,
+    )
   end
 
   before :each do
     allow(
-      Doorkeeper::AccessToken
+      Doorkeeper::AccessToken,
     ).to receive(:by_token).with(token_string).and_return(token)
   end
 end

data/spec/validators/redirect_uri_validator_spec.rb

@@ -2,7 +2,7 @@
 
 require "spec_helper"
 
-describe RedirectUriValidator do
+describe Doorkeeper::RedirectUriValidator do
   subject do
     FactoryBot.create(:application)
   end
@@ -18,7 +18,7 @@ describe RedirectUriValidator do
   #
   # @see https://www.oauth.com/oauth2-servers/redirect-uris/redirect-uris-native-apps/
   it "is valid when the uri is custom native URI" do
-    subject.redirect_uri = "myapp://callback"
+    subject.redirect_uri = "myapp:/callback"
     expect(subject).to be_valid
   end
 
@@ -27,33 +27,48 @@ describe RedirectUriValidator do
     expect(subject).to be_valid
   end
 
-  it "accepts native redirect uri" do
+  it "accepts nonstandard oob redirect uri" do
     subject.redirect_uri = "urn:ietf:wg:oauth:2.0:oob"
     expect(subject).to be_valid
   end
 
-  it "rejects if test uri is disabled" do
-    allow(RedirectUriValidator).to receive(:native_redirect_uri).and_return(nil)
-    subject.redirect_uri = "urn:some:test"
-    expect(subject).not_to be_valid
+  it "accepts nonstandard oob:auto redirect uri" do
+    subject.redirect_uri = "urn:ietf:wg:oauth:2.0:oob:auto"
+    expect(subject).to be_valid
   end
 
   it "is invalid when the uri is not a uri" do
     subject.redirect_uri = "]"
     expect(subject).not_to be_valid
-    expect(subject.errors[:redirect_uri].first).to eq("must be a valid URI.")
+    expect(subject.errors[:redirect_uri].first).to eq(I18n.t("activerecord.errors.models.doorkeeper/application.attributes.redirect_uri.invalid_uri"))
   end
 
   it "is invalid when the uri is relative" do
     subject.redirect_uri = "/abcd"
     expect(subject).not_to be_valid
-    expect(subject.errors[:redirect_uri].first).to eq("must be an absolute URI.")
+    expect(subject.errors[:redirect_uri].first).to eq(I18n.t("activerecord.errors.models.doorkeeper/application.attributes.redirect_uri.relative_uri"))
   end
 
   it "is invalid when the uri has a fragment" do
     subject.redirect_uri = "https://example.com/abcd#xyz"
     expect(subject).not_to be_valid
-    expect(subject.errors[:redirect_uri].first).to eq("cannot contain a fragment.")
+    expect(subject.errors[:redirect_uri].first).to eq(I18n.t("activerecord.errors.models.doorkeeper/application.attributes.redirect_uri.fragment_present"))
+  end
+
+  it "is invalid when scheme resolves to localhost (needs an explict scheme)" do
+    subject.redirect_uri = "localhost:80"
+    expect(subject).to be_invalid
+    expect(subject.errors[:redirect_uri].first).to eq(I18n.t("activerecord.errors.models.doorkeeper/application.attributes.redirect_uri.unspecified_scheme"))
+  end
+
+  it "is invalid if an ip address" do
+    subject.redirect_uri = "127.0.0.1:8080"
+    expect(subject).to be_invalid
+  end
+
+  it "accepts an ip address based URI if a scheme is specified" do
+    subject.redirect_uri = "https://127.0.0.1:8080"
+    expect(subject).to be_valid
   end
 
   context "force secured uri" do
@@ -62,20 +77,30 @@ describe RedirectUriValidator do
       expect(subject).to be_valid
     end
 
-    it "accepts native redirect uri" do
-      subject.redirect_uri = "urn:ietf:wg:oauth:2.0:oob"
+    it "accepts custom scheme redirect uri (as per rfc8252 section 7.1)" do
+      subject.redirect_uri = "com.example.app:/oauth/callback"
+      expect(subject).to be_valid
+    end
+
+    it "accepts custom scheme redirect uri (as per rfc8252 section 7.1) #2" do
+      subject.redirect_uri = "com.example.app:/test"
+      expect(subject).to be_valid
+    end
+
+    it "accepts custom scheme redirect uri (common misconfiguration we have decided to allow)" do
+      subject.redirect_uri = "com.example.app://oauth/callback"
       expect(subject).to be_valid
     end
 
-    it "accepts app redirect uri" do
-      subject.redirect_uri = "some-awesome-app://oauth/callback"
+    it "accepts custom scheme redirect uri (common misconfiguration we have decided to allow) #2" do
+      subject.redirect_uri = "com.example.app://test"
       expect(subject).to be_valid
     end
 
     it "accepts a non secured protocol when disabled" do
       subject.redirect_uri = "http://example.com/callback"
       allow(Doorkeeper.configuration).to receive(
-        :force_ssl_in_redirect_uri
+        :force_ssl_in_redirect_uri,
       ).and_return(false)
       expect(subject).to be_valid
     end
@@ -118,7 +143,7 @@ describe RedirectUriValidator do
       subject.redirect_uri = "http://example.com/callback"
       expect(subject).not_to be_valid
       error = subject.errors[:redirect_uri].first
-      expect(error).to eq("must be an HTTPS/SSL URI.")
+      expect(error).to eq(I18n.t("activerecord.errors.models.doorkeeper/application.attributes.redirect_uri.secured_uri"))
     end
   end