doorkeeper 5.1.0 → 5.5.0

data/spec/controllers/tokens_controller_spec.rb

@@ -1,330 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe Doorkeeper::TokensController do
-  describe "when authorization has succeeded" do
-    let(:token) { double(:token, authorize: true) }
-
-    it "returns the authorization" do
-      skip "verify need of these specs"
-
-      expect(token).to receive(:authorization)
-
-      post :create
-    end
-  end
-
-  describe "when authorization has failed" do
-    it "returns the error response" do
-      token = double(:token, authorize: false)
-      allow(controller).to receive(:token) { token }
-
-      post :create
-
-      expect(response.status).to eq 400
-      expect(response.headers["WWW-Authenticate"]).to match(/Bearer/)
-    end
-  end
-
-  describe "when there is a failure due to a custom error" do
-    it "returns the error response with a custom message" do
-      # I18n looks for `doorkeeper.errors.messages.custom_message` in locale files
-      custom_message = "my_message"
-      allow(I18n).to receive(:translate)
-        .with(
-          custom_message,
-          hash_including(scope: %i[doorkeeper errors messages])
-        )
-        .and_return("Authorization custom message")
-
-      doorkeeper_error = Doorkeeper::Errors::DoorkeeperError.new(custom_message)
-
-      strategy = double(:strategy)
-      request = double(token_request: strategy)
-      allow(strategy).to receive(:authorize).and_raise(doorkeeper_error)
-      allow(controller).to receive(:server).and_return(request)
-
-      post :create
-
-      expected_response_body = {
-        "error" => custom_message,
-        "error_description" => "Authorization custom message",
-      }
-      expect(response.status).to eq 400
-      expect(response.headers["WWW-Authenticate"]).to match(/Bearer/)
-      expect(JSON.parse(response.body)).to eq expected_response_body
-    end
-  end
-
-  # http://tools.ietf.org/html/rfc7009#section-2.2
-  describe "revoking tokens" do
-    let(:client) { FactoryBot.create(:application) }
-    let(:access_token) { FactoryBot.create(:access_token, application: client) }
-
-    context "when associated app is public" do
-      let(:client) { FactoryBot.create(:application, confidential: false) }
-
-      it "returns 200" do
-        post :revoke, params: { token: access_token.token }
-
-        expect(response.status).to eq 200
-      end
-
-      it "revokes the access token" do
-        post :revoke, params: { token: access_token.token }
-
-        expect(access_token.reload).to have_attributes(revoked?: true)
-      end
-    end
-
-    context "when associated app is confidential" do
-      let(:client) { FactoryBot.create(:application, confidential: true) }
-      let(:oauth_client) { Doorkeeper::OAuth::Client.new(client) }
-
-      before(:each) do
-        allow_any_instance_of(Doorkeeper::Server).to receive(:client) { oauth_client }
-      end
-
-      it "returns 200" do
-        post :revoke, params: { token: access_token.token }
-
-        expect(response.status).to eq 200
-      end
-
-      it "revokes the access token" do
-        post :revoke, params: { token: access_token.token }
-
-        expect(access_token.reload).to have_attributes(revoked?: true)
-      end
-
-      context "when authorization fails" do
-        let(:some_other_client) { FactoryBot.create(:application, confidential: true) }
-        let(:oauth_client) { Doorkeeper::OAuth::Client.new(some_other_client) }
-
-        it "returns 200" do
-          post :revoke, params: { token: access_token.token }
-
-          expect(response.status).to eq 200
-        end
-
-        it "does not revoke the access token" do
-          post :revoke, params: { token: access_token.token }
-
-          expect(access_token.reload).to have_attributes(revoked?: false)
-        end
-      end
-    end
-  end
-
-  describe "authorize response memoization" do
-    it "memoizes the result of the authorization" do
-      strategy = double(:strategy, authorize: true)
-      expect(strategy).to receive(:authorize).once
-      allow(controller).to receive(:strategy) { strategy }
-      allow(controller).to receive(:create) do
-        2.times { controller.send :authorize_response }
-        controller.render json: {}, status: :ok
-      end
-
-      post :create
-    end
-  end
-
-  describe "when requested token introspection" do
-    let(:client) { FactoryBot.create(:application) }
-    let(:access_token) { FactoryBot.create(:access_token, application: client) }
-    let(:token_for_introspection) { FactoryBot.create(:access_token, application: client) }
-
-    context "authorized using valid Bearer token" do
-      it "responds with full token introspection" do
-        request.headers["Authorization"] = "Bearer #{access_token.token}"
-
-        post :introspect, params: { token: token_for_introspection.token }
-
-        should_have_json "active", true
-        expect(json_response).to include("client_id", "token_type", "exp", "iat")
-      end
-    end
-
-    context "authorized using valid Client Authentication" do
-      it "responds with full token introspection" do
-        request.headers["Authorization"] = basic_auth_header_for_client(client)
-
-        post :introspect, params: { token: token_for_introspection.token }
-
-        should_have_json "active", true
-        expect(json_response).to include("client_id", "token_type", "exp", "iat")
-        should_have_json "client_id", client.uid
-      end
-    end
-
-    context "using custom introspection response" do
-      before do
-        Doorkeeper.configure do
-          orm DOORKEEPER_ORM
-          custom_introspection_response do |_token, _context|
-            {
-              sub: "Z5O3upPC88QrAjx00dis",
-              aud: "https://protected.example.net/resource",
-            }
-          end
-        end
-      end
-
-      it "responds with full token introspection" do
-        request.headers["Authorization"] = "Bearer #{access_token.token}"
-
-        post :introspect, params: { token: token_for_introspection.token }
-
-        expect(json_response).to include("client_id", "token_type", "exp", "iat", "sub", "aud")
-        should_have_json "sub", "Z5O3upPC88QrAjx00dis"
-        should_have_json "aud", "https://protected.example.net/resource"
-      end
-    end
-
-    context "public access token" do
-      let(:token_for_introspection) { FactoryBot.create(:access_token, application: nil) }
-
-      it "responds with full token introspection" do
-        request.headers["Authorization"] = basic_auth_header_for_client(client)
-
-        post :introspect, params: { token: token_for_introspection.token }
-
-        should_have_json "active", true
-        expect(json_response).to include("client_id", "token_type", "exp", "iat")
-        should_have_json "client_id", nil
-      end
-    end
-
-    context "token was issued to a different client than is making this request" do
-      let(:different_client) { FactoryBot.create(:application) }
-
-      it "responds with only active state" do
-        request.headers["Authorization"] = basic_auth_header_for_client(different_client)
-
-        post :introspect, params: { token: token_for_introspection.token }
-
-        expect(response).to be_successful
-
-        should_have_json "active", false
-        expect(json_response).not_to include("client_id", "token_type", "exp", "iat")
-      end
-    end
-
-    context "authorized using invalid Bearer token" do
-      let(:access_token) do
-        FactoryBot.create(:access_token, application: client, revoked_at: 1.day.ago)
-      end
-
-      it "responds with invalid token error" do
-        request.headers["Authorization"] = "Bearer #{access_token.token}"
-
-        post :introspect, params: { token: token_for_introspection.token }
-
-        response_status_should_be 401
-
-        should_not_have_json "active"
-        should_have_json "error", "invalid_token"
-      end
-    end
-
-    context "authorized using the Bearer token that need to be introspected" do
-      it "responds with invalid token error" do
-        request.headers["Authorization"] = "Bearer #{access_token.token}"
-
-        post :introspect, params: { token: access_token.token }
-
-        response_status_should_be 401
-
-        should_not_have_json "active"
-        should_have_json "error", "invalid_token"
-      end
-    end
-
-    context "using invalid credentials to authorize" do
-      let(:client) { double(uid: "123123", secret: "666999") }
-      let(:access_token) { FactoryBot.create(:access_token) }
-
-      it "responds with invalid_client error" do
-        request.headers["Authorization"] = basic_auth_header_for_client(client)
-
-        post :introspect, params: { token: access_token.token }
-
-        expect(response).not_to be_successful
-        response_status_should_be 401
-
-        should_not_have_json "active"
-        should_have_json "error", "invalid_client"
-      end
-    end
-
-    context "using wrong token value" do
-      context "authorized using client credentials" do
-        it "responds with only active state" do
-          request.headers["Authorization"] = basic_auth_header_for_client(client)
-
-          post :introspect, params: { token: SecureRandom.hex(16) }
-
-          should_have_json "active", false
-          expect(json_response).not_to include("client_id", "token_type", "exp", "iat")
-        end
-      end
-
-      context "authorized using valid Bearer token" do
-        it "responds with only active state" do
-          request.headers["Authorization"] = "Bearer #{access_token.token}"
-
-          post :introspect, params: { token: SecureRandom.hex(16) }
-
-          should_have_json "active", false
-          expect(json_response).not_to include("client_id", "token_type", "exp", "iat")
-        end
-      end
-    end
-
-    context "when requested access token expired" do
-      let(:token_for_introspection) do
-        FactoryBot.create(:access_token, application: client, created_at: 1.year.ago)
-      end
-
-      it "responds with only active state" do
-        request.headers["Authorization"] = basic_auth_header_for_client(client)
-
-        post :introspect, params: { token: token_for_introspection.token }
-
-        should_have_json "active", false
-        expect(json_response).not_to include("client_id", "token_type", "exp", "iat")
-      end
-    end
-
-    context "when requested Access Token revoked" do
-      let(:token_for_introspection) do
-        FactoryBot.create(:access_token, application: client, revoked_at: 1.year.ago)
-      end
-
-      it "responds with only active state" do
-        request.headers["Authorization"] = basic_auth_header_for_client(client)
-
-        post :introspect, params: { token: token_for_introspection.token }
-
-        should_have_json "active", false
-        expect(json_response).not_to include("client_id", "token_type", "exp", "iat")
-      end
-    end
-
-    context "unauthorized (no bearer token or client credentials)" do
-      let(:token_for_introspection) { FactoryBot.create(:access_token) }
-
-      it "responds with invalid_request error" do
-        post :introspect, params: { token: token_for_introspection.token }
-
-        expect(response).not_to be_successful
-        response_status_should_be 400
-
-        should_not_have_json "active"
-        should_have_json "error", "invalid_request"
-      end
-    end
-  end
-end

data/spec/dummy/Rakefile

@@ -1,9 +0,0 @@
-#!/usr/bin/env rake
-# frozen_string_literal: true
-
-# Add your own tasks in files placed in lib/tasks ending in .rake,
-# for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.
-
-require File.expand_path("config/application", __dir__)
-
-Dummy::Application.load_tasks

data/spec/dummy/app/assets/config/manifest.js

@@ -1,2 +0,0 @@
-// JS and CSS bundles
-//

data/spec/dummy/app/controllers/application_controller.rb

@@ -1,5 +0,0 @@
-# frozen_string_literal: true
-
-class ApplicationController < ActionController::Base
-  protect_from_forgery with: :exception
-end

data/spec/dummy/app/controllers/custom_authorizations_controller.rb

@@ -1,9 +0,0 @@
-# frozen_string_literal: true
-
-class CustomAuthorizationsController < ::ApplicationController
-  %w[index show new create edit update destroy].each do |action|
-    define_method action do
-      render nothing: true
-    end
-  end
-end

data/spec/dummy/app/controllers/full_protected_resources_controller.rb

@@ -1,14 +0,0 @@
-# frozen_string_literal: true
-
-class FullProtectedResourcesController < ApplicationController
-  before_action -> { doorkeeper_authorize! :write, :admin }, only: :show
-  before_action :doorkeeper_authorize!, only: :index
-
-  def index
-    render plain: "index"
-  end
-
-  def show
-    render plain: "show"
-  end
-end

data/spec/dummy/app/controllers/home_controller.rb

@@ -1,18 +0,0 @@
-# frozen_string_literal: true
-
-class HomeController < ApplicationController
-  def index; end
-
-  def sign_in
-    session[:user_id] = if Rails.env.development?
-                          User.first || User.create!(name: "Joe", password: "sekret")
-                        else
-                          User.first
-                        end
-    redirect_to "/"
-  end
-
-  def callback
-    render plain: "ok"
-  end
-end

data/spec/dummy/app/controllers/metal_controller.rb

@@ -1,13 +0,0 @@
-# frozen_string_literal: true
-
-class MetalController < ActionController::Metal
-  include AbstractController::Callbacks
-  include ActionController::Head
-  include Doorkeeper::Rails::Helpers
-
-  before_action :doorkeeper_authorize!
-
-  def index
-    self.response_body = { ok: true }.to_json
-  end
-end

data/spec/dummy/app/controllers/semi_protected_resources_controller.rb

@@ -1,13 +0,0 @@
-# frozen_string_literal: true
-
-class SemiProtectedResourcesController < ApplicationController
-  before_action :doorkeeper_authorize!, only: :index
-
-  def index
-    render plain: "protected index"
-  end
-
-  def show
-    render plain: "non protected show"
-  end
-end

data/spec/dummy/app/helpers/application_helper.rb

@@ -1,7 +0,0 @@
-# frozen_string_literal: true
-
-module ApplicationHelper
-  def current_user
-    @current_user ||= User.find_by_id(session[:user_id])
-  end
-end

data/spec/dummy/app/models/user.rb

@@ -1,7 +0,0 @@
-# frozen_string_literal: true
-
-class User < ActiveRecord::Base
-  def self.authenticate!(name, password)
-    User.where(name: name, password: password).first
-  end
-end

data/spec/dummy/app/views/layouts/application.html.erb

@@ -1,14 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <title>Dummy</title>
-  <%= csrf_meta_tags %>
-</head>
-<body>
-
-<%= link_to "Sign in", '/sign_in' %>
-
-<%= yield %>
-
-</body>
-</html>

data/spec/dummy/config/application.rb

@@ -1,47 +0,0 @@
-require File.expand_path('boot', __dir__)
-
-require "rails"
-
-%w[
-  action_controller/railtie
-  action_view/railtie
-  sprockets/railtie
-].each do |railtie|
-  begin
-    require railtie
-  rescue LoadError
-  end
-end
-
-Bundler.require(*Rails.groups)
-
-require 'yaml'
-
-orm = if DOORKEEPER_ORM =~ /mongoid/
-        Mongoid.load!(File.join(File.dirname(File.expand_path(__FILE__)), "#{DOORKEEPER_ORM}.yml"))
-        :mongoid
-      else
-        DOORKEEPER_ORM
-      end
-require "#{orm}/railtie"
-
-module Dummy
-  class Application < Rails::Application
-    if Rails.gem_version < Gem::Version.new('5.1')
-      config.action_controller.per_form_csrf_tokens = true
-      config.action_controller.forgery_protection_origin_check = true
-
-      ActiveSupport.to_time_preserves_timezone = true
-
-      config.active_record.belongs_to_required_by_default = true
-
-      config.ssl_options = { hsts: { subdomains: true } }
-    else
-      config.load_defaults "#{Rails::VERSION::MAJOR}.#{Rails::VERSION::MINOR}"
-    end
-
-    # Settings in config/environments/* take precedence over those specified here.
-    # Application configuration should go into files in config/initializers
-    # -- all .rb files in that directory are automatically loaded.
-  end
-end

data/spec/dummy/config/boot.rb

@@ -1,7 +0,0 @@
-require 'rubygems'
-require 'bundler/setup'
-
-orm = ENV['BUNDLE_GEMFILE'].match(/Gemfile\.(.+)\.rb/)
-DOORKEEPER_ORM = (orm && orm[1]) || :active_record unless defined?(DOORKEEPER_ORM)
-
-$LOAD_PATH.unshift File.expand_path('../../../lib', __dir__)

data/spec/dummy/config/database.yml

@@ -1,15 +0,0 @@
-development:
-  adapter: sqlite3
-  database: db/development.sqlite3
-  pool: 5
-  timeout: 5000
-
-test:
-  adapter: sqlite3
-  database: ":memory:"
-  timeout: 500
-
-production:
-  adapter: sqlite3
-  database: ":memory:"
-  timeout: 500

data/spec/dummy/config/environment.rb

@@ -1,5 +0,0 @@
-# Load the rails application
-require File.expand_path('application', __dir__)
-
-# Initialize the rails application
-Rails.application.initialize!

data/spec/dummy/config/environments/development.rb

@@ -1,31 +0,0 @@
-# frozen_string_literal: true
-
-Dummy::Application.configure do
-  # Settings specified here will take precedence over those in config/application.rb
-
-  # In the development environment your application's code is reloaded on
-  # every request.  This slows down response time but is perfect for development
-  # since you don't have to restart the web server when you make code changes.
-  config.cache_classes = false
-
-  # Show full error reports and disable caching
-  config.consider_all_requests_local       = true
-  config.action_controller.perform_caching = false
-
-  # Don't care if the mailer can't send
-  # config.action_mailer.raise_delivery_errors = false
-
-  # Print deprecation notices to the Rails logger
-  config.active_support.deprecation = :log
-
-  # Only use best-standards-support built into browsers
-  config.action_dispatch.best_standards_support = :builtin
-
-  # Do not compress assets
-  config.assets.compress = false
-
-  # Expands the lines which load the assets
-  config.assets.debug = true
-
-  config.eager_load = false
-end

data/spec/dummy/config/environments/production.rb

@@ -1,64 +0,0 @@
-# frozen_string_literal: true
-
-Dummy::Application.configure do
-  # Settings specified here will take precedence over those in config/application.rb
-
-  # Code is not reloaded between requests
-  config.cache_classes = true
-
-  # Full error reports are disabled and caching is turned on
-  config.consider_all_requests_local       = false
-  config.action_controller.perform_caching = true
-
-  # Disable Rails's static asset server (Apache or nginx will already do this)
-  config.serve_static_assets = false
-
-  # Compress JavaScripts and CSS
-  config.assets.compress = true
-
-  # Don't fallback to assets pipeline if a precompiled asset is missed
-  config.assets.compile = false
-
-  # Generate digests for assets URLs
-  config.assets.digest = true
-
-  # Defaults to Rails.root.join("public/assets")
-  # config.assets.manifest = YOUR_PATH
-
-  # Specifies the header that your server uses for sending files
-  # config.action_dispatch.x_sendfile_header = "X-Sendfile" # for apache
-  # config.action_dispatch.x_sendfile_header = 'X-Accel-Redirect' # for nginx
-
-  # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
-  # config.force_ssl = true
-
-  # See everything in the log (default is :info)
-  # config.log_level = :debug
-
-  # Use a different logger for distributed setups
-  # config.logger = SyslogLogger.new
-
-  # Use a different cache store in production
-  # config.cache_store = :mem_cache_store
-
-  # Enable serving of images, stylesheets, and JavaScripts from an asset server
-  # config.action_controller.asset_host = "http://assets.example.com"
-
-  # Precompile additional assets (application.js, application.css, and all non-JS/CSS are already added)
-  # config.assets.precompile += %w( search.js )
-
-  # Disable delivery errors, bad email addresses will be ignored
-  # config.action_mailer.raise_delivery_errors = false
-
-  # Enable threaded mode
-  # config.threadsafe!
-
-  # Enable locale fallbacks for I18n (makes lookups for any locale fall back to
-  # the I18n.default_locale when a translation can not be found)
-  config.i18n.fallbacks = true
-
-  # Send deprecation notices to registered listeners
-  config.active_support.deprecation = :notify
-
-  config.eager_load = true
-end

data/spec/dummy/config/environments/test.rb

@@ -1,45 +0,0 @@
-# frozen_string_literal: true
-
-Dummy::Application.configure do
-  # Settings specified here will take precedence over those in config/application.rb
-
-  # The test environment is used exclusively to run your application's
-  # test suite.  You never need to work with it otherwise.  Remember that
-  # your test database is "scratch space" for the test suite and is wiped
-  # and recreated between test runs.  Don't rely on the data there!
-  config.cache_classes = true
-
-  config.assets.enabled = true
-  config.assets.version = "1.0"
-  config.assets.digest = false
-
-  # Do not eager load code on boot. This avoids loading your whole application
-  # just for the purpose of running a single test. If you are using a tool that
-  # preloads Rails for running tests, you may have to set it to true.
-  config.eager_load = false
-
-  # Show full error reports and disable caching
-  config.consider_all_requests_local       = true
-  config.action_controller.perform_caching = false
-
-  # Raise exceptions instead of rendering exception templates
-  config.action_dispatch.show_exceptions = false
-
-  # Disable request forgery protection in test environment
-  config.action_controller.allow_forgery_protection = false
-
-  # Tell Action Mailer not to deliver emails to the real world.
-  # The :test delivery method accumulates sent emails in the
-  # ActionMailer::Base.deliveries array.
-  # config.action_mailer.delivery_method = :test
-
-  # Use SQL instead of Active Record's schema dumper when creating the test database.
-  # This is necessary if your schema can't be completely dumped by the schema dumper,
-  # like if you have constraints or database-specific column types
-  # config.active_record.schema_format = :sql
-
-  # Print deprecation notices to the stderr
-  config.active_support.deprecation = :stderr
-
-  config.eager_load = true
-end