doorkeeper 5.2.3 → 5.3.0

data/spec/lib/oauth/helpers/scope_checker_spec.rb

@@ -44,15 +44,19 @@ module Doorkeeper::OAuth::Helpers
       end
 
       it "is valid if scope is included in the application scope list" do
-        expect(ScopeChecker.valid?(scope_str: "app123",
-                                   server_scopes: server_scopes,
-                                   app_scopes: application_scopes)).to be_truthy
+        expect(ScopeChecker.valid?(
+                 scope_str: "app123",
+                 server_scopes: server_scopes,
+                 app_scopes: application_scopes,
+               )).to be_truthy
       end
 
       it "is invalid if any scope is not included in the application" do
-        expect(ScopeChecker.valid?(scope_str: "svr",
-                                   server_scopes: server_scopes,
-                                   app_scopes: application_scopes)).to be_falsey
+        expect(ScopeChecker.valid?(
+                 scope_str: "svr",
+                 server_scopes: server_scopes,
+                 app_scopes: application_scopes,
+               )).to be_falsey
       end
     end
 
@@ -63,15 +67,19 @@ module Doorkeeper::OAuth::Helpers
 
       context "with scopes_by_grant_type not configured for grant_type" do
         it "is valid if the scope is in server scopes" do
-          expect(ScopeChecker.valid?(scope_str: "scope1",
-                                     server_scopes: server_scopes,
-                                     grant_type: Doorkeeper::OAuth::PASSWORD)).to be_truthy
+          expect(ScopeChecker.valid?(
+                   scope_str: "scope1",
+                   server_scopes: server_scopes,
+                   grant_type: Doorkeeper::OAuth::PASSWORD,
+                 )).to be_truthy
         end
 
         it "is invalid if the scope is not in server scopes" do
-          expect(ScopeChecker.valid?(scope_str: "unknown",
-                                     server_scopes: server_scopes,
-                                     grant_type: Doorkeeper::OAuth::PASSWORD)).to be_falsey
+          expect(ScopeChecker.valid?(
+                   scope_str: "unknown",
+                   server_scopes: server_scopes,
+                   grant_type: Doorkeeper::OAuth::PASSWORD,
+                 )).to be_falsey
         end
       end
 
@@ -82,15 +90,19 @@ module Doorkeeper::OAuth::Helpers
         end
 
         it "is valid if the scope is permitted for grant_type" do
-          expect(ScopeChecker.valid?(scope_str: "scope1",
-                                     server_scopes: server_scopes,
-                                     grant_type: Doorkeeper::OAuth::PASSWORD)).to be_truthy
+          expect(ScopeChecker.valid?(
+                   scope_str: "scope1",
+                   server_scopes: server_scopes,
+                   grant_type: Doorkeeper::OAuth::PASSWORD,
+                 )).to be_truthy
         end
 
         it "is invalid if the scope is permitted for grant_type" do
-          expect(ScopeChecker.valid?(scope_str: "scope2",
-                                     server_scopes: server_scopes,
-                                     grant_type: Doorkeeper::OAuth::PASSWORD)).to be_falsey
+          expect(ScopeChecker.valid?(
+                   scope_str: "scope2",
+                   server_scopes: server_scopes,
+                   grant_type: Doorkeeper::OAuth::PASSWORD,
+                 )).to be_falsey
         end
       end
     end

data/spec/lib/oauth/invalid_request_response_spec.rb

@@ -2,73 +2,71 @@
 
 require "spec_helper"
 
-module Doorkeeper::OAuth
-  describe InvalidRequestResponse do
-    describe "#name" do
-      it { expect(subject.name).to eq(:invalid_request) }
-    end
+describe Doorkeeper::OAuth::InvalidRequestResponse do
+  describe "#name" do
+    it { expect(subject.name).to eq(:invalid_request) }
+  end
 
-    describe "#status" do
-      it { expect(subject.status).to eq(:bad_request) }
-    end
+  describe "#status" do
+    it { expect(subject.status).to eq(:bad_request) }
+  end
 
-    describe :from_request do
-      let(:response) { InvalidRequestResponse.from_request(request) }
+  describe ".from_request" do
+    let(:response) { described_class.from_request(request) }
 
-      context "missing param" do
-        let(:request) { double(missing_param: "some_param") }
+    context "missing param" do
+      let(:request) { double(missing_param: "some_param") }
 
-        it "sets a description" do
-          expect(response.description).to eq(
-            I18n.t(:missing_param, scope: %i[doorkeeper errors messages invalid_request], value: "some_param")
-          )
-        end
+      it "sets a description" do
+        expect(response.description).to eq(
+          I18n.t(:missing_param, scope: %i[doorkeeper errors messages invalid_request], value: "some_param"),
+        )
+      end
 
-        it "sets the reason" do
-          expect(response.reason).to eq(:missing_param)
-        end
+      it "sets the reason" do
+        expect(response.reason).to eq(:missing_param)
       end
+    end
 
-      context "server doesn not support_pkce" do
-        let(:request) { double(invalid_request_reason: :not_support_pkce) }
+    context "server doesn't support_pkce" do
+      let(:request) { double(invalid_request_reason: :not_support_pkce) }
 
-        it "sets a description" do
-          expect(response.description).to eq(
-            I18n.t(:not_support_pkce, scope: %i[doorkeeper errors messages invalid_request])
-          )
-        end
+      it "sets a description" do
+        expect(response.description).to eq(
+          I18n.t(:not_support_pkce, scope: %i[doorkeeper errors messages invalid_request]),
+        )
+      end
 
-        it "sets the reason" do
-          expect(response.reason).to eq(:not_support_pkce)
-        end
+      it "sets the reason" do
+        expect(response.reason).to eq(:not_support_pkce)
       end
+    end
 
-      context "request is not authorized" do
-        let(:request) { double(invalid_request_reason: :request_not_authorized) }
+    context "request is not authorized" do
+      let(:request) { double(invalid_request_reason: :request_not_authorized) }
 
-        it "sets a description" do
-          expect(response.description).to eq(
-            I18n.t(:request_not_authorized, scope: %i[doorkeeper errors messages invalid_request])
-          )
-        end
+      it "sets a description" do
+        expect(response.description).to eq(
+          I18n.t(:request_not_authorized, scope: %i[doorkeeper errors messages invalid_request]),
+        )
+      end
 
-        it "sets the reason" do
-          expect(response.reason).to eq(:request_not_authorized)
-        end
+      it "sets the reason" do
+        expect(response.reason).to eq(:request_not_authorized)
       end
+    end
 
-      context "unknown reason" do
-        let(:request) { double(invalid_request_reason: :unknown_reason) }
+    context "unknown reason" do
+      let(:request) { double(invalid_request_reason: :unknown_reason) }
 
-        it "sets a description" do
-          expect(response.description).to eq(
-            I18n.t(:unknown, scope: %i[doorkeeper errors messages invalid_request])
-          )
-        end
+      it "sets a description" do
+        expect(response.description).to eq(
+          I18n.t(:unknown, scope: %i[doorkeeper errors messages invalid_request]),
+        )
+      end
 
-        it "unknown reason" do
-          expect(response.reason).to eq(:unknown_reason)
-        end
+      it "unknown reason" do
+        expect(response.reason).to eq(:unknown_reason)
       end
     end
   end

data/spec/lib/oauth/invalid_token_response_spec.rb

@@ -2,53 +2,51 @@
 
 require "spec_helper"
 
-module Doorkeeper::OAuth
-  describe InvalidTokenResponse do
-    describe "#name" do
-      it { expect(subject.name).to eq(:invalid_token) }
-    end
+describe Doorkeeper::OAuth::InvalidTokenResponse do
+  describe "#name" do
+    it { expect(subject.name).to eq(:invalid_token) }
+  end
 
-    describe "#status" do
-      it { expect(subject.status).to eq(:unauthorized) }
-    end
+  describe "#status" do
+    it { expect(subject.status).to eq(:unauthorized) }
+  end
 
-    describe :from_access_token do
-      let(:response) { InvalidTokenResponse.from_access_token(access_token) }
+  describe ".from_access_token" do
+    let(:response) { described_class.from_access_token(access_token) }
 
-      context "revoked" do
-        let(:access_token) { double(revoked?: true, expired?: true) }
+    context "revoked" do
+      let(:access_token) { double(revoked?: true, expired?: true) }
 
-        it "sets a description" do
-          expect(response.description).to include("revoked")
-        end
+      it "sets a description" do
+        expect(response.description).to include("revoked")
+      end
 
-        it "sets the reason" do
-          expect(response.reason).to eq(:revoked)
-        end
+      it "sets the reason" do
+        expect(response.reason).to eq(:revoked)
       end
+    end
 
-      context "expired" do
-        let(:access_token) { double(revoked?: false, expired?: true) }
+    context "expired" do
+      let(:access_token) { double(revoked?: false, expired?: true) }
 
-        it "sets a description" do
-          expect(response.description).to include("expired")
-        end
+      it "sets a description" do
+        expect(response.description).to include("expired")
+      end
 
-        it "sets the reason" do
-          expect(response.reason).to eq(:expired)
-        end
+      it "sets the reason" do
+        expect(response.reason).to eq(:expired)
       end
+    end
 
-      context "unknown" do
-        let(:access_token) { double(revoked?: false, expired?: false) }
+    context "unknown" do
+      let(:access_token) { double(revoked?: false, expired?: false) }
 
-        it "sets a description" do
-          expect(response.description).to include("invalid")
-        end
+      it "sets a description" do
+        expect(response.description).to include("invalid")
+      end
 
-        it "sets the reason" do
-          expect(response.reason).to eq(:unknown)
-        end
+      it "sets the reason" do
+        expect(response.reason).to eq(:unknown)
       end
     end
   end

data/spec/lib/oauth/password_access_token_request_spec.rb

@@ -2,191 +2,189 @@
 
 require "spec_helper"
 
-module Doorkeeper::OAuth
-  describe PasswordAccessTokenRequest do
-    let(:server) do
-      double(
-        :server,
-        default_scopes: Doorkeeper::OAuth::Scopes.new,
-        access_token_expires_in: 2.hours,
-        refresh_token_enabled?: false,
-        custom_access_token_expires_in: lambda { |context|
-          context.grant_type == Doorkeeper::OAuth::PASSWORD ? 1234 : nil
-        }
-      )
-    end
-    let(:client) { FactoryBot.create(:application) }
-    let(:owner)  { double :owner, id: 99 }
+describe Doorkeeper::OAuth::PasswordAccessTokenRequest do
+  let(:server) do
+    double(
+      :server,
+      default_scopes: Doorkeeper::OAuth::Scopes.new,
+      access_token_expires_in: 2.hours,
+      refresh_token_enabled?: false,
+      custom_access_token_expires_in: lambda { |context|
+        context.grant_type == Doorkeeper::OAuth::PASSWORD ? 1234 : nil
+      },
+    )
+  end
+  let(:client) { FactoryBot.create(:application) }
+  let(:owner)  { double :owner, id: 99 }
 
-    before do
-      allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
-    end
+  before do
+    allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
+  end
 
-    subject do
-      PasswordAccessTokenRequest.new(server, client, owner)
-    end
+  subject do
+    described_class.new(server, client, owner)
+  end
 
-    it "issues a new token for the client" do
-      expect do
-        subject.authorize
-      end.to change { client.reload.access_tokens.count }.by(1)
+  it "issues a new token for the client" do
+    expect do
+      subject.authorize
+    end.to change { client.reload.access_tokens.count }.by(1)
 
-      expect(client.reload.access_tokens.max_by(&:created_at).expires_in).to eq(1234)
-    end
+    expect(client.reload.access_tokens.max_by(&:created_at).expires_in).to eq(1234)
+  end
 
-    it "issues a new token without a client" do
-      expect do
-        subject.client = nil
-        subject.authorize
-      end.to change { Doorkeeper::AccessToken.count }.by(1)
-    end
+  it "issues a new token without a client" do
+    expect do
+      subject.client = nil
+      subject.authorize
+    end.to change { Doorkeeper::AccessToken.count }.by(1)
+  end
 
-    it "does not issue a new token with an invalid client" do
-      expect do
-        subject.client = nil
-        subject.parameters = { client_id: "bad_id" }
-        subject.authorize
-      end.not_to(change { Doorkeeper::AccessToken.count })
+  it "does not issue a new token with an invalid client" do
+    expect do
+      subject.client = nil
+      subject.parameters = { client_id: "bad_id" }
+      subject.authorize
+    end.not_to(change { Doorkeeper::AccessToken.count })
 
-      expect(subject.error).to eq(:invalid_client)
-    end
+    expect(subject.error).to eq(:invalid_client)
+  end
 
-    it "requires the owner" do
-      subject.resource_owner = nil
-      subject.validate
-      expect(subject.error).to eq(:invalid_grant)
-    end
+  it "requires the owner" do
+    subject.resource_owner = nil
+    subject.validate
+    expect(subject.error).to eq(:invalid_grant)
+  end
 
-    it "optionally accepts the client" do
-      subject.client = nil
-      expect(subject).to be_valid
-    end
+  it "optionally accepts the client" do
+    subject.client = nil
+    expect(subject).to be_valid
+  end
 
-    it "creates token even when there is already one (default)" do
-      FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
+  it "creates token even when there is already one (default)" do
+    FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
 
-      expect do
-        subject.authorize
-      end.to change { Doorkeeper::AccessToken.count }.by(1)
-    end
+    expect do
+      subject.authorize
+    end.to change { Doorkeeper::AccessToken.count }.by(1)
+  end
 
-    it "skips token creation if there is already one reusable" do
-      allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-      FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
+  it "skips token creation if there is already one reusable" do
+    allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
+    FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
 
-      expect do
-        subject.authorize
-      end.not_to(change { Doorkeeper::AccessToken.count })
-    end
+    expect do
+      subject.authorize
+    end.not_to(change { Doorkeeper::AccessToken.count })
+  end
 
-    it "creates token when there is already one but non reusable" do
-      allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-      FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
-      allow_any_instance_of(Doorkeeper::AccessToken).to receive(:reusable?).and_return(false)
+  it "creates token when there is already one but non reusable" do
+    allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
+    FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
+    allow_any_instance_of(Doorkeeper::AccessToken).to receive(:reusable?).and_return(false)
 
-      expect do
-        subject.authorize
-      end.to change { Doorkeeper::AccessToken.count }.by(1)
-    end
+    expect do
+      subject.authorize
+    end.to change { Doorkeeper::AccessToken.count }.by(1)
+  end
 
-    it "calls configured request callback methods" do
-      expect(Doorkeeper.configuration.before_successful_strategy_response)
-        .to receive(:call).with(subject).once
+  it "calls configured request callback methods" do
+    expect(Doorkeeper.configuration.before_successful_strategy_response)
+      .to receive(:call).with(subject).once
 
-      expect(Doorkeeper.configuration.after_successful_strategy_response)
-        .to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
+    expect(Doorkeeper.configuration.after_successful_strategy_response)
+      .to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
 
-      subject.authorize
+    subject.authorize
+  end
+
+  describe "with scopes" do
+    subject do
+      described_class.new(server, client, owner, scope: "public")
     end
 
-    describe "with scopes" do
-      subject do
-        PasswordAccessTokenRequest.new(server, client, owner, scope: "public")
+    context "when scopes_by_grant_type is not configured for grant_type" do
+      it "returns error when scopes are invalid" do
+        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("another"))
+        subject.validate
+        expect(subject.error).to eq(:invalid_scope)
       end
 
-      context "when scopes_by_grant_type is not configured for grant_type" do
-        it "returns error when scopes are invalid" do
-          allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("another"))
-          subject.validate
-          expect(subject.error).to eq(:invalid_scope)
-        end
-
-        it "creates the token with scopes if scopes are valid" do
-          allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
-          expect do
-            subject.authorize
-          end.to change { Doorkeeper::AccessToken.count }.by(1)
-
-          expect(Doorkeeper::AccessToken.last.scopes).to include("public")
-        end
-      end
+      it "creates the token with scopes if scopes are valid" do
+        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
+        expect do
+          subject.authorize
+        end.to change { Doorkeeper::AccessToken.count }.by(1)
 
-      context "when scopes_by_grant_type is configured for grant_type" do
-        it "returns error when scopes are valid but not permitted for grant_type" do
-          allow(server)
-            .to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
-          allow(Doorkeeper.configuration)
-            .to receive(:scopes_by_grant_type).and_return(password: "another")
-          subject.validate
-          expect(subject.error).to eq(:invalid_scope)
-        end
-
-        it "creates the token with scopes if scopes are valid and permitted for grant_type" do
-          allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
-          allow(Doorkeeper.configuration)
-            .to receive(:scopes_by_grant_type).and_return(password: [:public])
-
-          expect do
-            subject.authorize
-          end.to change { Doorkeeper::AccessToken.count }.by(1)
-
-          expect(Doorkeeper::AccessToken.last.scopes).to include("public")
-        end
+        expect(Doorkeeper::AccessToken.last.scopes).to include("public")
       end
     end
 
-    describe "with custom expiry" do
-      let(:server) do
-        double(
-          :server,
-          default_scopes: Doorkeeper::OAuth::Scopes.new,
-          access_token_expires_in: 2.hours,
-          refresh_token_enabled?: false,
-          custom_access_token_expires_in: lambda { |context|
-            if context.scopes.exists?("public")
-              222
-            elsif context.scopes.exists?("magic")
-              Float::INFINITY
-            end
-          }
-        )
-      end
-
-      before do
-        allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
+    context "when scopes_by_grant_type is configured for grant_type" do
+      it "returns error when scopes are valid but not permitted for grant_type" do
+        allow(server)
+          .to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
+        allow(Doorkeeper.configuration)
+          .to receive(:scopes_by_grant_type).and_return(password: "another")
+        subject.validate
+        expect(subject.error).to eq(:invalid_scope)
       end
 
-      it "checks scopes" do
-        subject = PasswordAccessTokenRequest.new(server, client, owner, scope: "public")
+      it "creates the token with scopes if scopes are valid and permitted for grant_type" do
         allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
+        allow(Doorkeeper.configuration)
+          .to receive(:scopes_by_grant_type).and_return(password: [:public])
 
         expect do
           subject.authorize
         end.to change { Doorkeeper::AccessToken.count }.by(1)
 
-        expect(Doorkeeper::AccessToken.last.expires_in).to eq(222)
+        expect(Doorkeeper::AccessToken.last.scopes).to include("public")
       end
+    end
+  end
 
-      it "falls back to the default otherwise" do
-        subject = PasswordAccessTokenRequest.new(server, client, owner, scope: "private")
-        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("private"))
+  describe "with custom expiry" do
+    let(:server) do
+      double(
+        :server,
+        default_scopes: Doorkeeper::OAuth::Scopes.new,
+        access_token_expires_in: 2.hours,
+        refresh_token_enabled?: false,
+        custom_access_token_expires_in: lambda { |context|
+          if context.scopes.exists?("public")
+            222
+          elsif context.scopes.exists?("magic")
+            Float::INFINITY
+          end
+        },
+      )
+    end
 
-        expect do
-          subject.authorize
-        end.to change { Doorkeeper::AccessToken.count }.by(1)
+    before do
+      allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
+    end
 
-        expect(Doorkeeper::AccessToken.last.expires_in).to eq(2.hours)
-      end
+    it "checks scopes" do
+      subject = described_class.new(server, client, owner, scope: "public")
+      allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
+
+      expect do
+        subject.authorize
+      end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+      expect(Doorkeeper::AccessToken.last.expires_in).to eq(222)
+    end
+
+    it "falls back to the default otherwise" do
+      subject = described_class.new(server, client, owner, scope: "private")
+      allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("private"))
+
+      expect do
+        subject.authorize
+      end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+      expect(Doorkeeper::AccessToken.last.expires_in).to eq(2.hours)
     end
   end
 end