doorkeeper 5.1.2 → 5.6.6

data/spec/requests/flows/authorization_code_spec.rb

@@ -1,447 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-feature "Authorization Code Flow" do
-  background do
-    config_is_set(:authenticate_resource_owner) { User.first || redirect_to("/sign_in") }
-    client_exists
-    create_resource_owner
-    sign_in
-  end
-
-  scenario "resource owner authorizes the client" do
-    visit authorization_endpoint_url(client: @client)
-    click_on "Authorize"
-
-    access_grant_should_exist_for(@client, @resource_owner)
-
-    i_should_be_on_client_callback(@client)
-
-    url_should_have_param("code", Doorkeeper::AccessGrant.first.token)
-    url_should_not_have_param("state")
-    url_should_not_have_param("error")
-  end
-
-  context "with grant hashing enabled" do
-    background do
-      config_is_set(:token_secret_strategy, ::Doorkeeper::SecretStoring::Sha256Hash)
-    end
-
-    scenario "Authorization Code Flow with hashing" do
-      @client.redirect_uri = Doorkeeper.configuration.native_redirect_uri
-      @client.save!
-      visit authorization_endpoint_url(client: @client)
-      click_on "Authorize"
-
-      access_grant_should_exist_for(@client, @resource_owner)
-
-      code = current_params["code"]
-      expect(code).not_to be_nil
-
-      hashed_code = Doorkeeper::AccessGrant.secret_strategy.transform_secret code
-      expect(hashed_code).to eq Doorkeeper::AccessGrant.first.token
-
-      expect(code).not_to eq(hashed_code)
-
-      i_should_see "Authorization code:"
-      i_should_see code
-      i_should_not_see hashed_code
-    end
-  end
-
-  scenario "resource owner authorizes using test url" do
-    @client.redirect_uri = Doorkeeper.configuration.native_redirect_uri
-    @client.save!
-    visit authorization_endpoint_url(client: @client)
-    click_on "Authorize"
-
-    access_grant_should_exist_for(@client, @resource_owner)
-
-    url_should_have_param("code", Doorkeeper::AccessGrant.first.token)
-    i_should_see "Authorization code:"
-    i_should_see Doorkeeper::AccessGrant.first.token
-  end
-
-  scenario "resource owner authorizes the client with state parameter set" do
-    visit authorization_endpoint_url(client: @client, state: "return-me")
-    click_on "Authorize"
-    url_should_have_param("code", Doorkeeper::AccessGrant.first.token)
-    url_should_have_param("state", "return-me")
-    url_should_not_have_param("code_challenge_method")
-  end
-
-  scenario "resource owner requests an access token with authorization code" do
-    visit authorization_endpoint_url(client: @client)
-    click_on "Authorize"
-
-    authorization_code = Doorkeeper::AccessGrant.first.token
-    create_access_token authorization_code, @client
-
-    access_token_should_exist_for(@client, @resource_owner)
-
-    should_not_have_json "error"
-
-    should_have_json "access_token", Doorkeeper::AccessToken.first.token
-    should_have_json "token_type", "Bearer"
-    should_have_json_within "expires_in", Doorkeeper::AccessToken.first.expires_in, 1
-  end
-
-  scenario "resource owner requests an access token with authorization code but without secret" do
-    visit authorization_endpoint_url(client: @client)
-    click_on "Authorize"
-
-    authorization_code = Doorkeeper::AccessGrant.first.token
-    page.driver.post token_endpoint_url(code: authorization_code, client_id: @client.uid,
-                                        redirect_uri: @client.redirect_uri)
-
-    expect(Doorkeeper::AccessToken.count).to be_zero
-
-    should_have_json "error", "invalid_client"
-  end
-
-  scenario "resource owner requests an access token with authorization code but without client id" do
-    visit authorization_endpoint_url(client: @client)
-    click_on "Authorize"
-
-    authorization_code = Doorkeeper::AccessGrant.first.token
-    page.driver.post token_endpoint_url(code: authorization_code, client_secret: @client.secret,
-                                        redirect_uri: @client.redirect_uri)
-
-    expect(Doorkeeper::AccessToken.count).to be_zero
-
-    should_have_json "error", "invalid_client"
-  end
-
-  scenario "silently authorizes if matching token exists" do
-    default_scopes_exist :public, :write
-
-    access_token_exists application: @client,
-                        expires_in: -100, # even expired token
-                        resource_owner_id: @resource_owner.id,
-                        scopes: "public write"
-
-    visit authorization_endpoint_url(client: @client, scope: "public write")
-
-    response_status_should_be 200
-    i_should_not_see "Authorize"
-  end
-
-  context "with PKCE" do
-    context "plain" do
-      let(:code_challenge) { "a45a9fea-0676-477e-95b1-a40f72ac3cfb" }
-      let(:code_verifier) { "a45a9fea-0676-477e-95b1-a40f72ac3cfb" }
-
-      scenario "resource owner authorizes the client with code_challenge parameter set" do
-        visit authorization_endpoint_url(
-          client: @client,
-          code_challenge: code_challenge,
-          code_challenge_method: "plain"
-        )
-        click_on "Authorize"
-
-        url_should_have_param("code", Doorkeeper::AccessGrant.first.token)
-        url_should_not_have_param("code_challenge_method")
-        url_should_not_have_param("code_challenge")
-      end
-
-      scenario "mobile app requests an access token with authorization code but not pkce token" do
-        visit authorization_endpoint_url(client: @client)
-        click_on "Authorize"
-
-        authorization_code = current_params["code"]
-        create_access_token authorization_code, @client, code_verifier
-
-        should_have_json "error", "invalid_grant"
-      end
-
-      scenario "mobile app requests an access token with authorization code and plain code challenge method" do
-        visit authorization_endpoint_url(
-          client: @client,
-          code_challenge: code_challenge,
-          code_challenge_method: "plain"
-        )
-        click_on "Authorize"
-
-        authorization_code = current_params["code"]
-        create_access_token authorization_code, @client, code_verifier
-
-        access_token_should_exist_for(@client, @resource_owner)
-
-        should_not_have_json "error"
-
-        should_have_json "access_token", Doorkeeper::AccessToken.first.token
-        should_have_json "token_type", "Bearer"
-        should_have_json_within "expires_in", Doorkeeper::AccessToken.first.expires_in, 1
-      end
-
-      scenario "mobile app requests an access token with authorization code and code_challenge" do
-        visit authorization_endpoint_url(client: @client,
-                                         code_challenge: code_verifier,
-                                         code_challenge_method: "plain")
-        click_on "Authorize"
-
-        authorization_code = current_params["code"]
-        create_access_token authorization_code, @client, code_verifier: nil
-
-        should_not_have_json "access_token"
-        should_have_json "error", "invalid_grant"
-      end
-    end
-
-    context "s256" do
-      let(:code_challenge) { "Oz733NtQ0rJP8b04fgZMJMwprn6Iw8sMCT_9bR1q4tA" }
-      let(:code_verifier) { "a45a9fea-0676-477e-95b1-a40f72ac3cfb" }
-
-      scenario "resource owner authorizes the client with code_challenge parameter set" do
-        visit authorization_endpoint_url(
-          client: @client,
-          code_challenge: code_challenge,
-          code_challenge_method: "S256"
-        )
-        click_on "Authorize"
-
-        url_should_have_param("code", Doorkeeper::AccessGrant.first.token)
-        url_should_not_have_param("code_challenge_method")
-        url_should_not_have_param("code_challenge")
-      end
-
-      scenario "mobile app requests an access token with authorization code and S256 code challenge method" do
-        visit authorization_endpoint_url(
-          client: @client,
-          code_challenge: code_challenge,
-          code_challenge_method: "S256"
-        )
-        click_on "Authorize"
-
-        authorization_code = current_params["code"]
-        create_access_token authorization_code, @client, code_verifier
-
-        access_token_should_exist_for(@client, @resource_owner)
-
-        should_not_have_json "error"
-
-        should_have_json "access_token", Doorkeeper::AccessToken.first.token
-        should_have_json "token_type", "Bearer"
-        should_have_json_within "expires_in", Doorkeeper::AccessToken.first.expires_in, 1
-      end
-
-      scenario "mobile app requests an access token with authorization code and without code_verifier" do
-        visit authorization_endpoint_url(
-          client: @client,
-          code_challenge: code_challenge,
-          code_challenge_method: "S256"
-        )
-        click_on "Authorize"
-        authorization_code = current_params["code"]
-        create_access_token authorization_code, @client
-        should_have_json "error", "invalid_request"
-        should_not_have_json "access_token"
-      end
-
-      scenario "mobile app requests an access token with authorization code and without secret" do
-        visit authorization_endpoint_url(
-          client: @client,
-          code_challenge: code_challenge,
-          code_challenge_method: "S256"
-        )
-        click_on "Authorize"
-
-        authorization_code = current_params["code"]
-        page.driver.post token_endpoint_url(code: authorization_code, client_id: @client.uid,
-                                            redirect_uri: @client.redirect_uri, code_verifier: code_verifier)
-        should_have_json "error", "invalid_client"
-        should_not_have_json "access_token"
-      end
-
-      scenario "mobile app requests an access token with authorization code and without secret but is marked as not confidential" do
-        @client.update_attribute :confidential, false
-        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge, code_challenge_method: "S256")
-        click_on "Authorize"
-
-        authorization_code = current_params["code"]
-        page.driver.post token_endpoint_url(
-          code: authorization_code,
-          client_id: @client.uid,
-          redirect_uri: @client.redirect_uri,
-          code_verifier: code_verifier
-        )
-        should_not_have_json "error"
-
-        should_have_json "access_token", Doorkeeper::AccessToken.first.token
-        should_have_json "token_type", "Bearer"
-        should_have_json_within "expires_in", Doorkeeper::AccessToken.first.expires_in, 1
-      end
-
-      scenario "mobile app requests an access token with authorization code but no code verifier" do
-        visit authorization_endpoint_url(
-          client: @client,
-          code_challenge: code_challenge,
-          code_challenge_method: "S256"
-        )
-        click_on "Authorize"
-
-        authorization_code = current_params["code"]
-        create_access_token authorization_code, @client
-
-        should_not_have_json "access_token"
-        should_have_json "error", "invalid_request"
-      end
-
-      scenario "mobile app requests an access token with authorization code with wrong verifier" do
-        visit authorization_endpoint_url(
-          client: @client,
-          code_challenge: code_challenge,
-          code_challenge_method: "S256"
-        )
-        click_on "Authorize"
-
-        authorization_code = current_params["code"]
-        create_access_token authorization_code, @client, "incorrect-code-verifier"
-
-        should_not_have_json "access_token"
-        should_have_json "error", "invalid_grant"
-      end
-
-      scenario "code_challenge_mehthod in token request is totally ignored" do
-        visit authorization_endpoint_url(
-          client: @client,
-          code_challenge: code_challenge,
-          code_challenge_method: "S256"
-        )
-        click_on "Authorize"
-
-        authorization_code = current_params["code"]
-        page.driver.post token_endpoint_url(
-          code: authorization_code,
-          client: @client,
-          code_verifier: code_challenge,
-          code_challenge_method: "plain"
-        )
-
-        should_not_have_json "access_token"
-        should_have_json "error", "invalid_grant"
-      end
-
-      scenario "expects to set code_challenge_method explicitely without fallback" do
-        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge)
-        expect(page).to have_content("The code challenge method must be plain or S256.")
-      end
-    end
-  end
-
-  context "when application scopes are present and no scope is passed" do
-    background do
-      @client.update(scopes: "public write read")
-    end
-
-    scenario "access grant has no scope" do
-      default_scopes_exist :admin
-      visit authorization_endpoint_url(client: @client)
-      click_on "Authorize"
-      access_grant_should_exist_for(@client, @resource_owner)
-      grant = Doorkeeper::AccessGrant.first
-      expect(grant.scopes).to be_empty
-    end
-
-    scenario "access grant have scopes which are common in application scopees and default scopes" do
-      default_scopes_exist :public, :write
-      visit authorization_endpoint_url(client: @client)
-      click_on "Authorize"
-      access_grant_should_exist_for(@client, @resource_owner)
-      access_grant_should_have_scopes :public, :write
-    end
-  end
-
-  context "with scopes" do
-    background do
-      default_scopes_exist :public
-      optional_scopes_exist :write
-    end
-
-    scenario "resource owner authorizes the client with default scopes" do
-      visit authorization_endpoint_url(client: @client)
-      click_on "Authorize"
-      access_grant_should_exist_for(@client, @resource_owner)
-      access_grant_should_have_scopes :public
-    end
-
-    scenario "resource owner authorizes the client with required scopes" do
-      visit authorization_endpoint_url(client: @client, scope: "public write")
-      click_on "Authorize"
-      access_grant_should_have_scopes :public, :write
-    end
-
-    scenario "resource owner authorizes the client with required scopes (without defaults)" do
-      visit authorization_endpoint_url(client: @client, scope: "write")
-      click_on "Authorize"
-      access_grant_should_have_scopes :write
-    end
-
-    scenario "new access token matches required scopes" do
-      visit authorization_endpoint_url(client: @client, scope: "public write")
-      click_on "Authorize"
-
-      authorization_code = Doorkeeper::AccessGrant.first.token
-      create_access_token authorization_code, @client
-
-      access_token_should_exist_for(@client, @resource_owner)
-      access_token_should_have_scopes :public, :write
-    end
-
-    scenario "returns new token if scopes have changed" do
-      client_is_authorized(@client, @resource_owner, scopes: "public write")
-      visit authorization_endpoint_url(client: @client, scope: "public")
-      click_on "Authorize"
-
-      authorization_code = Doorkeeper::AccessGrant.first.token
-      create_access_token authorization_code, @client
-
-      expect(Doorkeeper::AccessToken.count).to be(2)
-
-      should_have_json "access_token", Doorkeeper::AccessToken.last.token
-    end
-
-    scenario "resource owner authorizes the client with extra scopes" do
-      client_is_authorized(@client, @resource_owner, scopes: "public")
-      visit authorization_endpoint_url(client: @client, scope: "public write")
-      click_on "Authorize"
-
-      authorization_code = Doorkeeper::AccessGrant.first.token
-      create_access_token authorization_code, @client
-
-      expect(Doorkeeper::AccessToken.count).to be(2)
-
-      should_have_json "access_token", Doorkeeper::AccessToken.last.token
-      access_token_should_have_scopes :public, :write
-    end
-  end
-end
-
-describe "Authorization Code Flow" do
-  before do
-    Doorkeeper.configure do
-      orm DOORKEEPER_ORM
-      use_refresh_token
-    end
-
-    client_exists
-  end
-
-  context "issuing a refresh token" do
-    before do
-      authorization_code_exists application: @client
-    end
-
-    it "second of simultaneous client requests get an error for revoked acccess token" do
-      authorization_code = Doorkeeper::AccessGrant.first.token
-      allow_any_instance_of(Doorkeeper::AccessGrant)
-        .to receive(:revoked?).and_return(false, true)
-
-      post token_endpoint_url(code: authorization_code, client: @client)
-
-      should_not_have_json "access_token"
-      should_have_json "error", "invalid_grant"
-    end
-  end
-end

data/spec/requests/flows/client_credentials_spec.rb

@@ -1,128 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe "Client Credentials Request" do
-  let(:client) { FactoryBot.create :application }
-
-  context "a valid request" do
-    it "authorizes the client and returns the token response" do
-      headers = authorization client.uid, client.secret
-      params  = { grant_type: "client_credentials" }
-
-      post "/oauth/token", params: params, headers: headers
-
-      should_have_json "access_token", Doorkeeper::AccessToken.first.token
-      should_have_json_within "expires_in", Doorkeeper.configuration.access_token_expires_in, 1
-      should_not_have_json "scope"
-      should_not_have_json "refresh_token"
-
-      should_not_have_json "error"
-      should_not_have_json "error_description"
-    end
-
-    context "with scopes" do
-      before do
-        optional_scopes_exist :write
-        default_scopes_exist :public
-      end
-
-      it "adds the scope to the token an returns in the response" do
-        headers = authorization client.uid, client.secret
-        params  = { grant_type: "client_credentials", scope: "write" }
-
-        post "/oauth/token", params: params, headers: headers
-
-        should_have_json "access_token", Doorkeeper::AccessToken.first.token
-        should_have_json "scope", "write"
-      end
-
-      context "that are default" do
-        it "adds the scope to the token an returns in the response" do
-          headers = authorization client.uid, client.secret
-          params  = { grant_type: "client_credentials", scope: "public" }
-
-          post "/oauth/token", params: params, headers: headers
-
-          should_have_json "access_token", Doorkeeper::AccessToken.first.token
-          should_have_json "scope", "public"
-        end
-      end
-
-      context "that are invalid" do
-        it "does not authorize the client and returns the error" do
-          headers = authorization client.uid, client.secret
-          params  = { grant_type: "client_credentials", scope: "random" }
-
-          post "/oauth/token", params: params, headers: headers
-
-          should_have_json "error", "invalid_scope"
-          should_have_json "error_description", translated_error_message(:invalid_scope)
-          should_not_have_json "access_token"
-
-          expect(response.status).to eq(400)
-        end
-      end
-    end
-  end
-
-  context "when application scopes contain some of the default scopes and no scope is passed" do
-    before do
-      client.update(scopes: "read write public")
-    end
-
-    it "issues new token with one default scope that are present in application scopes" do
-      default_scopes_exist :public
-
-      headers = authorization client.uid, client.secret
-      params  = { grant_type: "client_credentials" }
-
-      expect do
-        post "/oauth/token", params: params, headers: headers
-      end.to change { Doorkeeper::AccessToken.count }.by(1)
-
-      token = Doorkeeper::AccessToken.first
-
-      expect(token.application_id).to eq client.id
-      should_have_json "access_token", token.token
-      should_have_json "scope", "public"
-    end
-
-    it "issues new token with multiple default scopes that are present in application scopes" do
-      default_scopes_exist :public, :read, :update
-
-      headers = authorization client.uid, client.secret
-      params  = { grant_type: "client_credentials" }
-
-      expect do
-        post "/oauth/token", params: params, headers: headers
-      end.to change { Doorkeeper::AccessToken.count }.by(1)
-
-      token = Doorkeeper::AccessToken.first
-
-      expect(token.application_id).to eq client.id
-      should_have_json "access_token", token.token
-      should_have_json "scope", "public read"
-    end
-  end
-
-  context "an invalid request" do
-    it "does not authorize the client and returns the error" do
-      headers = {}
-      params  = { grant_type: "client_credentials" }
-
-      post "/oauth/token", params: params, headers: headers
-
-      should_have_json "error", "invalid_client"
-      should_have_json "error_description", translated_error_message(:invalid_client)
-      should_not_have_json "access_token"
-
-      expect(response.status).to eq(401)
-    end
-  end
-
-  def authorization(username, password)
-    credentials = ActionController::HttpAuthentication::Basic.encode_credentials username, password
-    { "HTTP_AUTHORIZATION" => credentials }
-  end
-end

data/spec/requests/flows/implicit_grant_errors_spec.rb

@@ -1,34 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-feature "Implicit Grant Flow Errors" do
-  background do
-    config_is_set(:authenticate_resource_owner) { User.first || redirect_to("/sign_in") }
-    config_is_set(:grant_flows, ["implicit"])
-    client_exists
-    create_resource_owner
-    sign_in
-  end
-
-  after do
-    access_token_should_not_exist
-  end
-
-  [
-    %i[client_id invalid_client],
-    %i[redirect_uri invalid_redirect_uri],
-  ].each do |error|
-    scenario "displays #{error.last} error for invalid #{error.first}" do
-      visit authorization_endpoint_url(client: @client, error.first => "invalid", response_type: "token")
-      i_should_not_see "Authorize"
-      i_should_see_translated_error_message error.last
-    end
-
-    scenario "displays #{error.last} error when #{error.first} is missing" do
-      visit authorization_endpoint_url(client: @client, error.first => "", response_type: "token")
-      i_should_not_see "Authorize"
-      i_should_see_translated_error_message error.last
-    end
-  end
-end

data/spec/requests/flows/implicit_grant_spec.rb

@@ -1,90 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-feature "Implicit Grant Flow (feature spec)" do
-  background do
-    config_is_set(:authenticate_resource_owner) { User.first || redirect_to("/sign_in") }
-    config_is_set(:grant_flows, ["implicit"])
-    client_exists
-    create_resource_owner
-    sign_in
-  end
-
-  scenario "resource owner authorizes the client" do
-    visit authorization_endpoint_url(client: @client, response_type: "token")
-    click_on "Authorize"
-
-    access_token_should_exist_for @client, @resource_owner
-
-    i_should_be_on_client_callback @client
-  end
-
-  context "when application scopes are present and no scope is passed" do
-    background do
-      @client.update(scopes: "public write read")
-    end
-
-    scenario "access token has no scopes" do
-      default_scopes_exist :admin
-      visit authorization_endpoint_url(client: @client, response_type: "token")
-      click_on "Authorize"
-      access_token_should_exist_for @client, @resource_owner
-      token = Doorkeeper::AccessToken.first
-      expect(token.scopes).to be_empty
-    end
-
-    scenario "access token has scopes which are common in application scopees and default scopes" do
-      default_scopes_exist :public, :write
-      visit authorization_endpoint_url(client: @client, response_type: "token")
-      click_on "Authorize"
-      access_token_should_exist_for @client, @resource_owner
-      access_token_should_have_scopes :public, :write
-    end
-  end
-end
-
-describe "Implicit Grant Flow (request spec)" do
-  before do
-    config_is_set(:authenticate_resource_owner) { User.first || redirect_to("/sign_in") }
-    config_is_set(:grant_flows, ["implicit"])
-    client_exists
-    create_resource_owner
-  end
-
-  context "token reuse" do
-    it "should return a new token each request" do
-      allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(false)
-
-      token = client_is_authorized(@client, @resource_owner)
-
-      post "/oauth/authorize",
-           params: {
-             client_id: @client.uid,
-             state: "",
-             redirect_uri: @client.redirect_uri,
-             response_type: "token",
-             commit: "Authorize",
-           }
-
-      expect(response.location).not_to include(token.token)
-    end
-
-    it "should return the same token if it is still accessible" do
-      allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-
-      token = client_is_authorized(@client, @resource_owner)
-
-      post "/oauth/authorize",
-           params: {
-             client_id: @client.uid,
-             state: "",
-             redirect_uri: @client.redirect_uri,
-             response_type: "token",
-             commit: "Authorize",
-           }
-
-      expect(response.location).to include(token.token)
-    end
-  end
-end