doorkeeper 5.3.0 → 5.4.0.rc1

data/spec/lib/oauth/client_credentials_request_spec.rb

@@ -12,7 +12,7 @@ describe Doorkeeper::OAuth::ClientCredentialsRequest do
   end
 
   let(:application)   { FactoryBot.create(:application, scopes: "") }
-  let(:client)        { double :client, application: application }
+  let(:client)        { double :client, application: application, scopes: "" }
   let(:token_creator) { double :issuer, create: true, token: double }
 
   before do
@@ -22,7 +22,7 @@ describe Doorkeeper::OAuth::ClientCredentialsRequest do
   subject { Doorkeeper::OAuth::ClientCredentialsRequest.new(server, client) }
 
   before do
-    subject.issuer = token_creator
+    allow(subject).to receive(:issuer).and_return(token_creator)
   end
 
   it "issues an access token for the current client" do
@@ -37,7 +37,8 @@ describe Doorkeeper::OAuth::ClientCredentialsRequest do
 
   context "if issue was not created" do
     before do
-      subject.issuer = double create: false, error: :invalid
+      issuer = double create: false, error: :invalid
+      allow(subject).to receive(:issuer).and_return(issuer)
     end
 
     it "has an error response" do
@@ -65,7 +66,7 @@ describe Doorkeeper::OAuth::ClientCredentialsRequest do
 
     it "issues an access token with requested scopes" do
       subject = Doorkeeper::OAuth::ClientCredentialsRequest.new(server, client, scope: "email")
-      subject.issuer = token_creator
+      allow(subject).to receive(:issuer).and_return(token_creator)
       expect(token_creator).to receive(:create).with(client, Doorkeeper::OAuth::Scopes.from_string("email"))
       subject.authorize
     end

data/spec/lib/oauth/code_request_spec.rb

@@ -24,7 +24,7 @@ describe Doorkeeper::OAuth::CodeRequest do
     pre_auth
   end
 
-  let(:owner) { double :owner, id: 8900 }
+  let(:owner) { FactoryBot.create(:resource_owner) }
 
   subject do
     described_class.new(pre_auth, owner)

data/spec/lib/oauth/code_response_spec.rb

@@ -15,8 +15,12 @@ describe Doorkeeper::OAuth::CodeResponse do
         )
       end
 
+      let :owner do
+        FactoryBot.create(:resource_owner)
+      end
+
       let :auth do
-        Doorkeeper::OAuth::Authorization::Token.new(pre_auth, double(id: 1)).tap do |c|
+        Doorkeeper::OAuth::Authorization::Token.new(pre_auth, owner).tap do |c|
           c.issue_token
           allow(c.token).to receive(:expires_in_seconds).and_return(3600)
         end

data/spec/lib/oauth/error_response_spec.rb

@@ -56,7 +56,7 @@ describe Doorkeeper::OAuth::ErrorResponse do
     describe "WWW-Authenticate header" do
       subject { error_response.headers["WWW-Authenticate"] }
 
-      it { expect(subject).to include("realm=\"#{error_response.realm}\"") }
+      it { expect(subject).to include("realm=\"#{error_response.send(:realm)}\"") }
       it { expect(subject).to include("error=\"#{error_response.name}\"") }
       it { expect(subject).to include("error_description=\"#{error_response.description}\"") }
     end

data/spec/lib/oauth/password_access_token_request_spec.rb

@@ -15,7 +15,7 @@ describe Doorkeeper::OAuth::PasswordAccessTokenRequest do
     )
   end
   let(:client) { FactoryBot.create(:application) }
-  let(:owner)  { double :owner, id: 99 }
+  let(:owner)  { FactoryBot.create(:resource_owner) }
 
   before do
     allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
@@ -34,16 +34,17 @@ describe Doorkeeper::OAuth::PasswordAccessTokenRequest do
   end
 
   it "issues a new token without a client" do
+    subject = described_class.new(server, nil, owner)
+    expect(subject).to be_valid
+
     expect do
-      subject.client = nil
       subject.authorize
     end.to change { Doorkeeper::AccessToken.count }.by(1)
   end
 
   it "does not issue a new token with an invalid client" do
+    subject = described_class.new(server, nil, owner, { client_id: "bad_id" })
     expect do
-      subject.client = nil
-      subject.parameters = { client_id: "bad_id" }
       subject.authorize
     end.not_to(change { Doorkeeper::AccessToken.count })
 
@@ -51,18 +52,18 @@ describe Doorkeeper::OAuth::PasswordAccessTokenRequest do
   end
 
   it "requires the owner" do
-    subject.resource_owner = nil
+    subject = described_class.new(server, client, nil)
     subject.validate
     expect(subject.error).to eq(:invalid_grant)
   end
 
-  it "optionally accepts the client" do
-    subject.client = nil
-    expect(subject).to be_valid
-  end
-
   it "creates token even when there is already one (default)" do
-    FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
+    FactoryBot.create(
+      :access_token,
+      application_id: client.id,
+      resource_owner_id: owner.id,
+      resource_owner_type: owner.class.name,
+    )
 
     expect do
       subject.authorize
@@ -71,7 +72,12 @@ describe Doorkeeper::OAuth::PasswordAccessTokenRequest do
 
   it "skips token creation if there is already one reusable" do
     allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-    FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
+    FactoryBot.create(
+      :access_token,
+      application_id: client.id,
+      resource_owner_id: owner.id,
+      resource_owner_type: owner.class.name,
+    )
 
     expect do
       subject.authorize
@@ -80,7 +86,12 @@ describe Doorkeeper::OAuth::PasswordAccessTokenRequest do
 
   it "creates token when there is already one but non reusable" do
     allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-    FactoryBot.create(:access_token, application_id: client.id, resource_owner_id: owner.id)
+    FactoryBot.create(
+      :access_token,
+      application_id: client.id,
+      resource_owner_id: owner.id,
+      resource_owner_type: owner.class.name,
+    )
     allow_any_instance_of(Doorkeeper::AccessToken).to receive(:reusable?).and_return(false)
 
     expect do

data/spec/lib/oauth/pre_authorization_spec.rb

@@ -19,6 +19,7 @@ describe Doorkeeper::OAuth::PreAuthorization do
       response_type: "code",
       redirect_uri: "https://app.com/callback",
       state: "save-this",
+      current_resource_owner: Object.new,
     }
   end
 
@@ -177,6 +178,14 @@ describe Doorkeeper::OAuth::PreAuthorization do
     expect(subject).not_to be_authorizable
   end
 
+  context "when resource_owner cannot access client application" do
+    before { allow(Doorkeeper.configuration).to receive(:authorize_resource_owner_for_client).and_return(->(*_) { false }) }
+
+    it "is not authorizable" do
+      expect(subject).not_to be_authorizable
+    end
+  end
+
   describe "as_json" do
     before { subject.authorizable? }
 
@@ -194,30 +203,16 @@ describe Doorkeeper::OAuth::PreAuthorization do
       end
     end
 
-    context "when attributes param is not passed" do
+    context "when called without params" do
       let(:json) { subject.as_json }
 
       include_examples "returns the pre authorization"
     end
 
-    context "when attributes param is passed" do
-      context "when attributes is a hash" do
-        let(:custom_attributes) { { custom_id: "1234", custom_name: "a pretty good name" } }
-        let(:json) { subject.as_json(custom_attributes) }
-
-        include_examples "returns the pre authorization"
+    context "when called with params" do
+      let(:json) { subject.as_json(foo: "bar") }
 
-        it "merges the attributes in params" do
-          expect(json[:custom_id]).to eq custom_attributes[:custom_id]
-          expect(json[:custom_name]).to eq custom_attributes[:custom_name]
-        end
-      end
-
-      context "when attributes is not a hash" do
-        let(:json) { subject.as_json(nil) }
-
-        include_examples "returns the pre authorization"
-      end
+      include_examples "returns the pre authorization"
     end
   end
 end

data/spec/lib/oauth/refresh_token_request_spec.rb

@@ -4,8 +4,7 @@ require "spec_helper"
 
 describe Doorkeeper::OAuth::RefreshTokenRequest do
   let(:server) do
-    double :server,
-           access_token_expires_in: 2.minutes
+    double :server, access_token_expires_in: 2.minutes
   end
 
   let(:refresh_token) do
@@ -20,28 +19,22 @@ describe Doorkeeper::OAuth::RefreshTokenRequest do
     allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(false)
   end
 
-  subject { described_class.new server, refresh_token, credentials }
+  subject { described_class.new(server, refresh_token, credentials) }
 
   it "issues a new token for the client" do
     expect { subject.authorize }.to change { client.reload.access_tokens.count }.by(1)
     # #sort_by used for MongoDB ORM extensions for valid ordering
-    expect(client.reload.access_tokens.max_by(&:created_at).expires_in).to eq(120)
+    expect(client.reload.access_tokens.max_by(&:created_at).expires_in).to eq(refresh_token.expires_in)
   end
 
-  it "issues a new token for the client with custom expires_in" do
-    server = double :server,
-                    access_token_expires_in: 2.minutes,
-                    custom_access_token_expires_in: lambda { |context|
-                      context.grant_type == Doorkeeper::OAuth::REFRESH_TOKEN ? 1234 : nil
-                    }
-
+  it "issues a new token for the client with the same expiry as of original token" do
     allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
     allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(false)
 
     described_class.new(server, refresh_token, credentials).authorize
 
     # #sort_by used for MongoDB ORM extensions for valid ordering
-    expect(client.reload.access_tokens.max_by(&:created_at).expires_in).to eq(1234)
+    expect(client.reload.access_tokens.max_by(&:created_at).expires_in).to eq(refresh_token.expires_in)
   end
 
   it "revokes the previous token" do
@@ -59,22 +52,26 @@ describe Doorkeeper::OAuth::RefreshTokenRequest do
   end
 
   it "requires the refresh token" do
-    subject.refresh_token = nil
-    subject.validate
-    expect(subject.error).to eq(:invalid_request)
-    expect(subject.missing_param).to eq(:refresh_token)
+    request = described_class.new(server, nil, credentials)
+    request.validate
+    expect(request.error).to eq(:invalid_request)
+    expect(request.missing_param).to eq(:refresh_token)
   end
 
   it "requires credentials to be valid if provided" do
-    subject.client = nil
-    subject.validate
-    expect(subject.error).to eq(:invalid_client)
+    credentials = Doorkeeper::OAuth::Client::Credentials.new("invalid", "invalid")
+    request = described_class.new(server, refresh_token, credentials)
+    request.validate
+    expect(request.error).to eq(:invalid_client)
   end
 
   it "requires the token's client and current client to match" do
-    subject.client = FactoryBot.create(:application)
-    subject.validate
-    expect(subject.error).to eq(:invalid_grant)
+    other_app = FactoryBot.create(:application)
+    credentials = Doorkeeper::OAuth::Client::Credentials.new(other_app.uid, other_app.secret)
+
+    request = described_class.new(server, refresh_token, credentials)
+    request.validate
+    expect(request.error).to eq(:invalid_grant)
   end
 
   it "rejects revoked tokens" do
@@ -91,14 +88,6 @@ describe Doorkeeper::OAuth::RefreshTokenRequest do
   end
 
   context "refresh tokens expire on access token use" do
-    let(:server) do
-      double :server,
-             access_token_expires_in: 2.minutes,
-             custom_access_token_expires_in: lambda { |context|
-               context.grant_type == Doorkeeper::OAuth::REFRESH_TOKEN ? 1234 : nil
-             }
-    end
-
     before do
       allow(Doorkeeper::AccessToken).to receive(:refresh_token_revoked_on_use?).and_return(true)
     end

data/spec/lib/oauth/token_request_spec.rb

@@ -8,7 +8,7 @@ describe Doorkeeper::OAuth::TokenRequest do
   end
 
   let :pre_auth do
-    server = Doorkeeper.configuration
+    server = Doorkeeper.config
     allow(server).to receive(:default_scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
     allow(server).to receive(:grant_flows).and_return(Doorkeeper::OAuth::Scopes.from_string("implicit"))
 
@@ -26,7 +26,7 @@ describe Doorkeeper::OAuth::TokenRequest do
   end
 
   let :owner do
-    double :owner, id: 7866
+    FactoryBot.create(:doorkeeper_testing_user)
   end
 
   subject do
@@ -116,9 +116,13 @@ describe Doorkeeper::OAuth::TokenRequest do
     it "creates a new token if scopes do not match" do
       allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
       FactoryBot.create(
-        :access_token, application_id: pre_auth.client.id,
-                       resource_owner_id: owner.id, scopes: "",
+        :access_token,
+        application_id: pre_auth.client.id,
+        resource_owner_id: owner.id,
+        resource_owner_type: owner.class.name,
+        scopes: "",
       )
+
       expect do
         subject.authorize
       end.to change { Doorkeeper::AccessToken.count }.by(1)
@@ -131,7 +135,7 @@ describe Doorkeeper::OAuth::TokenRequest do
 
       FactoryBot.create(
         :access_token, application_id: pre_auth.client.id,
-                       resource_owner_id: owner.id, scopes: "public",
+                       resource_owner_id: owner.id, resource_owner_type: owner.class.name, scopes: "public",
       )
 
       expect { subject.authorize }.not_to(change { Doorkeeper::AccessToken.count })
@@ -143,8 +147,11 @@ describe Doorkeeper::OAuth::TokenRequest do
       allow(application.scopes).to receive(:all?).and_return(true)
 
       FactoryBot.create(
-        :access_token, application_id: pre_auth.client.id,
-                       resource_owner_id: owner.id, scopes: "public",
+        :access_token,
+        application_id: pre_auth.client.id,
+        resource_owner_id: owner.id,
+        resource_owner_type: owner.class.name,
+        scopes: "public",
       )
 
       allow_any_instance_of(Doorkeeper::AccessToken).to receive(:reusable?).and_return(false)

data/spec/lib/option_spec.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+describe Doorkeeper, "configuration option DSL" do
+  class Extension
+    def self.configure(&block)
+      @config = Config::Builder.new(Config.new, &block).build
+    end
+
+    def self.configuration
+      @config || (raise Errors::MissingConfiguration)
+    end
+
+    class Config
+      class Builder < Doorkeeper::Config::AbstractBuilder
+        def enforce_something
+          @config.instance_variable_set(:@enforce_something, true)
+        end
+      end
+
+      def enforce_something?
+        if defined?(@enforce_something)
+          @enforce_something
+        else
+          false
+        end
+      end
+
+      def self.builder_class
+        Config::Builder
+      end
+
+      extend Doorkeeper::Config::Option
+    end
+  end
+
+  it "allows to define custom options in extensions" do
+    expect do
+      Extension::Config.option(:some_option, default: 1)
+    end.not_to raise_error
+
+    Extension.configure do
+      some_option 20
+      enforce_something
+    end
+
+    expect(Extension.configuration.some_option).to eq(20)
+    expect(Extension.configuration.enforce_something?).to be(true)
+  end
+end

data/spec/lib/stale_records_cleaner_spec.rb

@@ -10,6 +10,7 @@ describe Doorkeeper::StaleRecordsCleaner do
       access_grant: Doorkeeper::AccessGrant,
     }
   end
+  let(:resource_owner) { FactoryBot.create(:resource_owner) }
 
   context "when ORM has no cleaner class" do
     it "raises an error" do
@@ -30,7 +31,10 @@ describe Doorkeeper::StaleRecordsCleaner do
 
         context "with revoked record" do
           before do
-            FactoryBot.create model_name, revoked_at: Time.current - 1.minute
+            FactoryBot.create model_name,
+                              revoked_at: Time.current - 1.minute,
+                              resource_owner_id: resource_owner.id,
+                              resource_owner_type: resource_owner.class.name
           end
 
           it "removes the record" do
@@ -40,7 +44,9 @@ describe Doorkeeper::StaleRecordsCleaner do
 
         context "with record revoked in the future" do
           before do
-            FactoryBot.create model_name, revoked_at: Time.current + 1.minute
+            FactoryBot.create model_name, revoked_at: Time.current + 1.minute,
+                                          resource_owner_id: resource_owner.id,
+                                          resource_owner_type: resource_owner.class.name
           end
 
           it "keeps the record" do
@@ -50,7 +56,9 @@ describe Doorkeeper::StaleRecordsCleaner do
 
         context "with unrevoked record" do
           before do
-            FactoryBot.create model_name, revoked_at: nil
+            FactoryBot.create model_name, revoked_at: nil,
+                                          resource_owner_id: resource_owner.id,
+                                          resource_owner_type: resource_owner.class.name
           end
 
           it "keeps the record" do
@@ -66,7 +74,10 @@ describe Doorkeeper::StaleRecordsCleaner do
 
         context "with record that is expired" do
           before do
-            FactoryBot.create model_name, created_at: expiry_border - 1.minute
+            FactoryBot.create model_name,
+                              created_at: expiry_border - 1.minute,
+                              resource_owner_id: resource_owner.id,
+                              resource_owner_type: resource_owner.class.name
           end
 
           it "removes the record" do
@@ -76,7 +87,9 @@ describe Doorkeeper::StaleRecordsCleaner do
 
         context "with record that is not expired" do
           before do
-            FactoryBot.create model_name, created_at: expiry_border + 1.minute
+            FactoryBot.create model_name, created_at: expiry_border + 1.minute,
+                                          resource_owner_id: resource_owner.id,
+                                          resource_owner_type: resource_owner.class.name
           end
 
           it "keeps the record" do

data/spec/models/doorkeeper/access_grant_spec.rb

@@ -3,10 +3,18 @@
 require "spec_helper"
 
 describe Doorkeeper::AccessGrant do
+  let(:resource_owner) { FactoryBot.create(:resource_owner) }
   let(:client) { FactoryBot.build_stubbed(:application) }
   let(:clazz) { Doorkeeper::AccessGrant }
 
-  subject { FactoryBot.build(:access_grant, application: client) }
+  subject do
+    FactoryBot.build(
+      :access_grant,
+      application: client,
+      resource_owner_id: resource_owner.id,
+      resource_owner_type: resource_owner.class.name,
+    )
+  end
 
   it { expect(subject).to be_valid }
 
@@ -17,7 +25,12 @@ describe Doorkeeper::AccessGrant do
   end
 
   context "with hashing enabled" do
-    let(:grant) { FactoryBot.create :access_grant }
+    let(:resource_owner) { FactoryBot.create(:resource_owner) }
+    let(:grant) do
+      FactoryBot.create :access_grant,
+                        resource_owner_id: resource_owner.id,
+                        resource_owner_type: resource_owner.class.name
+    end
     include_context "with token hashing enabled"
 
     it "holds a volatile plaintext token when created" do
@@ -117,12 +130,12 @@ describe Doorkeeper::AccessGrant do
   end
 
   describe ".revoke_all_for" do
-    let(:resource_owner) { double(id: 100) }
     let(:application) { FactoryBot.create :application }
     let(:default_attributes) do
       {
         application: application,
         resource_owner_id: resource_owner.id,
+        resource_owner_type: resource_owner.class.name,
       }
     end
 
@@ -148,9 +161,10 @@ describe Doorkeeper::AccessGrant do
     end
 
     it "matches resource owner" do
+      other_resource_owner = FactoryBot.create(:resource_owner)
       access_grant_for_different_owner = FactoryBot.create(
         :access_grant,
-        default_attributes.merge(resource_owner_id: 90),
+        default_attributes.merge(resource_owner_id: other_resource_owner.id),
       )
 
       described_class.revoke_all_for application.id, resource_owner