doorkeeper 5.1.2 → 5.2.6

data/spec/controllers/authorizations_controller_spec.rb

@@ -14,23 +14,23 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
     end
   end
 
-  def translated_error_message(key)
-    I18n.translate key, scope: %i[doorkeeper errors messages]
-  end
-
   let(:client)        { FactoryBot.create :application }
   let(:user)          { User.create!(name: "Joe", password: "sekret") }
-  let(:access_token)  { FactoryBot.build :access_token, resource_owner_id: user.id, application_id: client.id }
+  let(:access_token)  { FactoryBot.build :access_token, resource_owner_id: user.id, application_id: client.id, scopes: "default" }
 
   before do
     Doorkeeper.configure do
+      default_scopes :default
+
       custom_access_token_expires_in(lambda do |context|
         context.grant_type == Doorkeeper::OAuth::IMPLICIT ? 1234 : nil
       end)
     end
 
     allow(Doorkeeper.configuration).to receive(:grant_flows).and_return(["implicit"])
-    allow(controller).to receive(:current_resource_owner).and_return(user)
+    allow(Doorkeeper.configuration).to receive(:authenticate_resource_owner).and_return(->(_) { authenticator_method })
+    allow(controller).to receive(:authenticator_method).and_return(user)
+    expect(controller).to receive(:authenticator_method).at_most(:once)
   end
 
   describe "POST #create" do
@@ -106,80 +106,146 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
   end
 
   describe "POST #create with errors" do
-    before do
-      default_scopes_exist :public
+    context "when missing client_id" do
+      before do
+        post :create, params: {
+          client_id: "",
+          response_type: "token",
+          redirect_uri: client.redirect_uri,
+        }
+      end
 
-      post :create, params: {
-        client_id: client.uid,
-        response_type: "token",
-        scope: "invalid",
-        redirect_uri: client.redirect_uri,
-      }
-    end
+      let(:response_json_body) { JSON.parse(response.body) }
 
-    it "redirects after authorization" do
-      expect(response).to be_redirect
-    end
+      it "renders 400 error" do
+        expect(response.status).to eq 400
+      end
 
-    it "redirects to client redirect uri" do
-      expect(response.location).to match(/^#{client.redirect_uri}/)
-    end
+      it "includes error name" do
+        expect(response_json_body["error"]).to eq("invalid_request")
+      end
 
-    it "does not include access token in fragment" do
-      expect(response.query_params["access_token"]).to be_nil
-    end
+      it "includes error description" do
+        expect(response_json_body["error_description"]).to eq(
+          translated_invalid_request_error_message(:missing_param, :client_id)
+        )
+      end
 
-    it "includes error in fragment" do
-      expect(response.query_params["error"]).to eq("invalid_scope")
+      it "does not issue any access token" do
+        expect(Doorkeeper::AccessToken.all).to be_empty
+      end
     end
 
-    it "includes error description in fragment" do
-      expect(response.query_params["error_description"]).to eq(translated_error_message(:invalid_scope))
-    end
+    context "when other error happens" do
+      before do
+        default_scopes_exist :public
+
+        post :create, params: {
+          client_id: client.uid,
+          response_type: "token",
+          scope: "invalid",
+          redirect_uri: client.redirect_uri,
+        }
+      end
+
+      it "redirects after authorization" do
+        expect(response).to be_redirect
+      end
+
+      it "redirects to client redirect uri" do
+        expect(response.location).to match(/^#{client.redirect_uri}/)
+      end
+
+      it "does not include access token in fragment" do
+        expect(response.query_params["access_token"]).to be_nil
+      end
+
+      it "includes error in fragment" do
+        expect(response.query_params["error"]).to eq("invalid_scope")
+      end
+
+      it "includes error description in fragment" do
+        expect(response.query_params["error_description"]).to eq(translated_error_message(:invalid_scope))
+      end
 
-    it "does not issue any access token" do
-      expect(Doorkeeper::AccessToken.all).to be_empty
+      it "does not issue any access token" do
+        expect(Doorkeeper::AccessToken.all).to be_empty
+      end
     end
   end
 
   describe "POST #create in API mode with errors" do
-    before do
-      allow(Doorkeeper.configuration).to receive(:api_only).and_return(true)
-      default_scopes_exist :public
+    context "when missing client_id" do
+      before do
+        allow(Doorkeeper.configuration).to receive(:api_only).and_return(true)
 
-      post :create, params: {
-        client_id: client.uid,
-        response_type: "token",
-        scope: "invalid",
-        redirect_uri: client.redirect_uri,
-      }
-    end
+        post :create, params: {
+          client_id: "",
+          response_type: "token",
+          redirect_uri: client.redirect_uri,
+        }
+      end
 
-    let(:response_json_body) { JSON.parse(response.body) }
-    let(:redirect_uri) { response_json_body["redirect_uri"] }
+      let(:response_json_body) { JSON.parse(response.body) }
 
-    it "renders 400 error" do
-      expect(response.status).to eq 400
-    end
+      it "renders 400 error" do
+        expect(response.status).to eq 400
+      end
 
-    it "includes correct redirect URI" do
-      expect(redirect_uri).to match(/^#{client.redirect_uri}/)
-    end
+      it "includes error name" do
+        expect(response_json_body["error"]).to eq("invalid_request")
+      end
 
-    it "does not include access token in fragment" do
-      expect(redirect_uri.match(/access_token=([a-f0-9]+)&?/)).to be_nil
-    end
+      it "includes error description" do
+        expect(response_json_body["error_description"]).to eq(
+          translated_invalid_request_error_message(:missing_param, :client_id)
+        )
+      end
 
-    it "includes error in redirect uri" do
-      expect(redirect_uri.match(/error=([a-z_]+)&?/)[1]).to eq "invalid_scope"
+      it "does not issue any access token" do
+        expect(Doorkeeper::AccessToken.all).to be_empty
+      end
     end
 
-    it "includes error description in redirect uri" do
-      expect(redirect_uri.match(/error_description=(.+)&?/)[1]).to_not be_nil
-    end
+    context "when other error happens" do
+      before do
+        allow(Doorkeeper.configuration).to receive(:api_only).and_return(true)
+        default_scopes_exist :public
 
-    it "does not issue any access token" do
-      expect(Doorkeeper::AccessToken.all).to be_empty
+        post :create, params: {
+          client_id: client.uid,
+          response_type: "token",
+          scope: "invalid",
+          redirect_uri: client.redirect_uri,
+        }
+      end
+
+      let(:response_json_body) { JSON.parse(response.body) }
+      let(:redirect_uri) { response_json_body["redirect_uri"] }
+
+      it "renders 400 error" do
+        expect(response.status).to eq 400
+      end
+
+      it "includes correct redirect URI" do
+        expect(redirect_uri).to match(/^#{client.redirect_uri}/)
+      end
+
+      it "does not include access token in fragment" do
+        expect(redirect_uri.match(/access_token=([a-f0-9]+)&?/)).to be_nil
+      end
+
+      it "includes error in redirect uri" do
+        expect(redirect_uri.match(/error=([a-z_]+)&?/)[1]).to eq "invalid_scope"
+      end
+
+      it "includes error description in redirect uri" do
+        expect(redirect_uri.match(/error_description=(.+)&?/)[1]).to_not be_nil
+      end
+
+      it "does not issue any access token" do
+        expect(Doorkeeper::AccessToken.all).to be_empty
+      end
     end
   end
 
@@ -368,7 +434,7 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
       expect(json_response["redirect_uri"]).to eq(client.redirect_uri)
       expect(json_response["state"]).to be_nil
       expect(json_response["response_type"]).to eq("token")
-      expect(json_response["scope"]).to eq("")
+      expect(json_response["scope"]).to eq("default")
     end
   end
 
@@ -445,12 +511,12 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
     end
 
     it "includes error in body" do
-      expect(response_json_body["error"]).to eq("unsupported_response_type")
+      expect(response_json_body["error"]).to eq("invalid_request")
     end
 
     it "includes error description in body" do
       expect(response_json_body["error_description"])
-        .to eq(translated_error_message(:unsupported_response_type))
+        .to eq(translated_invalid_request_error_message(:missing_param, :client_id))
     end
 
     it "does not issue any token" do
@@ -513,6 +579,8 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
 
   describe "authorize response memoization" do
     it "memoizes the result of the authorization" do
+      pre_auth = double(:pre_auth, authorizable?: true)
+      allow(controller).to receive(:pre_auth) { pre_auth }
       strategy = double(:strategy, authorize: true)
       expect(strategy).to receive(:authorize).once
       allow(controller).to receive(:strategy) { strategy }
@@ -524,4 +592,17 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
       post :create
     end
   end
+
+  describe "strong parameters" do
+    it "ignores non-scalar scope parameter" do
+      get :new, params: {
+        client_id: client.uid,
+        response_type: "token",
+        redirect_uri: client.redirect_uri,
+        scope: { "0" => "profile" },
+      }
+
+      expect(response).to be_successful
+    end
+  end
 end

data/spec/controllers/protected_resources_controller_spec.rb

@@ -166,7 +166,7 @@ describe "doorkeeper authorize filter" do
       it "it renders a custom JSON response", token: :invalid do
         get :index, params: { access_token: token_string }
         expect(response.status).to eq 401
-        expect(response.content_type).to match(/application\/json/)
+        expect(response.content_type).to include("application/json")
         expect(response.header["WWW-Authenticate"]).to match(/^Bearer/)
 
         expect(json_response).not_to be_nil
@@ -196,7 +196,7 @@ describe "doorkeeper authorize filter" do
       it "it renders a custom text response", token: :invalid do
         get :index, params: { access_token: token_string }
         expect(response.status).to eq 401
-        expect(response.content_type).to match(/text\/plain/)
+        expect(response.content_type).to include("text/plain")
         expect(response.header["WWW-Authenticate"]).to match(/^Bearer/)
         expect(response.body).to eq("Unauthorized")
       end
@@ -246,7 +246,7 @@ describe "doorkeeper authorize filter" do
       it "renders a custom JSON response" do
         get :index, params: { access_token: token_string }
         expect(response.header).to_not include("WWW-Authenticate")
-        expect(response.content_type).to match(/application\/json/)
+        expect(response.content_type).to include("application/json")
         expect(response.status).to eq 403
 
         expect(json_response).not_to be_nil

data/spec/controllers/tokens_controller_spec.rb

@@ -3,31 +3,139 @@
 require "spec_helper"
 
 describe Doorkeeper::TokensController do
-  describe "when authorization has succeeded" do
-    let(:token) { double(:token, authorize: true) }
+  let(:client) { FactoryBot.create :application }
+  let!(:user)  { User.create!(name: "Joe", password: "sekret") }
 
-    it "returns the authorization" do
-      skip "verify need of these specs"
+  before do
+    Doorkeeper.configure do
+      resource_owner_from_credentials do
+        User.first
+      end
+    end
 
-      expect(token).to receive(:authorization)
+    allow(Doorkeeper.configuration).to receive(:grant_flows).and_return(["password"])
+  end
 
-      post :create
+  subject { JSON.parse(response.body) }
+
+  describe "POST #create" do
+    before do
+      post :create, params: {
+        client_id: client.uid,
+        client_secret: client.secret,
+        grant_type: "password",
+      }
+    end
+
+    it "responds after authorization" do
+      expect(response).to be_successful
+    end
+
+    it "includes access token in response" do
+      expect(subject["access_token"]).to eq(Doorkeeper::AccessToken.first.token)
+    end
+
+    it "includes token type in response" do
+      expect(subject["token_type"]).to eq("Bearer")
+    end
+
+    it "includes token expiration in response" do
+      expect(subject["expires_in"].to_i).to eq(Doorkeeper.configuration.access_token_expires_in)
+    end
+
+    it "issues the token for the current client" do
+      expect(Doorkeeper::AccessToken.first.application_id).to eq(client.id)
+    end
+
+    it "issues the token for the current resource owner" do
+      expect(Doorkeeper::AccessToken.first.resource_owner_id).to eq(user.id)
     end
   end
 
-  describe "when authorization has failed" do
-    it "returns the error response" do
-      token = double(:token, authorize: false)
-      allow(controller).to receive(:token) { token }
+  describe "POST #create with errors" do
+    before do
+      post :create, params: {
+        client_id: client.uid,
+        client_secret: "invalid",
+        grant_type: "password",
+      }
+    end
 
-      post :create
+    it "responds after authorization" do
+      expect(response).to be_unauthorized
+    end
 
-      expect(response.status).to eq 400
-      expect(response.headers["WWW-Authenticate"]).to match(/Bearer/)
+    it "include error in response" do
+      expect(subject["error"]).to eq("invalid_client")
+    end
+
+    it "include error_description in response" do
+      expect(subject["error_description"]).to be
+    end
+
+    it "does not include access token in response" do
+      expect(subject["access_token"]).to be_nil
+    end
+
+    it "does not include token type in response" do
+      expect(subject["token_type"]).to be_nil
+    end
+
+    it "does not include token expiration in response" do
+      expect(subject["expires_in"]).to be_nil
+    end
+
+    it "does not issue any access token" do
+      expect(Doorkeeper::AccessToken.all).to be_empty
+    end
+  end
+
+  describe "POST #create with callbacks" do
+    after do
+      client.update_attribute :redirect_uri, "urn:ietf:wg:oauth:2.0:oob"
+    end
+
+    describe "when successful" do
+      after do
+        post :create, params: {
+          client_id: client.uid,
+          client_secret: client.secret,
+          grant_type: "password",
+        }
+      end
+
+      it "should call :before_successful_authorization callback" do
+        expect(Doorkeeper.configuration)
+          .to receive_message_chain(:before_successful_authorization, :call).with(instance_of(described_class))
+      end
+
+      it "should call :after_successful_authorization callback" do
+        expect(Doorkeeper.configuration)
+          .to receive_message_chain(:after_successful_authorization, :call).with(instance_of(described_class))
+      end
+    end
+
+    describe "with errors" do
+      after do
+        post :create, params: {
+          client_id: client.uid,
+          client_secret: "invalid",
+          grant_type: "password",
+        }
+      end
+
+      it "should call :before_successful_authorization callback" do
+        expect(Doorkeeper.configuration)
+          .to receive_message_chain(:before_successful_authorization, :call).with(instance_of(described_class))
+      end
+
+      it "should not call :after_successful_authorization callback" do
+        expect(Doorkeeper.configuration).not_to receive(:after_successful_authorization)
+      end
     end
   end
 
-  describe "when there is a failure due to a custom error" do
+  describe "POST #create with custom error" do
     it "returns the error response with a custom message" do
       # I18n looks for `doorkeeper.errors.messages.custom_message` in locale files
       custom_message = "my_message"
@@ -58,7 +166,7 @@ describe Doorkeeper::TokensController do
   end
 
   # http://tools.ietf.org/html/rfc7009#section-2.2
-  describe "revoking tokens" do
+  describe "POST #revoke" do
     let(:client) { FactoryBot.create(:application) }
     let(:access_token) { FactoryBot.create(:access_token, application: client) }
 
@@ -102,10 +210,10 @@ describe Doorkeeper::TokensController do
         let(:some_other_client) { FactoryBot.create(:application, confidential: true) }
         let(:oauth_client) { Doorkeeper::OAuth::Client.new(some_other_client) }
 
-        it "returns 200" do
+        it "returns 403" do
           post :revoke, params: { token: access_token.token }
 
-          expect(response.status).to eq 200
+          expect(response.status).to eq 403
         end
 
         it "does not revoke the access token" do
@@ -117,21 +225,7 @@ describe Doorkeeper::TokensController do
     end
   end
 
-  describe "authorize response memoization" do
-    it "memoizes the result of the authorization" do
-      strategy = double(:strategy, authorize: true)
-      expect(strategy).to receive(:authorize).once
-      allow(controller).to receive(:strategy) { strategy }
-      allow(controller).to receive(:create) do
-        2.times { controller.send :authorize_response }
-        controller.render json: {}, status: :ok
-      end
-
-      post :create
-    end
-  end
-
-  describe "when requested token introspection" do
+  describe "POST #introspect" do
     let(:client) { FactoryBot.create(:application) }
     let(:access_token) { FactoryBot.create(:access_token, application: client) }
     let(:token_for_introspection) { FactoryBot.create(:access_token, application: client) }
@@ -147,7 +241,7 @@ describe Doorkeeper::TokensController do
       end
     end
 
-    context "authorized using valid Client Authentication" do
+    context "authorized using Client Credentials of the client that token is issued to" do
       it "responds with full token introspection" do
         request.headers["Authorization"] = basic_auth_header_for_client(client)
 
@@ -159,6 +253,26 @@ describe Doorkeeper::TokensController do
       end
     end
 
+    context "configured token introspection disabled" do
+      before do
+        Doorkeeper.configure do
+          orm DOORKEEPER_ORM
+          allow_token_introspection false
+        end
+      end
+
+      it "responds with invalid_token error" do
+        request.headers["Authorization"] = "Bearer #{access_token.token}"
+
+        post :introspect, params: { token: token_for_introspection.token }
+
+        response_status_should_be 401
+
+        should_not_have_json "active"
+        should_have_json "error", "invalid_token"
+      end
+    end
+
     context "using custom introspection response" do
       before do
         Doorkeeper.configure do
@@ -212,12 +326,64 @@ describe Doorkeeper::TokensController do
       end
     end
 
+    context "introspection request authorized by a client and allow_token_introspection is true" do
+      let(:different_client) { FactoryBot.create(:application) }
+
+      before do
+        allow(Doorkeeper.configuration).to receive(:allow_token_introspection).and_return(proc do
+          true
+        end)
+      end
+
+      it "responds with full token introspection" do
+        request.headers["Authorization"] = basic_auth_header_for_client(different_client)
+
+        post :introspect, params: { token: token_for_introspection.token }
+
+        should_have_json "active", true
+        expect(json_response).to include("client_id", "token_type", "exp", "iat")
+        should_have_json "client_id", client.uid
+      end
+    end
+
+    context "allow_token_introspection requires authorized token with special scope" do
+      let(:access_token) { FactoryBot.create(:access_token, scopes: "introspection") }
+
+      before do
+        allow(Doorkeeper.configuration).to receive(:allow_token_introspection).and_return(proc do |_token, _client, authorized_token|
+          authorized_token.scopes.include?("introspection")
+        end)
+      end
+
+      it "responds with full token introspection if authorized token has introspection scope" do
+        request.headers["Authorization"] = "Bearer #{access_token.token}"
+
+        post :introspect, params: { token: token_for_introspection.token }
+
+        should_have_json "active", true
+        expect(json_response).to include("client_id", "token_type", "exp", "iat")
+      end
+
+      it "responds with invalid_token error if authorized token doesn't have introspection scope" do
+        access_token.update(scopes: "read write")
+
+        request.headers["Authorization"] = "Bearer #{access_token.token}"
+
+        post :introspect, params: { token: token_for_introspection.token }
+
+        response_status_should_be 401
+
+        should_not_have_json "active"
+        should_have_json "error", "invalid_token"
+      end
+    end
+
     context "authorized using invalid Bearer token" do
       let(:access_token) do
         FactoryBot.create(:access_token, application: client, revoked_at: 1.day.ago)
       end
 
-      it "responds with invalid token error" do
+      it "responds with invalid_token error" do
         request.headers["Authorization"] = "Bearer #{access_token.token}"
 
         post :introspect, params: { token: token_for_introspection.token }
@@ -272,13 +438,15 @@ describe Doorkeeper::TokensController do
       end
 
       context "authorized using valid Bearer token" do
-        it "responds with only active state" do
+        it "responds with invalid_token error" do
           request.headers["Authorization"] = "Bearer #{access_token.token}"
 
           post :introspect, params: { token: SecureRandom.hex(16) }
 
-          should_have_json "active", false
-          expect(json_response).not_to include("client_id", "token_type", "exp", "iat")
+          response_status_should_be 401
+
+          should_not_have_json "active"
+          should_have_json "error", "invalid_token"
         end
       end
     end

data/spec/dummy/config/application.rb

@@ -5,11 +5,13 @@ require "rails"
 %w[
   action_controller/railtie
   action_view/railtie
+  action_cable/engine
   sprockets/railtie
 ].each do |railtie|
   begin
     require railtie
-  rescue LoadError
+  rescue LoadError => e
+    puts "Error loading '#{railtie}' (#{e.message})"
   end
 end