doorkeeper 5.1.2 → 5.2.0.rc1

data/lib/generators/doorkeeper/templates/migration.rb.erb

@@ -36,6 +36,9 @@ class CreateDoorkeeperTables < ActiveRecord::Migration<%= migration_version %>
 
     create_table :oauth_access_tokens do |t|
       t.references :resource_owner, index: true
+
+      # Remove `null: false` if you are planning to use Password
+      # Credentials Grant flow that doesn't require an application.
       t.references :application,    null: false
 
       # If you use a custom token generator you may need to change this column

data/spec/controllers/applications_controller_spec.rb

@@ -26,6 +26,10 @@ module Doorkeeper
 
         expect(json_response).to include("id", "name", "uid", "secret", "redirect_uri", "scopes")
 
+        application = Application.last
+        secret_from_response = json_response["secret"]
+        expect(application.secret_matches?(secret_from_response)).to be_truthy
+
         expect(json_response["name"]).to eq("Example")
         expect(json_response["redirect_uri"]).to eq("https://example.com")
       end
@@ -44,6 +48,21 @@ module Doorkeeper
         expect(json_response).to include("errors")
       end
 
+      it "returns validations on wrong create params (unspecified scheme)" do
+        expect do
+          post :create, params: {
+            doorkeeper_application: {
+              name: "Example",
+              redirect_uri: "app.com:80",
+            }, format: :json,
+          }
+        end.not_to(change { Doorkeeper::Application.count })
+
+        expect(response).to have_http_status(422)
+
+        expect(json_response).to include("errors")
+      end
+
       it "returns application info" do
         application = FactoryBot.create(:application, name: "Change me")
 
@@ -121,6 +140,72 @@ module Doorkeeper
     end
 
     context "when admin is authenticated" do
+      context "when application secrets are hashed" do
+        before do
+          allow(Doorkeeper.configuration).to receive(:application_secret_strategy).and_return(Doorkeeper::SecretStoring::Sha256Hash)
+        end
+
+        it "shows the application secret after creating a new application" do
+          expect do
+            post :create, params: {
+              doorkeeper_application: {
+                name: "Example",
+                redirect_uri: "https://example.com",
+              },
+            }
+          end.to change { Doorkeeper::Application.count }.by(1)
+
+          application = Application.last
+
+          secret_from_flash = flash[:application_secret]
+          expect(secret_from_flash).not_to be_empty
+          expect(application.secret_matches?(secret_from_flash)).to be_truthy
+          expect(response).to redirect_to(controller.main_app.oauth_application_url(application.id))
+
+          get :show, params: { id: application.id, format: :html }
+
+          # We don't know the application secret here (because its hashed) so we can not assert its text on the page
+          # Instead, we read it from the page and then check if it matches the application secret
+          code_element = %r{<code.*id="secret".*>(.*)<\/code>}.match(response.body)
+          secret_from_page = code_element[1]
+
+          expect(response.body).to have_selector("code#application_id", text: application.uid)
+          expect(response.body).to have_selector("code#secret")
+          expect(secret_from_page).not_to be_empty
+          expect(application.secret_matches?(secret_from_page)).to be_truthy
+        end
+
+        it "does not show an application secret when application did already exist" do
+          application = FactoryBot.create(:application)
+          get :show, params: { id: application.id, format: :html }
+
+          expect(response.body).to have_selector("code#application_id", text: application.uid)
+          expect(response.body).to have_selector("code#secret", text: "")
+        end
+
+        it "returns the application details in a json response" do
+          expect do
+            post :create, params: {
+              doorkeeper_application: {
+                name: "Example",
+                redirect_uri: "https://example.com",
+              }, format: :json,
+            }
+          end.to(change { Doorkeeper::Application.count })
+
+          expect(response).to be_successful
+
+          expect(json_response).to include("id", "name", "uid", "secret", "redirect_uri", "scopes")
+
+          application = Application.last
+          secret_from_response = json_response["secret"]
+          expect(application.secret_matches?(secret_from_response)).to be_truthy
+
+          expect(json_response["name"]).to eq("Example")
+          expect(json_response["redirect_uri"]).to eq("https://example.com")
+        end
+      end
+
       render_views
 
       before do
@@ -151,6 +236,14 @@ module Doorkeeper
         expect(response).to be_redirect
       end
 
+      it "shows application details" do
+        application = FactoryBot.create(:application)
+        get :show, params: { id: application.id, format: :html }
+
+        expect(response.body).to have_selector("code#application_id", text: application.uid)
+        expect(response.body).to have_selector("code#secret", text: application.plaintext_secret)
+      end
+
       it "does not allow mass assignment of uid or secret" do
         application = FactoryBot.create(:application)
         put :update, params: {

data/spec/controllers/protected_resources_controller_spec.rb

@@ -166,7 +166,7 @@ describe "doorkeeper authorize filter" do
       it "it renders a custom JSON response", token: :invalid do
         get :index, params: { access_token: token_string }
         expect(response.status).to eq 401
-        expect(response.content_type).to match(/application\/json/)
+        expect(response.content_type).to eq("application/json")
         expect(response.header["WWW-Authenticate"]).to match(/^Bearer/)
 
         expect(json_response).not_to be_nil
@@ -196,7 +196,7 @@ describe "doorkeeper authorize filter" do
       it "it renders a custom text response", token: :invalid do
         get :index, params: { access_token: token_string }
         expect(response.status).to eq 401
-        expect(response.content_type).to match(/text\/plain/)
+        expect(response.content_type).to eq("text/plain")
         expect(response.header["WWW-Authenticate"]).to match(/^Bearer/)
         expect(response.body).to eq("Unauthorized")
       end
@@ -246,7 +246,7 @@ describe "doorkeeper authorize filter" do
       it "renders a custom JSON response" do
         get :index, params: { access_token: token_string }
         expect(response.header).to_not include("WWW-Authenticate")
-        expect(response.content_type).to match(/application\/json/)
+        expect(response.content_type).to eq("application/json")
         expect(response.status).to eq 403
 
         expect(json_response).not_to be_nil

data/spec/controllers/tokens_controller_spec.rb

@@ -102,10 +102,10 @@ describe Doorkeeper::TokensController do
         let(:some_other_client) { FactoryBot.create(:application, confidential: true) }
         let(:oauth_client) { Doorkeeper::OAuth::Client.new(some_other_client) }
 
-        it "returns 200" do
+        it "returns 403" do
           post :revoke, params: { token: access_token.token }
 
-          expect(response.status).to eq 200
+          expect(response.status).to eq 403
         end
 
         it "does not revoke the access token" do
@@ -147,7 +147,7 @@ describe Doorkeeper::TokensController do
       end
     end
 
-    context "authorized using valid Client Authentication" do
+    context "authorized using Client Credentials of the client that token is issued to" do
       it "responds with full token introspection" do
         request.headers["Authorization"] = basic_auth_header_for_client(client)
 
@@ -159,6 +159,24 @@ describe Doorkeeper::TokensController do
       end
     end
 
+    context "configured token introspection disabled" do
+      before do
+        Doorkeeper.configure do
+          orm DOORKEEPER_ORM
+          allow_token_introspection false
+        end
+      end
+
+      it "responds with just active: false response" do
+        request.headers["Authorization"] = "Bearer #{access_token.token}"
+
+        post :introspect, params: { token: token_for_introspection.token }
+
+        should_have_json "active", false
+        expect(json_response).not_to include("client_id", "token_type", "exp", "iat")
+      end
+    end
+
     context "using custom introspection response" do
       before do
         Doorkeeper.configure do
@@ -212,6 +230,56 @@ describe Doorkeeper::TokensController do
       end
     end
 
+    context "introspection request authorized by a client and allow_token_introspection is true" do
+      let(:different_client) { FactoryBot.create(:application) }
+
+      before do
+        allow(Doorkeeper.configuration).to receive(:allow_token_introspection).and_return(proc do
+          true
+        end)
+      end
+
+      it "responds with full token introspection" do
+        request.headers["Authorization"] = basic_auth_header_for_client(different_client)
+
+        post :introspect, params: { token: token_for_introspection.token }
+
+        should_have_json "active", true
+        expect(json_response).to include("client_id", "token_type", "exp", "iat")
+        should_have_json "client_id", client.uid
+      end
+    end
+
+    context "allow_token_introspection requires authorized token with special scope" do
+      let(:access_token) { FactoryBot.create(:access_token, scopes: "introspection") }
+
+      before do
+        allow(Doorkeeper.configuration).to receive(:allow_token_introspection).and_return(proc do |_token, _client, authorized_token|
+          authorized_token.scopes.include?("introspection")
+        end)
+      end
+
+      it "responds with full token introspection if authorized token has introspection scope" do
+        request.headers["Authorization"] = "Bearer #{access_token.token}"
+
+        post :introspect, params: { token: token_for_introspection.token }
+
+        should_have_json "active", true
+        expect(json_response).to include("client_id", "token_type", "exp", "iat")
+      end
+
+      it "responds with just active status if authorized token doesn't have introspection scope" do
+        access_token.update(scopes: "read write")
+
+        request.headers["Authorization"] = "Bearer #{access_token.token}"
+
+        post :introspect, params: { token: token_for_introspection.token }
+
+        should_have_json "active", false
+        expect(json_response).not_to include("client_id", "token_type", "exp", "iat")
+      end
+    end
+
     context "authorized using invalid Bearer token" do
       let(:access_token) do
         FactoryBot.create(:access_token, application: client, revoked_at: 1.day.ago)

data/spec/dummy/config/application.rb

@@ -5,11 +5,13 @@ require "rails"
 %w[
   action_controller/railtie
   action_view/railtie
+  action_cable/engine
   sprockets/railtie
 ].each do |railtie|
   begin
     require railtie
-  rescue LoadError
+  rescue LoadError => e
+    puts "Error loading '#{railtie}' (#{e.message})"
   end
 end
 

data/spec/dummy/config/initializers/doorkeeper.rb

@@ -65,15 +65,6 @@ Doorkeeper.configure do
   # Check out the wiki for more information on customization
   # access_token_methods :from_bearer_authorization, :from_access_token_param, :from_bearer_param
 
-  # Change the native redirect uri for client apps
-  # When clients register with the following redirect uri, they won't be redirected to any server and
-  # the authorization code will be displayed within the provider
-  # The value can be any string. Use nil to disable this feature.
-  # When disabled, clients must provide a valid URL
-  # (Similar behaviour: https://developers.google.com/accounts/docs/OAuth2InstalledApp#choosingredirecturi)
-  #
-  # native_redirect_uri 'urn:ietf:wg:oauth:2.0:oob'
-
   # Forces the usage of the HTTPS protocol in non-native redirect uris (enabled
   # by default in non-development environments). OAuth2 delegates security in
   # communication to the HTTPS protocol so it is wise to keep this enabled.
@@ -116,6 +107,33 @@ Doorkeeper.configure do
   #   client.superapp? or resource_owner.admin?
   # end
 
+  # Implement constraints in case you use Client Credentials to authenticate
+  # the introspection endpoint.
+  # By default allow introspection if the introspected token belongs to authorized client,
+  # OR token doesn't belong to any client (public token). Otherwise disallow.
+  #
+  # Params:
+  # `token` - the token to be introspected (see Doorkeeper::AccessToken)
+  # `client` - the client application authorized for the endpoint (see Doorkeeper::Application)
+  #
+  # You can completely ignore it:
+  # allow_token_introspection do |_token, _client|
+  #   false
+  # end
+  #
+  # Or you can define your custom check:
+  #   Adding `protected_resource` boolean column to applications table
+  #   to allow protected_resource client introspect the token of normal client.
+  #   In this case, protected resource client must be confidential.
+  #
+  # allow_token_introspection do |token, client|
+  #   if token.application
+  #     token.application == client || client.protected_resource?
+  #   else
+  #     true
+  #   end
+  # end
+
   # WWW-Authenticate Realm (default "Doorkeeper").
   realm "Doorkeeper"
 end

data/spec/lib/config_spec.rb

@@ -694,4 +694,15 @@ describe Doorkeeper, "configuration" do
       end
     end
   end
+
+  describe "options deprecation" do
+    it "prints a warning message when an option is deprecated" do
+      expect(Kernel).to receive(:warn).with(
+        "[DOORKEEPER] native_redirect_uri has been deprecated and will soon be removed"
+      )
+      Doorkeeper.configure do
+        native_redirect_uri "urn:ietf:wg:oauth:2.0:oob"
+      end
+    end
+  end
 end

data/spec/lib/oauth/helpers/uri_checker_spec.rb

@@ -40,13 +40,28 @@ module Doorkeeper::OAuth::Helpers
         expect(URIChecker.valid?(uri)).to be_falsey
       end
 
+      it "is invalid if localhost is resolved as as scheme (no scheme specified)" do
+        uri = "localhost:8080"
+        expect(URIChecker.valid?(uri)).to be_falsey
+      end
+
+      it "is invalid if scheme is missing #2" do
+        uri = "app.co:80"
+        expect(URIChecker.valid?(uri)).to be_falsey
+      end
+
       it "is invalid if is not an uri" do
         uri = "   "
         expect(URIChecker.valid?(uri)).to be_falsey
       end
 
-      it "is valid for native uris" do
-        uri = "urn:ietf:wg:oauth:2.0:oob"
+      it "is valid for custom schemes" do
+        uri = "com.example.app:/test"
+        expect(URIChecker.valid?(uri)).to be_truthy
+      end
+
+      it "is valid for custom schemes with authority marker (common misconfiguration)" do
+        uri = "com.example.app://test"
         expect(URIChecker.valid?(uri)).to be_truthy
       end
     end

data/spec/lib/oauth/pre_authorization_spec.rb

@@ -149,21 +149,6 @@ module Doorkeeper::OAuth
       expect(subject.scopes).to eq(Scopes.from_string("default"))
     end
 
-    context "with native redirect uri" do
-      let(:native_redirect_uri) { "urn:ietf:wg:oauth:2.0:oob" }
-
-      it "accepts redirect_uri when it matches with the client" do
-        subject.redirect_uri = native_redirect_uri
-        allow(subject.client).to receive(:redirect_uri) { native_redirect_uri }
-        expect(subject).to be_authorizable
-      end
-
-      it "invalidates redirect_uri when it does'n match with the client" do
-        subject.redirect_uri = "urn:ietf:wg:oauth:2.0:oob"
-        expect(subject).not_to be_authorizable
-      end
-    end
-
     it "matches the redirect uri against client's one" do
       subject.redirect_uri = "http://nothesame.com"
       expect(subject).not_to be_authorizable

data/spec/models/doorkeeper/application_spec.rb

@@ -3,469 +3,364 @@
 require "spec_helper"
 require "bcrypt"
 
-describe Doorkeeper::Application do
-  let(:require_owner) { Doorkeeper.configuration.instance_variable_set("@confirm_application_owner", true) }
-  let(:unset_require_owner) { Doorkeeper.configuration.instance_variable_set("@confirm_application_owner", false) }
-  let(:new_application) { FactoryBot.build(:application) }
+module Doorkeeper
+  describe Application do
+    let(:clazz) { Doorkeeper::Application }
+    let(:require_owner) { Doorkeeper.configuration.instance_variable_set("@confirm_application_owner", true) }
+    let(:unset_require_owner) { Doorkeeper.configuration.instance_variable_set("@confirm_application_owner", false) }
+    let(:new_application) { FactoryBot.build(:application) }
 
-  let(:uid) { SecureRandom.hex(8) }
-  let(:secret) { SecureRandom.hex(8) }
+    let(:uid) { SecureRandom.hex(8) }
+    let(:secret) { SecureRandom.hex(8) }
 
-  it "is invalid without a name" do
-    new_application.name = nil
-    expect(new_application).not_to be_valid
-  end
-
-  it "is invalid without determining confidentiality" do
-    new_application.confidential = nil
-    expect(new_application).not_to be_valid
-  end
-
-  it "generates uid on create" do
-    expect(new_application.uid).to be_nil
-    new_application.save
-    expect(new_application.uid).not_to be_nil
-  end
-
-  it "generates uid on create if an empty string" do
-    new_application.uid = ""
-    new_application.save
-    expect(new_application.uid).not_to be_blank
-  end
-
-  it "generates uid on create unless one is set" do
-    new_application.uid = uid
-    new_application.save
-    expect(new_application.uid).to eq(uid)
-  end
-
-  it "is invalid without uid" do
-    new_application.save
-    new_application.uid = nil
-    expect(new_application).not_to be_valid
-  end
-
-  it "checks uniqueness of uid" do
-    app1 = FactoryBot.create(:application)
-    app2 = FactoryBot.create(:application)
-    app2.uid = app1.uid
-    expect(app2).not_to be_valid
-  end
-
-  it "expects database to throw an error when uids are the same" do
-    app1 = FactoryBot.create(:application)
-    app2 = FactoryBot.create(:application)
-    app2.uid = app1.uid
-    expect { app2.save!(validate: false) }.to raise_error(uniqueness_error)
-  end
+    context "application_owner is enabled" do
+      before do
+        Doorkeeper.configure do
+          orm DOORKEEPER_ORM
+          enable_application_owner
+        end
+      end
 
-  it "generate secret on create" do
-    expect(new_application.secret).to be_nil
-    new_application.save
-    expect(new_application.secret).not_to be_nil
-  end
+      context "application owner is not required" do
+        before(:each) do
+          unset_require_owner
+        end
 
-  it "generate secret on create if is blank string" do
-    new_application.secret = ""
-    new_application.save
-    expect(new_application.secret).not_to be_blank
-  end
+        it "is valid given valid attributes" do
+          expect(new_application).to be_valid
+        end
+      end
 
-  it "generate secret on create unless one is set" do
-    new_application.secret = secret
-    new_application.save
-    expect(new_application.secret).to eq(secret)
-  end
+      context "application owner is required" do
+        before(:each) do
+          require_owner
+          @owner = FactoryBot.build_stubbed(:doorkeeper_testing_user)
+        end
 
-  it "is invalid without secret" do
-    new_application.save
-    new_application.secret = nil
-    expect(new_application).not_to be_valid
-  end
+        it "is invalid without an owner" do
+          expect(new_application).not_to be_valid
+        end
 
-  context "application_owner is enabled" do
-    before do
-      Doorkeeper.configure do
-        orm DOORKEEPER_ORM
-        enable_application_owner
+        it "is valid with an owner" do
+          new_application.owner = @owner
+          expect(new_application).to be_valid
+        end
       end
     end
 
-    context "application owner is not required" do
-      before(:each) do
-        unset_require_owner
-      end
-
-      it "is valid given valid attributes" do
-        expect(new_application).to be_valid
-      end
+    it "is invalid without a name" do
+      new_application.name = nil
+      expect(new_application).not_to be_valid
     end
 
-    context "application owner is required" do
-      before do
-        require_owner
-        @owner = FactoryBot.build_stubbed(:doorkeeper_testing_user)
-      end
+    it "is invalid without determining confidentiality" do
+      new_application.confidential = nil
+      expect(new_application).not_to be_valid
+    end
 
-      it "is invalid without an owner" do
-        expect(new_application).not_to be_valid
-      end
+    it "generates uid on create" do
+      expect(new_application.uid).to be_nil
+      new_application.save
+      expect(new_application.uid).not_to be_nil
+    end
 
-      it "is valid with an owner" do
-        new_application.owner = @owner
-        expect(new_application).to be_valid
-      end
+    it "generates uid on create if an empty string" do
+      new_application.uid = ""
+      new_application.save
+      expect(new_application.uid).not_to be_blank
     end
-  end
 
-  context "redirect URI" do
-    context "when grant flows allow blank redirect URI" do
-      before do
-        Doorkeeper.configure do
-          grant_flows %w[password client_credentials]
-        end
-      end
+    it "generates uid on create unless one is set" do
+      new_application.uid = uid
+      new_application.save
+      expect(new_application.uid).to eq(uid)
+    end
 
-      it "is valid without redirect_uri" do
-        new_application.save
-        new_application.redirect_uri = nil
-        expect(new_application).to be_valid
-      end
+    it "is invalid without uid" do
+      new_application.save
+      new_application.uid = nil
+      expect(new_application).not_to be_valid
     end
 
-    context "when grant flows require redirect URI" do
-      before do
-        Doorkeeper.configure do
-          grant_flows %w[password client_credentials authorization_code]
+    context "redirect URI" do
+      context "when grant flows allow blank redirect URI" do
+        before do
+          Doorkeeper.configure do
+            grant_flows %w[password client_credentials]
+          end
         end
-      end
 
-      it "is invalid without redirect_uri" do
-        new_application.save
-        new_application.redirect_uri = nil
-        expect(new_application).not_to be_valid
+        it "is valid without redirect_uri" do
+          new_application.save
+          new_application.redirect_uri = nil
+          expect(new_application).to be_valid
+        end
       end
-    end
 
-    context "when blank URI option disabled" do
-      before do
-        Doorkeeper.configure do
-          grant_flows %w[password client_credentials]
-          allow_blank_redirect_uri false
+      context "when grant flows require redirect URI" do
+        before do
+          Doorkeeper.configure do
+            grant_flows %w[password client_credentials authorization_code]
+          end
         end
-      end
 
-      it "is invalid without redirect_uri" do
-        new_application.save
-        new_application.redirect_uri = nil
-        expect(new_application).not_to be_valid
+        it "is invalid without redirect_uri" do
+          new_application.save
+          new_application.redirect_uri = nil
+          expect(new_application).not_to be_valid
+        end
       end
-    end
-  end
-
-  context "with hashing enabled" do
-    include_context "with application hashing enabled"
-    let(:app) { FactoryBot.create :application }
-    let(:default_strategy) { Doorkeeper::SecretStoring::Sha256Hash }
-
-    it "uses SHA256 to avoid additional dependencies" do
-      # Ensure token was generated
-      app.validate
-      expect(app.secret).to eq(default_strategy.transform_secret(app.plaintext_secret))
-    end
 
-    context "when bcrypt strategy is configured" do
-      # In this text context, we have bcrypt loaded so `bcrypt_present?`
-      # will always be true
-      before do
-        Doorkeeper.configure do
-          hash_application_secrets using: "Doorkeeper::SecretStoring::BCrypt"
+      context "when blank URI option disabled" do
+        before do
+          Doorkeeper.configure do
+            grant_flows %w[password client_credentials]
+            allow_blank_redirect_uri false
+          end
         end
-      end
 
-      it "holds a volatile plaintext and BCrypt secret" do
-        expect(app.secret_strategy).to eq Doorkeeper::SecretStoring::BCrypt
-        expect(app.plaintext_secret).to be_a(String)
-        expect(app.secret).not_to eq(app.plaintext_secret)
-        expect { ::BCrypt::Password.create(app.secret) }.not_to raise_error
+        it "is invalid without redirect_uri" do
+          new_application.save
+          new_application.redirect_uri = nil
+          expect(new_application).not_to be_valid
+        end
       end
     end
 
-    it "does not fallback to plain lookup by default" do
-      lookup = described_class.by_uid_and_secret(app.uid, app.secret)
-      expect(lookup).to eq(nil)
-
-      lookup = described_class.by_uid_and_secret(app.uid, app.plaintext_secret)
-      expect(lookup).to eq(app)
+    it "checks uniqueness of uid" do
+      app1 = FactoryBot.create(:application)
+      app2 = FactoryBot.create(:application)
+      app2.uid = app1.uid
+      expect(app2).not_to be_valid
     end
 
-    context "with fallback enabled" do
-      include_context "with token hashing and fallback lookup enabled"
-
-      it "provides plain and hashed lookup" do
-        lookup = described_class.by_uid_and_secret(app.uid, app.secret)
-        expect(lookup).to eq(app)
-
-        lookup = described_class.by_uid_and_secret(app.uid, app.plaintext_secret)
-        expect(lookup).to eq(app)
-      end
+    it "expects database to throw an error when uids are the same" do
+      app1 = FactoryBot.create(:application)
+      app2 = FactoryBot.create(:application)
+      app2.uid = app1.uid
+      expect { app2.save!(validate: false) }.to raise_error(uniqueness_error)
     end
 
-    it "does not provide access to secret after loading" do
-      lookup = described_class.by_uid_and_secret(app.uid, app.plaintext_secret)
-      expect(lookup.plaintext_secret).to be_nil
+    it "generate secret on create" do
+      expect(new_application.secret).to be_nil
+      new_application.save
+      expect(new_application.secret).not_to be_nil
     end
-  end
 
-  describe "destroy related models on cascade" do
-    before(:each) do
+    it "generate secret on create if is blank string" do
+      new_application.secret = ""
       new_application.save
+      expect(new_application.secret).not_to be_blank
     end
 
-    let(:resource_owner) { FactoryBot.create(:doorkeeper_testing_user) }
-
-    it "should destroy its access grants" do
-      FactoryBot.create(
-        :access_grant,
-        application: new_application,
-        resource_owner_id: resource_owner.id,
-      )
-
-      expect { new_application.destroy }.to change { Doorkeeper::AccessGrant.count }.by(-1)
+    it "generate secret on create unless one is set" do
+      new_application.secret = secret
+      new_application.save
+      expect(new_application.secret).to eq(secret)
     end
 
-    it "should destroy its access tokens" do
-      FactoryBot.create(:access_token, application: new_application)
-      FactoryBot.create(:access_token, application: new_application, revoked_at: Time.now.utc)
-      expect do
-        new_application.destroy
-      end.to change { Doorkeeper::AccessToken.count }.by(-2)
+    it "is invalid without secret" do
+      new_application.save
+      new_application.secret = nil
+      expect(new_application).not_to be_valid
     end
-  end
 
-  describe "#ordered_by" do
-    let(:applications) { FactoryBot.create_list(:application, 5) }
+    context "with hashing enabled" do
+      include_context "with application hashing enabled"
+      let(:app) { FactoryBot.create :application }
+      let(:default_strategy) { Doorkeeper::SecretStoring::Sha256Hash }
 
-    context "when a direction is not specified" do
-      it "calls order with a default order of asc" do
-        names = applications.map(&:name).sort
-        expect(described_class.ordered_by(:name).map(&:name)).to eq(names)
+      it "uses SHA256 to avoid additional dependencies" do
+        # Ensure token was generated
+        app.validate
+        expect(app.secret).to eq(default_strategy.transform_secret(app.plaintext_secret))
       end
-    end
 
-    context "when a direction is specified" do
-      it "calls order with specified direction" do
-        names = applications.map(&:name).sort.reverse
-        expect(described_class.ordered_by(:name, :desc).map(&:name)).to eq(names)
-      end
-    end
-  end
+      context "when bcrypt strategy is configured" do
+        # In this text context, we have bcrypt loaded so `bcrypt_present?`
+        # will always be true
+        before do
+          Doorkeeper.configure do
+            hash_application_secrets using: "Doorkeeper::SecretStoring::BCrypt"
+          end
+        end
 
-  describe "#redirect_uri=" do
-    context "when array of valid redirect_uris" do
-      it "should join by newline" do
-        new_application.redirect_uri = ["http://localhost/callback1", "http://localhost/callback2"]
-        expect(new_application.redirect_uri).to eq("http://localhost/callback1\nhttp://localhost/callback2")
-      end
-    end
-    context "when string of valid redirect_uris" do
-      it "should store as-is" do
-        new_application.redirect_uri = "http://localhost/callback1\nhttp://localhost/callback2"
-        expect(new_application.redirect_uri).to eq("http://localhost/callback1\nhttp://localhost/callback2")
+        it "holds a volatile plaintext and BCrypt secret" do
+          expect(app.secret_strategy).to eq Doorkeeper::SecretStoring::BCrypt
+          expect(app.plaintext_secret).to be_a(String)
+          expect(app.secret).not_to eq(app.plaintext_secret)
+          expect { ::BCrypt::Password.create(app.secret) }.not_to raise_error
+        end
       end
-    end
-  end
 
-  describe "#authorized_for" do
-    let(:resource_owner) { FactoryBot.create(:doorkeeper_testing_user) }
-    let(:other_resource_owner) { FactoryBot.create(:doorkeeper_testing_user) }
+      it "does not fallback to plain lookup by default" do
+        lookup = clazz.by_uid_and_secret(app.uid, app.secret)
+        expect(lookup).to eq(nil)
 
-    it "is empty if the application is not authorized for anyone" do
-      expect(described_class.authorized_for(resource_owner)).to be_empty
-    end
+        lookup = clazz.by_uid_and_secret(app.uid, app.plaintext_secret)
+        expect(lookup).to eq(app)
+      end
 
-    it "returns only application for a specific resource owner" do
-      FactoryBot.create(
-        :access_token,
-        resource_owner_id: other_resource_owner.id,
-      )
-      token = FactoryBot.create(
-        :access_token,
-        resource_owner_id: resource_owner.id,
-      )
-      expect(described_class.authorized_for(resource_owner)).to eq([token.application])
-    end
+      context "with fallback enabled" do
+        include_context "with token hashing and fallback lookup enabled"
 
-    it "excludes revoked tokens" do
-      FactoryBot.create(
-        :access_token,
-        resource_owner_id: resource_owner.id,
-        revoked_at: 2.days.ago,
-      )
-      expect(described_class.authorized_for(resource_owner)).to be_empty
-    end
+        it "provides plain and hashed lookup" do
+          lookup = clazz.by_uid_and_secret(app.uid, app.secret)
+          expect(lookup).to eq(app)
 
-    it "returns all applications that have been authorized" do
-      token1 = FactoryBot.create(
-        :access_token,
-        resource_owner_id: resource_owner.id,
-      )
-      token2 = FactoryBot.create(
-        :access_token,
-        resource_owner_id: resource_owner.id,
-      )
-      expect(described_class.authorized_for(resource_owner))
-        .to eq([token1.application, token2.application])
-    end
+          lookup = clazz.by_uid_and_secret(app.uid, app.plaintext_secret)
+          expect(lookup).to eq(app)
+        end
+      end
 
-    it "returns only one application even if it has been authorized twice" do
-      application = FactoryBot.create(:application)
-      FactoryBot.create(
-        :access_token,
-        resource_owner_id: resource_owner.id,
-        application: application,
-      )
-      FactoryBot.create(
-        :access_token,
-        resource_owner_id: resource_owner.id,
-        application: application,
-      )
-      expect(described_class.authorized_for(resource_owner)).to eq([application])
+      it "does not provide access to secret after loading" do
+        lookup = clazz.by_uid_and_secret(app.uid, app.plaintext_secret)
+        expect(lookup.plaintext_secret).to be_nil
+      end
     end
-  end
 
-  describe "#revoke_tokens_and_grants_for" do
-    it "revokes all access tokens and access grants" do
-      application_id = 42
-      resource_owner = double
-      expect(Doorkeeper::AccessToken)
-        .to receive(:revoke_all_for).with(application_id, resource_owner)
-      expect(Doorkeeper::AccessGrant)
-        .to receive(:revoke_all_for).with(application_id, resource_owner)
+    describe "destroy related models on cascade" do
+      before(:each) do
+        new_application.save
+      end
+
+      it "should destroy its access grants" do
+        FactoryBot.create(:access_grant, application: new_application)
+        expect { new_application.destroy }.to change { Doorkeeper::AccessGrant.count }.by(-1)
+      end
 
-      described_class.revoke_tokens_and_grants_for(application_id, resource_owner)
+      it "should destroy its access tokens" do
+        FactoryBot.create(:access_token, application: new_application)
+        FactoryBot.create(:access_token, application: new_application, revoked_at: Time.now.utc)
+        expect do
+          new_application.destroy
+        end.to change { Doorkeeper::AccessToken.count }.by(-2)
+      end
     end
-  end
 
-  describe "#by_uid_and_secret" do
-    context "when application is private/confidential" do
-      it "finds the application via uid/secret" do
-        app = FactoryBot.create :application
-        authenticated = described_class.by_uid_and_secret(app.uid, app.secret)
-        expect(authenticated).to eq(app)
+    describe :ordered_by do
+      let(:applications) { FactoryBot.create_list(:application, 5) }
+
+      context "when a direction is not specified" do
+        it "calls order with a default order of asc" do
+          names = applications.map(&:name).sort
+          expect(Application.ordered_by(:name).map(&:name)).to eq(names)
+        end
       end
-      context "when secret is wrong" do
-        it "should not find the application" do
-          app = FactoryBot.create :application
-          authenticated = described_class.by_uid_and_secret(app.uid, "bad")
-          expect(authenticated).to eq(nil)
+
+      context "when a direction is specified" do
+        it "calls order with specified direction" do
+          names = applications.map(&:name).sort.reverse
+          expect(Application.ordered_by(:name, :desc).map(&:name)).to eq(names)
         end
       end
     end
 
-    context "when application is public/non-confidential" do
-      context "when secret is blank" do
-        it "should find the application" do
-          app = FactoryBot.create :application, confidential: false
-          authenticated = described_class.by_uid_and_secret(app.uid, nil)
-          expect(authenticated).to eq(app)
+    describe "#redirect_uri=" do
+      context "when array of valid redirect_uris" do
+        it "should join by newline" do
+          new_application.redirect_uri = ["http://localhost/callback1", "http://localhost/callback2"]
+          expect(new_application.redirect_uri).to eq("http://localhost/callback1\nhttp://localhost/callback2")
         end
       end
-      context "when secret is wrong" do
-        it "should not find the application" do
-          app = FactoryBot.create :application, confidential: false
-          authenticated = described_class.by_uid_and_secret(app.uid, "bad")
-          expect(authenticated).to eq(nil)
+      context "when string of valid redirect_uris" do
+        it "should store as-is" do
+          new_application.redirect_uri = "http://localhost/callback1\nhttp://localhost/callback2"
+          expect(new_application.redirect_uri).to eq("http://localhost/callback1\nhttp://localhost/callback2")
         end
       end
     end
-  end
-
-  describe "#confidential?" do
-    subject { FactoryBot.create(:application, confidential: confidential).confidential? }
-
-    context "when application is private/confidential" do
-      let(:confidential) { true }
-      it { expect(subject).to eq(true) }
-    end
-
-    context "when application is public/non-confidential" do
-      let(:confidential) { false }
-      it { expect(subject).to eq(false) }
-    end
-  end
 
-  describe "#as_json" do
-    let(:app) { FactoryBot.create :application, secret: "123123123" }
+    describe :authorized_for do
+      let(:resource_owner) { double(:resource_owner, id: 10) }
 
-    before do
-      allow(Doorkeeper.configuration)
-        .to receive(:application_secret_strategy).and_return(Doorkeeper::SecretStoring::Plain)
-    end
+      it "is empty if the application is not authorized for anyone" do
+        expect(Application.authorized_for(resource_owner)).to be_empty
+      end
 
-    # AR specific feature
-    if DOORKEEPER_ORM == :active_record
-      it "correctly works with #to_json" do
-        ActiveRecord::Base.include_root_in_json = true
-        expect(app.to_json(include_root_in_json: true)).to match(/application.+?:\{/)
-        ActiveRecord::Base.include_root_in_json = false
+      it "returns only application for a specific resource owner" do
+        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id + 1)
+        token = FactoryBot.create(:access_token, resource_owner_id: resource_owner.id)
+        expect(Application.authorized_for(resource_owner)).to eq([token.application])
       end
-    end
 
-    context "when called without authorized resource owner" do
-      it "includes minimal set of attributes" do
-        expect(app.as_json).to match(
-          "id" => app.id,
-          "name" => app.name,
-          "created_at" => an_instance_of(String),
-        )
+      it "excludes revoked tokens" do
+        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id, revoked_at: 2.days.ago)
+        expect(Application.authorized_for(resource_owner)).to be_empty
       end
 
-      it "includes application UID if it's public" do
-        app = FactoryBot.create :application, secret: "123123123", confidential: false
+      it "returns all applications that have been authorized" do
+        token1 = FactoryBot.create(:access_token, resource_owner_id: resource_owner.id)
+        token2 = FactoryBot.create(:access_token, resource_owner_id: resource_owner.id)
+        expect(Application.authorized_for(resource_owner)).to eq([token1.application, token2.application])
+      end
 
-        expect(app.as_json).to match(
-          "id" => app.id,
-          "name" => app.name,
-          "created_at" => an_instance_of(String),
-          "uid" => app.uid,
-        )
+      it "returns only one application even if it has been authorized twice" do
+        application = FactoryBot.create(:application)
+        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id, application: application)
+        FactoryBot.create(:access_token, resource_owner_id: resource_owner.id, application: application)
+        expect(Application.authorized_for(resource_owner)).to eq([application])
       end
+    end
 
-      it "respects custom options" do
-        expect(app.as_json(except: :id)).not_to include("id")
-        expect(app.as_json(only: %i[name created_at secret]))
-          .to match(
-            "name" => app.name,
-            "created_at" => an_instance_of(String),
-          )
+    describe :revoke_tokens_and_grants_for do
+      it "revokes all access tokens and access grants" do
+        application_id = 42
+        resource_owner = double
+        expect(Doorkeeper::AccessToken)
+          .to receive(:revoke_all_for).with(application_id, resource_owner)
+        expect(Doorkeeper::AccessGrant)
+          .to receive(:revoke_all_for).with(application_id, resource_owner)
+
+        Application.revoke_tokens_and_grants_for(application_id, resource_owner)
       end
     end
 
-    context "when called with authorized resource owner" do
-      let(:owner) { FactoryBot.create(:doorkeeper_testing_user) }
-      let(:other_owner) { FactoryBot.create(:doorkeeper_testing_user) }
-      let(:app) { FactoryBot.create(:application, secret: "123123123", owner: owner) }
+    describe :by_uid_and_secret do
+      context "when application is private/confidential" do
+        it "finds the application via uid/secret" do
+          app = FactoryBot.create :application
+          authenticated = Application.by_uid_and_secret(app.uid, app.secret)
+          expect(authenticated).to eq(app)
+        end
+        context "when secret is wrong" do
+          it "should not find the application" do
+            app = FactoryBot.create :application
+            authenticated = Application.by_uid_and_secret(app.uid, "bad")
+            expect(authenticated).to eq(nil)
+          end
+        end
+      end
 
-      before do
-        Doorkeeper.configure do
-          orm DOORKEEPER_ORM
-          enable_application_owner confirmation: false
+      context "when application is public/non-confidential" do
+        context "when secret is blank" do
+          it "should find the application" do
+            app = FactoryBot.create :application, confidential: false
+            authenticated = Application.by_uid_and_secret(app.uid, nil)
+            expect(authenticated).to eq(app)
+          end
+        end
+        context "when secret is wrong" do
+          it "should not find the application" do
+            app = FactoryBot.create :application, confidential: false
+            authenticated = Application.by_uid_and_secret(app.uid, "bad")
+            expect(authenticated).to eq(nil)
+          end
         end
       end
+    end
+
+    describe :confidential? do
+      subject { FactoryBot.create(:application, confidential: confidential).confidential? }
 
-      it "includes all the attributes" do
-        expect(app.as_json(current_resource_owner: owner))
-          .to include(
-            "secret" => "123123123",
-            "redirect_uri" => app.redirect_uri,
-            "uid" => app.uid,
-          )
+      context "when application is private/confidential" do
+        let(:confidential) { true }
+        it { expect(subject).to eq(true) }
       end
 
-      it "doesn't include unsafe attributes if current owner isn't the same as owner" do
-        expect(app.as_json(current_resource_owner: other_owner))
-          .not_to include("redirect_uri")
+      context "when application is public/non-confidential" do
+        let(:confidential) { false }
+        it { expect(subject).to eq(false) }
       end
     end
   end