doorkeeper 5.3.0 → 5.4.0.rc1

data/spec/lib/oauth/authorization_code_request_spec.rb

@@ -12,7 +12,12 @@ describe Doorkeeper::OAuth::AuthorizationCodeRequest do
            }
   end
 
-  let(:grant)  { FactoryBot.create :access_grant }
+  let(:resource_owner) { FactoryBot.create :resource_owner }
+  let(:grant) do
+    FactoryBot.create :access_grant,
+                      resource_owner_id: resource_owner.id,
+                      resource_owner_type: resource_owner.class.name
+  end
   let(:client) { grant.application }
   let(:redirect_uri) { client.redirect_uri }
   let(:params) { { redirect_uri: redirect_uri } }
@@ -49,43 +54,42 @@ describe Doorkeeper::OAuth::AuthorizationCodeRequest do
   end
 
   it "requires the grant" do
-    subject.grant = nil
+    subject = described_class.new(server, nil, client, params)
     subject.validate
     expect(subject.error).to eq(:invalid_grant)
   end
 
   it "requires the client" do
-    subject.client = nil
+    subject = described_class.new(server, grant, nil, params)
     subject.validate
     expect(subject.error).to eq(:invalid_client)
   end
 
   it "requires the redirect_uri" do
-    subject.redirect_uri = nil
+    subject = described_class.new(server, grant, nil, params.except(:redirect_uri))
     subject.validate
     expect(subject.error).to eq(:invalid_request)
     expect(subject.missing_param).to eq(:redirect_uri)
   end
 
   it "invalid code_verifier param because server does not support pkce" do
-    # Some other ORMs work relies on #respond_to? so it's not a good idea to stub it :\
-    allow_any_instance_of(Doorkeeper::AccessGrant).to receive(:respond_to?).with(anything).and_call_original
-    allow_any_instance_of(Doorkeeper::AccessGrant).to receive(:respond_to?).with(:code_challenge).and_return(false)
-
-    subject.code_verifier = "a45a9fea-0676-477e-95b1-a40f72ac3cfb"
+    allow(Doorkeeper::AccessGrant).to receive(:pkce_supported?).and_return(false)
+    code_verifier = "a45a9fea-0676-477e-95b1-a40f72ac3cfb"
+    subject = described_class.new(server, grant, client, params.merge(code_verifier: code_verifier))
     subject.validate
     expect(subject.error).to eq(:invalid_request)
     expect(subject.invalid_request_reason).to eq(:not_support_pkce)
   end
 
   it "matches the redirect_uri with grant's one" do
-    subject.redirect_uri = "http://other.com"
+    subject = described_class.new(server, grant, client, params.merge(redirect_uri: "http://other.com"))
     subject.validate
     expect(subject.error).to eq(:invalid_grant)
   end
 
   it "matches the client with grant's one" do
-    subject.client = FactoryBot.create :application
+    other_client = FactoryBot.create :application
+    subject = described_class.new(server, grant, other_client, params)
     subject.validate
     expect(subject.error).to eq(:invalid_grant)
   end
@@ -100,8 +104,11 @@ describe Doorkeeper::OAuth::AuthorizationCodeRequest do
     end
 
     FactoryBot.create(
-      :access_token, application_id: client.id,
-                     resource_owner_id: grant.resource_owner_id, scopes: grant.scopes.to_s,
+      :access_token,
+      application_id: client.id,
+      resource_owner_id: grant.resource_owner_id,
+      resource_owner_type: grant.resource_owner_type,
+      scopes: grant.scopes.to_s,
     )
 
     expect { subject.authorize }.to_not(change { Doorkeeper::AccessToken.count })
@@ -117,8 +124,11 @@ describe Doorkeeper::OAuth::AuthorizationCodeRequest do
     end
 
     FactoryBot.create(
-      :access_token, application_id: client.id,
-                     resource_owner_id: grant.resource_owner_id, scopes: grant.scopes.to_s,
+      :access_token,
+      application_id: client.id,
+      resource_owner_id: grant.resource_owner_id,
+      resource_owner_type: grant.resource_owner_type,
+      scopes: grant.scopes.to_s,
     )
 
     allow_any_instance_of(Doorkeeper::AccessToken).to receive(:reusable?).and_return(false)

data/spec/lib/oauth/base_request_spec.rb

@@ -117,10 +117,12 @@ describe Doorkeeper::OAuth::BaseRequest do
   end
 
   describe "#find_or_create_access_token" do
+    let(:resource_owner) { FactoryBot.build_stubbed(:resource_owner) }
+
     it "returns an instance of AccessToken" do
       result = subject.find_or_create_access_token(
         client,
-        "1",
+        resource_owner,
         "public",
         server,
       )
@@ -140,7 +142,7 @@ describe Doorkeeper::OAuth::BaseRequest do
 
       result = subject.find_or_create_access_token(
         client,
-        "1",
+        resource_owner,
         "public",
         server,
       )
@@ -161,7 +163,7 @@ describe Doorkeeper::OAuth::BaseRequest do
 
       result = subject.find_or_create_access_token(
         client,
-        "1",
+        resource_owner,
         "public",
         server,
       )
@@ -169,7 +171,7 @@ describe Doorkeeper::OAuth::BaseRequest do
 
       result = subject.find_or_create_access_token(
         client,
-        "1",
+        resource_owner,
         "private",
         server,
       )
@@ -205,20 +207,4 @@ describe Doorkeeper::OAuth::BaseRequest do
       end
     end
   end
-
-  describe "#valid?" do
-    context "error is nil" do
-      it "returns true" do
-        allow(subject).to receive(:error).and_return(nil).once
-        expect(subject.valid?).to eq(true)
-      end
-    end
-
-    context "error is not nil" do
-      it "returns false" do
-        allow(subject).to receive(:error).and_return(Object.new).once
-        expect(subject.valid?).to eq(false)
-      end
-    end
-  end
 end

data/spec/lib/oauth/client_credentials/creator_spec.rb

@@ -2,133 +2,134 @@
 
 require "spec_helper"
 
-class Doorkeeper::OAuth::ClientCredentialsRequest
-  describe Creator do
-    let(:client) { FactoryBot.create :application }
-    let(:scopes) { Doorkeeper::OAuth::Scopes.from_string("public") }
+describe Doorkeeper::OAuth::ClientCredentials::Creator do
+  let(:client) { FactoryBot.create :application }
+  let(:scopes) { Doorkeeper::OAuth::Scopes.from_string("public") }
 
-    before do
-      default_scopes_exist :public
-    end
+  before do
+    default_scopes_exist :public
+  end
 
-    it "creates a new token" do
-      expect do
-        subject.call(client, scopes)
-      end.to change { Doorkeeper::AccessToken.count }.by(1)
+  it "creates a new token" do
+    expect do
+      subject.call(client, scopes)
+    end.to change { Doorkeeper::AccessToken.count }.by(1)
+  end
+
+  context "when reuse_access_token is true" do
+    before do
+      allow(Doorkeeper.config).to receive(:reuse_access_token).and_return(true)
     end
 
-    context "when reuse_access_token is true" do
-      context "when expiration is disabled" do
-        it "returns the existing valid token" do
-          allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-          existing_token = subject.call(client, scopes)
+    context "when expiration is disabled" do
+      it "returns the existing valid token" do
+        existing_token = subject.call(client, scopes)
 
-          result = subject.call(client, scopes)
+        result = subject.call(client, scopes)
 
-          expect(Doorkeeper::AccessToken.count).to eq(1)
-          expect(result).to eq(existing_token)
-        end
+        expect(Doorkeeper::AccessToken.count).to eq(1)
+        expect(result).to eq(existing_token)
       end
+    end
 
-      context "when existing token has not crossed token_reuse_limit" do
-        let!(:existing_token) { subject.call(client, scopes, expires_in: 1000) }
-
-        before do
-          allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-          allow(Doorkeeper.configuration).to receive(:token_reuse_limit).and_return(50)
-          allow_any_instance_of(Doorkeeper::AccessToken).to receive(:expires_in_seconds).and_return(600)
-        end
-
-        it "returns the existing valid token" do
-          result = subject.call(client, scopes, expires_in: 1000)
+    context "when existing token has not crossed token_reuse_limit" do
+      let!(:existing_token) { subject.call(client, scopes, expires_in: 1000) }
 
-          expect(Doorkeeper::AccessToken.count).to eq(1)
-          expect(result).to eq(existing_token)
-        end
+      before do
+        allow(Doorkeeper.config).to receive(:token_reuse_limit).and_return(50)
+        allow_any_instance_of(Doorkeeper::AccessToken).to receive(:expires_in_seconds).and_return(600)
+      end
 
-        context "and when revoke_previous_client_credentials_token is true" do
-          before do
-            allow(Doorkeeper.configuration).to receive(:revoke_previous_client_credentials_token).and_return(false)
-          end
+      it "returns the existing valid token" do
+        result = subject.call(client, scopes, expires_in: 1000)
 
-          it "does not revoke the existing valid token" do
-            subject.call(client, scopes, expires_in: 1000)
-            expect(existing_token.reload).not_to be_revoked
-          end
-        end
+        expect(Doorkeeper::AccessToken.count).to eq(1)
+        expect(result).to eq(existing_token)
       end
 
-      context "when existing token has crossed token_reuse_limit" do
-        it "returns a new token" do
-          allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-          allow(Doorkeeper.configuration).to receive(:token_reuse_limit).and_return(50)
-          existing_token = subject.call(client, scopes, expires_in: 1000)
-
-          allow_any_instance_of(Doorkeeper::AccessToken).to receive(:expires_in_seconds).and_return(400)
-          result = subject.call(client, scopes, expires_in: 1000)
+      context "and when revoke_previous_client_credentials_token is false" do
+        before do
+          allow(Doorkeeper.config).to receive(:revoke_previous_client_credentials_token).and_return(false)
+        end
 
-          expect(Doorkeeper::AccessToken.count).to eq(2)
-          expect(result).not_to eq(existing_token)
+        it "does not revoke the existing valid token" do
+          subject.call(client, scopes, expires_in: 1000)
+          expect(existing_token.reload).not_to be_revoked
         end
       end
+    end
 
-      context "when existing token has been expired" do
-        it "returns a new token" do
-          allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-          allow(Doorkeeper.configuration).to receive(:token_reuse_limit).and_return(50)
-          existing_token = subject.call(client, scopes, expires_in: 1000)
+    context "when existing token has crossed token_reuse_limit" do
+      it "returns a new token" do
+        allow(Doorkeeper.config).to receive(:token_reuse_limit).and_return(50)
+        existing_token = subject.call(client, scopes, expires_in: 1000)
 
-          allow_any_instance_of(Doorkeeper::AccessToken).to receive(:expired?).and_return(true)
-          result = subject.call(client, scopes, expires_in: 1000)
+        allow_any_instance_of(Doorkeeper::AccessToken).to receive(:expires_in_seconds).and_return(400)
+        result = subject.call(client, scopes, expires_in: 1000)
 
-          expect(Doorkeeper::AccessToken.count).to eq(2)
-          expect(result).not_to eq(existing_token)
-        end
+        expect(Doorkeeper::AccessToken.count).to eq(2)
+        expect(result).not_to eq(existing_token)
       end
     end
 
-    context "when reuse_access_token is false" do
+    context "when existing token has been expired" do
       it "returns a new token" do
-        allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(false)
-        existing_token = subject.call(client, scopes)
+        allow(Doorkeeper.configuration).to receive(:token_reuse_limit).and_return(50)
+        existing_token = subject.call(client, scopes, expires_in: 1000)
 
-        result = subject.call(client, scopes)
+        allow_any_instance_of(Doorkeeper::AccessToken).to receive(:expired?).and_return(true)
+        result = subject.call(client, scopes, expires_in: 1000)
 
         expect(Doorkeeper::AccessToken.count).to eq(2)
         expect(result).not_to eq(existing_token)
       end
     end
+  end
 
-    context "when revoke_previous_client_credentials_token is true" do
-      let!(:existing_token) { subject.call(client, scopes, expires_in: 1000) }
+  context "when reuse_access_token is false" do
+    before do
+      allow(Doorkeeper.config).to receive(:reuse_access_token).and_return(false)
+    end
 
-      before do
-        allow(Doorkeeper.configuration).to receive(:revoke_previous_client_credentials_token).and_return(true)
-      end
+    it "returns a new token" do
+      existing_token = subject.call(client, scopes)
 
-      it "revokes the existing token" do
-        subject.call(client, scopes, expires_in: 1000)
-        expect(existing_token.reload).to be_revoked
-      end
+      result = subject.call(client, scopes)
+
+      expect(Doorkeeper::AccessToken.count).to eq(2)
+      expect(result).not_to eq(existing_token)
     end
+  end
 
-    context "when revoke_previous_client_credentials_token is false" do
-      let!(:existing_token) { subject.call(client, scopes, expires_in: 1000) }
+  context "when revoke_previous_client_credentials_token is true" do
+    let!(:existing_token) { subject.call(client, scopes, expires_in: 1000) }
 
-      before do
-        allow(Doorkeeper.configuration).to receive(:revoke_previous_client_credentials_token).and_return(false)
-      end
+    before do
+      allow(Doorkeeper.configuration).to receive(:revoke_previous_client_credentials_token).and_return(true)
+    end
 
-      it "does not revoke the existing token" do
-        subject.call(client, scopes, expires_in: 1000)
-        expect(existing_token.reload).not_to be_revoked
-      end
+    it "revokes the existing token" do
+      subject.call(client, scopes, expires_in: 1000)
+      expect(existing_token.reload).to be_revoked
+    end
+  end
+
+  context "when revoke_previous_client_credentials_token is false" do
+    let!(:existing_token) { subject.call(client, scopes, expires_in: 1000) }
+
+    before do
+      allow(Doorkeeper.configuration).to receive(:revoke_previous_client_credentials_token).and_return(false)
     end
 
-    it "returns false if creation fails" do
-      expect(Doorkeeper::AccessToken).to receive(:find_or_create_for).and_return(false)
-      created = subject.call(client, scopes)
-      expect(created).to be_falsey
+    it "does not revoke the existing token" do
+      subject.call(client, scopes, expires_in: 1000)
+      expect(existing_token.reload).not_to be_revoked
     end
   end
+
+  it "returns false if creation fails" do
+    expect(Doorkeeper::AccessToken).to receive(:find_or_create_for).and_return(false)
+    created = subject.call(client, scopes)
+    expect(created).to be_falsey
+  end
 end

data/spec/lib/oauth/client_credentials/issuer_spec.rb

@@ -2,110 +2,108 @@
 
 require "spec_helper"
 
-class Doorkeeper::OAuth::ClientCredentialsRequest
-  describe Issuer do
-    let(:creator) { double :access_token_creator }
-    let(:server) do
-      double(
-        :server,
-        access_token_expires_in: 100,
-      )
+describe Doorkeeper::OAuth::ClientCredentials::Issuer do
+  let(:creator) { double :access_token_creator }
+  let(:server) do
+    double(
+      :server,
+      access_token_expires_in: 100,
+    )
+  end
+  let(:validator) { double :validator, valid?: true }
+
+  before do
+    allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(false)
+  end
+
+  subject { described_class.new(server, validator) }
+
+  describe "#create" do
+    let(:client) { double :client, id: "some-id" }
+    let(:scopes) { "some scope" }
+
+    it "creates and sets the token" do
+      expect(creator).to receive(:call).and_return("token")
+      subject.create client, scopes, creator
+
+      expect(subject.token).to eq("token")
     end
-    let(:validator) { double :validator, valid?: true }
 
-    before do
-      allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(false)
+    it "creates with correct token parameters" do
+      expect(creator).to receive(:call).with(
+        client,
+        scopes,
+        expires_in: 100,
+        use_refresh_token: false,
+      )
+
+      subject.create client, scopes, creator
     end
 
-    subject { Issuer.new(server, validator) }
+    it "has error set to :server_error if creator fails" do
+      expect(creator).to receive(:call).and_return(false)
+      subject.create client, scopes, creator
+
+      expect(subject.error).to eq(:server_error)
+    end
 
-    describe :create do
-      let(:client) { double :client, id: "some-id" }
-      let(:scopes) { "some scope" }
+    context "when validator fails" do
+      before do
+        allow(validator).to receive(:valid?).and_return(false)
+        allow(validator).to receive(:error).and_return(:validation_error)
+        expect(creator).not_to receive(:create)
+      end
 
-      it "creates and sets the token" do
-        expect(creator).to receive(:call).and_return("token")
+      it "has error set from validator" do
         subject.create client, scopes, creator
+        expect(subject.error).to eq(:validation_error)
+      end
 
-        expect(subject.token).to eq("token")
+      it "returns false" do
+        expect(subject.create(client, scopes, creator)).to be_falsey
       end
+    end
 
-      it "creates with correct token parameters" do
+    context "with custom expiration" do
+      let(:custom_ttl_grant) { 1234 }
+      let(:custom_ttl_scope) { 1235 }
+      let(:custom_scope) { "special" }
+      let(:server) do
+        double(
+          :server,
+          custom_access_token_expires_in: lambda { |context|
+            # scopes is normally an object but is a string in this test
+            if context.scopes == custom_scope
+              custom_ttl_scope
+            elsif context.grant_type == Doorkeeper::OAuth::CLIENT_CREDENTIALS
+              custom_ttl_grant
+            end
+          },
+        )
+      end
+
+      before do
+        allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
+      end
+
+      it "respects grant based rules" do
         expect(creator).to receive(:call).with(
           client,
           scopes,
-          expires_in: 100,
+          expires_in: custom_ttl_grant,
           use_refresh_token: false,
         )
-
         subject.create client, scopes, creator
       end
 
-      it "has error set to :server_error if creator fails" do
-        expect(creator).to receive(:call).and_return(false)
-        subject.create client, scopes, creator
-
-        expect(subject.error).to eq(:server_error)
-      end
-
-      context "when validator fails" do
-        before do
-          allow(validator).to receive(:valid?).and_return(false)
-          allow(validator).to receive(:error).and_return(:validation_error)
-          expect(creator).not_to receive(:create)
-        end
-
-        it "has error set from validator" do
-          subject.create client, scopes, creator
-          expect(subject.error).to eq(:validation_error)
-        end
-
-        it "returns false" do
-          expect(subject.create(client, scopes, creator)).to be_falsey
-        end
-      end
-
-      context "with custom expiration" do
-        let(:custom_ttl_grant) { 1234 }
-        let(:custom_ttl_scope) { 1235 }
-        let(:custom_scope) { "special" }
-        let(:server) do
-          double(
-            :server,
-            custom_access_token_expires_in: lambda { |context|
-              # scopes is normally an object but is a string in this test
-              if context.scopes == custom_scope
-                custom_ttl_scope
-              elsif context.grant_type == Doorkeeper::OAuth::CLIENT_CREDENTIALS
-                custom_ttl_grant
-              end
-            },
-          )
-        end
-
-        before do
-          allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
-        end
-
-        it "respects grant based rules" do
-          expect(creator).to receive(:call).with(
-            client,
-            scopes,
-            expires_in: custom_ttl_grant,
-            use_refresh_token: false,
-          )
-          subject.create client, scopes, creator
-        end
-
-        it "respects scope based rules" do
-          expect(creator).to receive(:call).with(
-            client,
-            custom_scope,
-            expires_in: custom_ttl_scope,
-            use_refresh_token: false,
-          )
-          subject.create client, custom_scope, creator
-        end
+      it "respects scope based rules" do
+        expect(creator).to receive(:call).with(
+          client,
+          custom_scope,
+          expires_in: custom_ttl_scope,
+          use_refresh_token: false,
+        )
+        subject.create client, custom_scope, creator
       end
     end
   end

data/spec/lib/oauth/client_credentials/validation_spec.rb

@@ -2,58 +2,56 @@
 
 require "spec_helper"
 
-class Doorkeeper::OAuth::ClientCredentialsRequest
-  describe Validator do
-    let(:server)      { double :server, scopes: nil }
-    let(:application) { double scopes: nil }
-    let(:client)      { double application: application }
-    let(:request)     { double :request, client: client, scopes: nil }
+describe Doorkeeper::OAuth::ClientCredentials::Validator do
+  let(:server)      { double :server, scopes: nil }
+  let(:application) { double scopes: nil }
+  let(:client)      { double application: application }
+  let(:request)     { double :request, client: client, scopes: nil }
 
-    subject { described_class.new(server, request) }
+  subject { described_class.new(server, request) }
 
-    it "is valid with valid request" do
-      expect(subject).to be_valid
-    end
+  it "is valid with valid request" do
+    expect(subject).to be_valid
+  end
 
-    it "is invalid when client is not present" do
-      allow(request).to receive(:client).and_return(nil)
+  it "is invalid when client is not present" do
+    allow(request).to receive(:client).and_return(nil)
+    expect(subject).not_to be_valid
+  end
+
+  context "with scopes" do
+    it "is invalid when scopes are not included in the server" do
+      server_scopes = Doorkeeper::OAuth::Scopes.from_string "email"
+      allow(request).to receive(:grant_type).and_return(Doorkeeper::OAuth::CLIENT_CREDENTIALS)
+      allow(server).to receive(:scopes).and_return(server_scopes)
+      allow(request).to receive(:scopes).and_return(
+        Doorkeeper::OAuth::Scopes.from_string("invalid"),
+      )
       expect(subject).not_to be_valid
     end
 
-    context "with scopes" do
-      it "is invalid when scopes are not included in the server" do
-        server_scopes = Doorkeeper::OAuth::Scopes.from_string "email"
+    context "with application scopes" do
+      it "is valid when scopes are included in the application" do
+        application_scopes = Doorkeeper::OAuth::Scopes.from_string "app"
+        server_scopes = Doorkeeper::OAuth::Scopes.from_string "email app"
+        allow(application).to receive(:scopes).and_return(application_scopes)
+        allow(server).to receive(:scopes).and_return(server_scopes)
+        allow(request).to receive(:grant_type).and_return(Doorkeeper::OAuth::CLIENT_CREDENTIALS)
+        allow(request).to receive(:scopes).and_return(application_scopes)
+        expect(subject).to be_valid
+      end
+
+      it "is invalid when scopes are not included in the application" do
+        application_scopes = Doorkeeper::OAuth::Scopes.from_string "app"
+        server_scopes = Doorkeeper::OAuth::Scopes.from_string "email app"
+        allow(application).to receive(:scopes).and_return(application_scopes)
         allow(request).to receive(:grant_type).and_return(Doorkeeper::OAuth::CLIENT_CREDENTIALS)
         allow(server).to receive(:scopes).and_return(server_scopes)
         allow(request).to receive(:scopes).and_return(
-          Doorkeeper::OAuth::Scopes.from_string("invalid"),
+          Doorkeeper::OAuth::Scopes.from_string("email"),
         )
         expect(subject).not_to be_valid
       end
-
-      context "with application scopes" do
-        it "is valid when scopes are included in the application" do
-          application_scopes = Doorkeeper::OAuth::Scopes.from_string "app"
-          server_scopes = Doorkeeper::OAuth::Scopes.from_string "email app"
-          allow(application).to receive(:scopes).and_return(application_scopes)
-          allow(server).to receive(:scopes).and_return(server_scopes)
-          allow(request).to receive(:grant_type).and_return(Doorkeeper::OAuth::CLIENT_CREDENTIALS)
-          allow(request).to receive(:scopes).and_return(application_scopes)
-          expect(subject).to be_valid
-        end
-
-        it "is invalid when scopes are not included in the application" do
-          application_scopes = Doorkeeper::OAuth::Scopes.from_string "app"
-          server_scopes = Doorkeeper::OAuth::Scopes.from_string "email app"
-          allow(application).to receive(:scopes).and_return(application_scopes)
-          allow(request).to receive(:grant_type).and_return(Doorkeeper::OAuth::CLIENT_CREDENTIALS)
-          allow(server).to receive(:scopes).and_return(server_scopes)
-          allow(request).to receive(:scopes).and_return(
-            Doorkeeper::OAuth::Scopes.from_string("email"),
-          )
-          expect(subject).not_to be_valid
-        end
-      end
     end
   end
 end