doorkeeper 5.2.0 → 5.3.0

data/spec/models/doorkeeper/application_spec.rb

@@ -13,6 +13,78 @@ module Doorkeeper
     let(:uid) { SecureRandom.hex(8) }
     let(:secret) { SecureRandom.hex(8) }
 
+    it "is invalid without a name" do
+      new_application.name = nil
+      expect(new_application).not_to be_valid
+    end
+
+    it "is invalid without determining confidentiality" do
+      new_application.confidential = nil
+      expect(new_application).not_to be_valid
+    end
+
+    it "generates uid on create" do
+      expect(new_application.uid).to be_nil
+      new_application.save
+      expect(new_application.uid).not_to be_nil
+    end
+
+    it "generates uid on create if an empty string" do
+      new_application.uid = ""
+      new_application.save
+      expect(new_application.uid).not_to be_blank
+    end
+
+    it "generates uid on create unless one is set" do
+      new_application.uid = uid
+      new_application.save
+      expect(new_application.uid).to eq(uid)
+    end
+
+    it "is invalid without uid" do
+      new_application.save
+      new_application.uid = nil
+      expect(new_application).not_to be_valid
+    end
+
+    it "checks uniqueness of uid" do
+      app1 = FactoryBot.create(:application)
+      app2 = FactoryBot.create(:application)
+      app2.uid = app1.uid
+      expect(app2).not_to be_valid
+    end
+
+    it "expects database to throw an error when uids are the same" do
+      app1 = FactoryBot.create(:application)
+      app2 = FactoryBot.create(:application)
+      app2.uid = app1.uid
+      expect { app2.save!(validate: false) }.to raise_error(uniqueness_error)
+    end
+
+    it "generate secret on create" do
+      expect(new_application.secret).to be_nil
+      new_application.save
+      expect(new_application.secret).not_to be_nil
+    end
+
+    it "generate secret on create if is blank string" do
+      new_application.secret = ""
+      new_application.save
+      expect(new_application.secret).not_to be_blank
+    end
+
+    it "generate secret on create unless one is set" do
+      new_application.secret = secret
+      new_application.save
+      expect(new_application.secret).to eq(secret)
+    end
+
+    it "is invalid without secret" do
+      new_application.save
+      new_application.secret = nil
+      expect(new_application).not_to be_valid
+    end
+
     context "application_owner is enabled" do
       before do
         Doorkeeper.configure do
@@ -48,40 +120,6 @@ module Doorkeeper
       end
     end
 
-    it "is invalid without a name" do
-      new_application.name = nil
-      expect(new_application).not_to be_valid
-    end
-
-    it "is invalid without determining confidentiality" do
-      new_application.confidential = nil
-      expect(new_application).not_to be_valid
-    end
-
-    it "generates uid on create" do
-      expect(new_application.uid).to be_nil
-      new_application.save
-      expect(new_application.uid).not_to be_nil
-    end
-
-    it "generates uid on create if an empty string" do
-      new_application.uid = ""
-      new_application.save
-      expect(new_application.uid).not_to be_blank
-    end
-
-    it "generates uid on create unless one is set" do
-      new_application.uid = uid
-      new_application.save
-      expect(new_application.uid).to eq(uid)
-    end
-
-    it "is invalid without uid" do
-      new_application.save
-      new_application.uid = nil
-      expect(new_application).not_to be_valid
-    end
-
     context "redirect URI" do
       context "when grant flows allow blank redirect URI" do
         before do
@@ -127,44 +165,6 @@ module Doorkeeper
       end
     end
 
-    it "checks uniqueness of uid" do
-      app1 = FactoryBot.create(:application)
-      app2 = FactoryBot.create(:application)
-      app2.uid = app1.uid
-      expect(app2).not_to be_valid
-    end
-
-    it "expects database to throw an error when uids are the same" do
-      app1 = FactoryBot.create(:application)
-      app2 = FactoryBot.create(:application)
-      app2.uid = app1.uid
-      expect { app2.save!(validate: false) }.to raise_error(uniqueness_error)
-    end
-
-    it "generate secret on create" do
-      expect(new_application.secret).to be_nil
-      new_application.save
-      expect(new_application.secret).not_to be_nil
-    end
-
-    it "generate secret on create if is blank string" do
-      new_application.secret = ""
-      new_application.save
-      expect(new_application.secret).not_to be_blank
-    end
-
-    it "generate secret on create unless one is set" do
-      new_application.secret = secret
-      new_application.save
-      expect(new_application.secret).to eq(secret)
-    end
-
-    it "is invalid without secret" do
-      new_application.save
-      new_application.secret = nil
-      expect(new_application).not_to be_valid
-    end
-
     context "with hashing enabled" do
       include_context "with application hashing enabled"
       let(:app) { FactoryBot.create :application }
@@ -238,7 +238,7 @@ module Doorkeeper
       end
     end
 
-    describe :ordered_by do
+    describe "#ordered_by" do
       let(:applications) { FactoryBot.create_list(:application, 5) }
 
       context "when a direction is not specified" do
@@ -271,7 +271,17 @@ module Doorkeeper
       end
     end
 
-    describe :authorized_for do
+    describe "#renew_secret" do
+      let(:app) { FactoryBot.create :application }
+
+      it "should generate a new secret" do
+        old_secret = app.secret
+        app.renew_secret
+        expect(old_secret).not_to eq(app.secret)
+      end
+    end
+
+    describe "#authorized_for" do
       let(:resource_owner) { double(:resource_owner, id: 10) }
 
       it "is empty if the application is not authorized for anyone" do
@@ -303,7 +313,7 @@ module Doorkeeper
       end
     end
 
-    describe :revoke_tokens_and_grants_for do
+    describe "#revoke_tokens_and_grants_for" do
       it "revokes all access tokens and access grants" do
         application_id = 42
         resource_owner = double
@@ -316,7 +326,7 @@ module Doorkeeper
       end
     end
 
-    describe :by_uid_and_secret do
+    describe "#by_uid_and_secret" do
       context "when application is private/confidential" do
         it "finds the application via uid/secret" do
           app = FactoryBot.create :application
@@ -350,7 +360,7 @@ module Doorkeeper
       end
     end
 
-    describe :confidential? do
+    describe "#confidential?" do
       subject { FactoryBot.create(:application, confidential: confidential).confidential? }
 
       context "when application is private/confidential" do
@@ -363,5 +373,32 @@ module Doorkeeper
         it { expect(subject).to eq(false) }
       end
     end
+
+    describe "#as_json" do
+      let(:app) { FactoryBot.create :application, secret: "123123123" }
+
+      before do
+        allow(Doorkeeper.configuration)
+          .to receive(:application_secret_strategy).and_return(Doorkeeper::SecretStoring::Plain)
+      end
+
+      it "includes plaintext secret" do
+        expect(app.as_json).to include("secret" => "123123123")
+      end
+
+      it "respects custom options" do
+        expect(app.as_json(except: :secret)).not_to include("secret")
+        expect(app.as_json(only: :id)).to match("id" => app.id)
+      end
+
+      # AR specific
+      if DOORKEEPER_ORM == :active_record
+        it "correctly works with #to_json" do
+          ActiveRecord::Base.include_root_in_json = true
+          expect(app.to_json(include_root_in_json: true)).to match(/application.+?:\{/)
+          ActiveRecord::Base.include_root_in_json = false
+        end
+      end
+    end
   end
 end

data/spec/requests/applications/applications_request_spec.rb

@@ -91,7 +91,7 @@ feature "Adding applications" do
       i_should_see "Whoops! Check your form for possible errors"
       i_should_see Regexp.new(
         I18n.t("activerecord.errors.models.doorkeeper/application.attributes.scopes.not_match_configured"),
-        true
+        true,
       )
     end
 

data/spec/requests/endpoints/authorization_spec.rb

@@ -79,9 +79,11 @@ feature "Authorization endpoint" do
     scenario "raises exception on forged requests" do
       allowing_forgery_protection do
         expect do
-          page.driver.post authorization_endpoint_url(client_id: @client.uid,
-                                                      redirect_uri: @client.redirect_uri,
-                                                      response_type: "code")
+          page.driver.post authorization_endpoint_url(
+            client_id: @client.uid,
+            redirect_uri: @client.redirect_uri,
+            response_type: "code",
+          )
         end.to raise_error(ActionController::InvalidAuthenticityToken)
       end
     end

data/spec/requests/flows/authorization_code_spec.rb

@@ -149,8 +149,10 @@ feature "Authorization Code Flow" do
     click_on "Authorize"
 
     authorization_code = Doorkeeper::AccessGrant.first.token
-    page.driver.post token_endpoint_url(code: authorization_code, client_id: @client.uid,
-                                        redirect_uri: @client.redirect_uri)
+    page.driver.post token_endpoint_url(
+      code: authorization_code, client_id: @client.uid,
+      redirect_uri: @client.redirect_uri,
+    )
 
     expect(Doorkeeper::AccessToken.count).to be_zero
 
@@ -163,8 +165,10 @@ feature "Authorization Code Flow" do
     click_on "Authorize"
 
     authorization_code = Doorkeeper::AccessGrant.first.token
-    page.driver.post token_endpoint_url(code: authorization_code, client_secret: @client.secret,
-                                        redirect_uri: @client.redirect_uri)
+    page.driver.post token_endpoint_url(
+      code: authorization_code, client_secret: @client.secret,
+      redirect_uri: @client.redirect_uri,
+    )
 
     expect(Doorkeeper::AccessToken.count).to be_zero
 
@@ -195,7 +199,7 @@ feature "Authorization Code Flow" do
         visit authorization_endpoint_url(
           client: @client,
           code_challenge: code_challenge,
-          code_challenge_method: "plain"
+          code_challenge_method: "plain",
         )
         click_on "Authorize"
 
@@ -219,7 +223,7 @@ feature "Authorization Code Flow" do
         visit authorization_endpoint_url(
           client: @client,
           code_challenge: code_challenge,
-          code_challenge_method: "plain"
+          code_challenge_method: "plain",
         )
         click_on "Authorize"
 
@@ -236,9 +240,11 @@ feature "Authorization Code Flow" do
       end
 
       scenario "mobile app requests an access token with authorization code but without code_verifier" do
-        visit authorization_endpoint_url(client: @client,
-                                         code_challenge: code_challenge,
-                                         code_challenge_method: "plain")
+        visit authorization_endpoint_url(
+          client: @client,
+          code_challenge: code_challenge,
+          code_challenge_method: "plain",
+        )
         click_on "Authorize"
 
         authorization_code = current_params["code"]
@@ -250,9 +256,11 @@ feature "Authorization Code Flow" do
       end
 
       scenario "mobile app requests an access token with authorization code with wrong code_verifier" do
-        visit authorization_endpoint_url(client: @client,
-                                         code_challenge: code_challenge,
-                                         code_challenge_method: "plain")
+        visit authorization_endpoint_url(
+          client: @client,
+          code_challenge: code_challenge,
+          code_challenge_method: "plain",
+        )
         click_on "Authorize"
 
         authorization_code = current_params["code"]
@@ -272,7 +280,7 @@ feature "Authorization Code Flow" do
         visit authorization_endpoint_url(
           client: @client,
           code_challenge: code_challenge,
-          code_challenge_method: "S256"
+          code_challenge_method: "S256",
         )
         click_on "Authorize"
 
@@ -285,7 +293,7 @@ feature "Authorization Code Flow" do
         visit authorization_endpoint_url(
           client: @client,
           code_challenge: code_challenge,
-          code_challenge_method: "S256"
+          code_challenge_method: "S256",
         )
         click_on "Authorize"
 
@@ -305,13 +313,17 @@ feature "Authorization Code Flow" do
         visit authorization_endpoint_url(
           client: @client,
           code_challenge: code_challenge,
-          code_challenge_method: "S256"
+          code_challenge_method: "S256",
         )
         click_on "Authorize"
 
         authorization_code = current_params["code"]
-        page.driver.post token_endpoint_url(code: authorization_code, client_id: @client.uid,
-                                            redirect_uri: @client.redirect_uri, code_verifier: code_verifier)
+        page.driver.post token_endpoint_url(
+          code: authorization_code,
+          client_id: @client.uid,
+          redirect_uri: @client.redirect_uri,
+          code_verifier: code_verifier,
+        )
         should_not_have_json "access_token"
         should_have_json "error", "invalid_client"
         should_have_json "error_description", translated_error_message(:invalid_client)
@@ -327,7 +339,7 @@ feature "Authorization Code Flow" do
           code: authorization_code,
           client_id: @client.uid,
           redirect_uri: @client.redirect_uri,
-          code_verifier: code_verifier
+          code_verifier: code_verifier,
         )
         should_not_have_json "error"
 
@@ -340,7 +352,7 @@ feature "Authorization Code Flow" do
         visit authorization_endpoint_url(
           client: @client,
           code_challenge: code_challenge,
-          code_challenge_method: "S256"
+          code_challenge_method: "S256",
         )
         click_on "Authorize"
 
@@ -356,7 +368,7 @@ feature "Authorization Code Flow" do
         visit authorization_endpoint_url(
           client: @client,
           code_challenge: code_challenge,
-          code_challenge_method: "S256"
+          code_challenge_method: "S256",
         )
         click_on "Authorize"
 
@@ -372,7 +384,7 @@ feature "Authorization Code Flow" do
         visit authorization_endpoint_url(
           client: @client,
           code_challenge: code_challenge,
-          code_challenge_method: "S256"
+          code_challenge_method: "S256",
         )
         click_on "Authorize"
 
@@ -381,7 +393,7 @@ feature "Authorization Code Flow" do
           code: authorization_code,
           client: @client,
           code_verifier: code_challenge,
-          code_challenge_method: "plain"
+          code_challenge_method: "plain",
         )
 
         should_not_have_json "access_token"

data/spec/requests/flows/client_credentials_spec.rb

@@ -70,7 +70,7 @@ describe "Client Credentials Request" do
     before do
       Doorkeeper.configuration.instance_variable_set(
         :@allow_grant_flow_for_client,
-        ->(_grant_flow, client) { client.name == "admin" }
+        ->(_grant_flow, client) { client.name == "admin" },
       )
     end
 

data/spec/requests/flows/password_spec.rb

@@ -35,7 +35,7 @@ describe "Resource Owner Password Credentials Flow" do
         before do
           Doorkeeper.configuration.instance_variable_set(
             :@allow_grant_flow_for_client,
-            ->(_grant_flow, client) { client.name == "admin" }
+            ->(_grant_flow, client) { client.name == "admin" },
           )
         end
 
@@ -46,7 +46,7 @@ describe "Resource Owner Password Credentials Flow" do
             post password_token_endpoint_url(
               client_id: @client.uid,
               client_secret: "foobar",
-              resource_owner: @resource_owner
+              resource_owner: @resource_owner,
             )
           end.not_to(change { Doorkeeper::AccessToken.count })
 
@@ -99,7 +99,7 @@ describe "Resource Owner Password Credentials Flow" do
               post password_token_endpoint_url(
                 client_id: @client.uid,
                 client_secret: "foobar",
-                resource_owner: @resource_owner
+                resource_owner: @resource_owner,
               )
             end.not_to(change { Doorkeeper::AccessToken.count })
 
@@ -241,9 +241,11 @@ describe "Resource Owner Password Credentials Flow" do
 
   context "with invalid scopes" do
     subject do
-      post password_token_endpoint_url(client: @client,
-                                       resource_owner: @resource_owner,
-                                       scope: "random")
+      post password_token_endpoint_url(
+        client: @client,
+        resource_owner: @resource_owner,
+        scope: "random",
+      )
     end
 
     it "should not issue new token" do
@@ -263,9 +265,11 @@ describe "Resource Owner Password Credentials Flow" do
   context "with invalid user credentials" do
     it "should not issue new token with bad password" do
       expect do
-        post password_token_endpoint_url(client: @client,
-                                         resource_owner_username: @resource_owner.name,
-                                         resource_owner_password: "wrongpassword")
+        post password_token_endpoint_url(
+          client: @client,
+          resource_owner_username: @resource_owner.name,
+          resource_owner_password: "wrongpassword",
+        )
       end.to_not(change { Doorkeeper::AccessToken.count })
     end
 
@@ -274,14 +278,30 @@ describe "Resource Owner Password Credentials Flow" do
         post password_token_endpoint_url(client: @client)
       end.to_not(change { Doorkeeper::AccessToken.count })
     end
+
+    it "should not issue new token if resource_owner_from_credentials returned false or nil" do
+      config_is_set(:resource_owner_from_credentials) { false }
+
+      expect do
+        post password_token_endpoint_url(client: @client)
+      end.to_not(change { Doorkeeper::AccessToken.count })
+
+      config_is_set(:resource_owner_from_credentials) { nil }
+
+      expect do
+        post password_token_endpoint_url(client: @client)
+      end.to_not(change { Doorkeeper::AccessToken.count })
+    end
   end
 
   context "with invalid confidential client credentials" do
     it "should not issue new token with bad client credentials" do
       expect do
-        post password_token_endpoint_url(client_id: @client.uid,
-                                         client_secret: "bad_secret",
-                                         resource_owner: @resource_owner)
+        post password_token_endpoint_url(
+          client_id: @client.uid,
+          client_secret: "bad_secret",
+          resource_owner: @resource_owner,
+        )
       end.to_not(change { Doorkeeper::AccessToken.count })
     end
   end

data/spec/requests/flows/refresh_token_spec.rb

@@ -44,17 +44,17 @@ describe "Refresh Token Flow" do
         :access_token,
         application: @client,
         resource_owner_id: 1,
-        use_refresh_token: true
+        use_refresh_token: true,
       )
     end
 
     context "refresh_token revoked on use" do
       it "client request a token with refresh token" do
         post refresh_token_endpoint_url(
-          client: @client, refresh_token: @token.refresh_token
+          client: @client, refresh_token: @token.refresh_token,
         )
         should_have_json(
-          "refresh_token", Doorkeeper::AccessToken.last.refresh_token
+          "refresh_token", Doorkeeper::AccessToken.last.refresh_token,
         )
         expect(@token.reload).not_to be_revoked
       end
@@ -62,10 +62,10 @@ describe "Refresh Token Flow" do
       it "client request a token with expired access token" do
         @token.update_attribute :expires_in, -100
         post refresh_token_endpoint_url(
-          client: @client, refresh_token: @token.refresh_token
+          client: @client, refresh_token: @token.refresh_token,
         )
         should_have_json(
-          "refresh_token", Doorkeeper::AccessToken.last.refresh_token
+          "refresh_token", Doorkeeper::AccessToken.last.refresh_token,
         )
         expect(@token.reload).not_to be_revoked
       end
@@ -78,10 +78,10 @@ describe "Refresh Token Flow" do
 
       it "client request a token with refresh token" do
         post refresh_token_endpoint_url(
-          client: @client, refresh_token: @token.refresh_token
+          client: @client, refresh_token: @token.refresh_token,
         )
         should_have_json(
-          "refresh_token", Doorkeeper::AccessToken.last.refresh_token
+          "refresh_token", Doorkeeper::AccessToken.last.refresh_token,
         )
         expect(@token.reload).to be_revoked
       end
@@ -89,10 +89,10 @@ describe "Refresh Token Flow" do
       it "client request a token with expired access token" do
         @token.update_attribute :expires_in, -100
         post refresh_token_endpoint_url(
-          client: @client, refresh_token: @token.refresh_token
+          client: @client, refresh_token: @token.refresh_token,
         )
         should_have_json(
-          "refresh_token", Doorkeeper::AccessToken.last.refresh_token
+          "refresh_token", Doorkeeper::AccessToken.last.refresh_token,
         )
         expect(@token.reload).to be_revoked
       end
@@ -102,7 +102,7 @@ describe "Refresh Token Flow" do
       let(:public_client) do
         FactoryBot.create(
           :application,
-          confidential: false
+          confidential: false,
         )
       end
 
@@ -111,7 +111,7 @@ describe "Refresh Token Flow" do
           :access_token,
           application: @client,
           resource_owner_id: 1,
-          use_refresh_token: true
+          use_refresh_token: true,
         )
       end
 
@@ -120,14 +120,14 @@ describe "Refresh Token Flow" do
           :access_token,
           application: public_client,
           resource_owner_id: 1,
-          use_refresh_token: true
+          use_refresh_token: true,
         )
       end
 
       it "issues a new token without client_secret when refresh token was issued to a public client" do
         post refresh_token_endpoint_url(
           client_id: public_client.uid,
-          refresh_token: token_for_public_client.refresh_token
+          refresh_token: token_for_public_client.refresh_token,
         )
 
         new_token = Doorkeeper::AccessToken.last
@@ -146,7 +146,7 @@ describe "Refresh Token Flow" do
         post refresh_token_endpoint_url(
           client_id: "1",
           client_secret: "1",
-          refresh_token: token_for_private_client.refresh_token
+          refresh_token: token_for_private_client.refresh_token,
         )
 
         should_not_have_json "refresh_token"
@@ -185,7 +185,7 @@ describe "Refresh Token Flow" do
       end
       create_resource_owner
       _another_token = post password_token_endpoint_url(
-        client: @client, resource_owner: @resource_owner
+        client: @client, resource_owner: @resource_owner,
       )
       last_token.update_attribute :created_at, 5.seconds.ago
 
@@ -193,7 +193,7 @@ describe "Refresh Token Flow" do
         :access_token,
         application: @client,
         resource_owner_id: @resource_owner.id,
-        use_refresh_token: true
+        use_refresh_token: true,
       )
       @token.update_attribute :expires_in, -100
     end
@@ -201,7 +201,7 @@ describe "Refresh Token Flow" do
     context "refresh_token revoked on use" do
       it "client request a token after creating another token with the same user" do
         post refresh_token_endpoint_url(
-          client: @client, refresh_token: @token.refresh_token
+          client: @client, refresh_token: @token.refresh_token,
         )
 
         should_have_json "refresh_token", last_token.refresh_token
@@ -216,7 +216,7 @@ describe "Refresh Token Flow" do
 
       it "client request a token after creating another token with the same user" do
         post refresh_token_endpoint_url(
-          client: @client, refresh_token: @token.refresh_token
+          client: @client, refresh_token: @token.refresh_token,
         )
 
         should_have_json "refresh_token", last_token.refresh_token
@@ -226,7 +226,7 @@ describe "Refresh Token Flow" do
 
     def last_token
       Doorkeeper::AccessToken.last_authorized_token_for(
-        @client.id, @resource_owner.id
+        @client.id, @resource_owner.id,
       )
     end
   end