doorkeeper 5.3.2 → 5.4.0

data/spec/controllers/protected_resources_controller_spec.rb

@@ -1,361 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-module ControllerActions
-  def index
-    render plain: "index"
-  end
-
-  def show
-    render plain: "show"
-  end
-
-  def doorkeeper_unauthorized_render_options(*); end
-
-  def doorkeeper_forbidden_render_options(*); end
-end
-
-describe "doorkeeper authorize filter" do
-  context "accepts token code specified as" do
-    controller do
-      before_action :doorkeeper_authorize!
-
-      def index
-        render plain: "index"
-      end
-    end
-
-    let(:token_string) { "1A2BC3" }
-    let(:token) do
-      double(
-        Doorkeeper::AccessToken,
-        acceptable?: true, previous_refresh_token: "",
-        revoke_previous_refresh_token!: true,
-      )
-    end
-
-    it "access_token param" do
-      expect(Doorkeeper::AccessToken).to receive(:by_token).with(token_string).and_return(token)
-      get :index, params: { access_token: token_string }
-    end
-
-    it "bearer_token param" do
-      expect(Doorkeeper::AccessToken).to receive(:by_token).with(token_string).and_return(token)
-      get :index, params: { bearer_token: token_string }
-    end
-
-    it "Authorization header" do
-      expect(Doorkeeper::AccessToken).to receive(:by_token).with(token_string).and_return(token)
-      request.env["HTTP_AUTHORIZATION"] = "Bearer #{token_string}"
-      get :index
-    end
-
-    it "different kind of Authorization header" do
-      expect(Doorkeeper::AccessToken).not_to receive(:by_token)
-      request.env["HTTP_AUTHORIZATION"] = "MAC #{token_string}"
-      get :index
-    end
-
-    it "does not change Authorization header value" do
-      expect(Doorkeeper::AccessToken).to receive(:by_token).exactly(2).times.and_return(token)
-      request.env["HTTP_AUTHORIZATION"] = "Bearer #{token_string}"
-      get :index
-      controller.send(:remove_instance_variable, :@doorkeeper_token)
-      get :index
-    end
-  end
-
-  context "defined for all actions" do
-    controller do
-      before_action :doorkeeper_authorize!
-
-      include ControllerActions
-    end
-
-    context "with valid token", token: :valid do
-      it "allows into index action" do
-        get :index, params: { access_token: token_string }
-        expect(response).to be_successful
-      end
-
-      it "allows into show action" do
-        get :show, params: { id: "4", access_token: token_string }
-        expect(response).to be_successful
-      end
-    end
-
-    context "with invalid token", token: :invalid do
-      it "does not allow into index action" do
-        get :index, params: { access_token: token_string }
-        expect(response.status).to eq 401
-        expect(response.header["WWW-Authenticate"]).to match(/^Bearer/)
-      end
-
-      it "does not allow into show action" do
-        get :show, params: { id: "4", access_token: token_string }
-        expect(response.status).to eq 401
-        expect(response.header["WWW-Authenticate"]).to match(/^Bearer/)
-      end
-    end
-  end
-
-  context "defined with scopes" do
-    controller do
-      before_action -> { doorkeeper_authorize! :write }
-
-      include ControllerActions
-    end
-
-    let(:token_string) { "1A2DUWE" }
-
-    it "allows if the token has particular scopes" do
-      token = double(
-        Doorkeeper::AccessToken,
-        accessible?: true, scopes: %w[write public],
-        previous_refresh_token: "",
-        revoke_previous_refresh_token!: true,
-      )
-      expect(token).to receive(:acceptable?).with([:write]).and_return(true)
-      expect(
-        Doorkeeper::AccessToken,
-      ).to receive(:by_token).with(token_string).and_return(token)
-
-      get :index, params: { access_token: token_string }
-      expect(response).to be_successful
-    end
-
-    it "does not allow if the token does not include given scope" do
-      token = double(
-        Doorkeeper::AccessToken,
-        accessible?: true, scopes: ["public"], revoked?: false,
-        expired?: false, previous_refresh_token: "",
-        revoke_previous_refresh_token!: true,
-      )
-      expect(
-        Doorkeeper::AccessToken,
-      ).to receive(:by_token).with(token_string).and_return(token)
-      expect(token).to receive(:acceptable?).with([:write]).and_return(false)
-
-      get :index, params: { access_token: token_string }
-      expect(response.status).to eq 403
-      expect(response.header).to_not include("WWW-Authenticate")
-    end
-  end
-
-  context "when custom unauthorized render options are configured" do
-    controller do
-      before_action :doorkeeper_authorize!
-
-      include ControllerActions
-    end
-
-    context "with a JSON custom render", token: :invalid do
-      before do
-        module ControllerActions
-          remove_method :doorkeeper_unauthorized_render_options
-
-          def doorkeeper_unauthorized_render_options(error: nil)
-            { json: ActiveSupport::JSON.encode(error_message: error.description) }
-          end
-        end
-      end
-
-      after do
-        module ControllerActions
-          remove_method :doorkeeper_unauthorized_render_options
-
-          def doorkeeper_unauthorized_render_options(error: nil); end
-        end
-      end
-
-      it "it renders a custom JSON response", token: :invalid do
-        get :index, params: { access_token: token_string }
-        expect(response.status).to eq 401
-        expect(response.content_type).to include("application/json")
-        expect(response.header["WWW-Authenticate"]).to match(/^Bearer/)
-
-        expect(json_response).not_to be_nil
-        expect(json_response["error_message"]).to match("token is invalid")
-      end
-    end
-
-    context "with a text custom render", token: :invalid do
-      before do
-        module ControllerActions
-          remove_method :doorkeeper_unauthorized_render_options
-
-          def doorkeeper_unauthorized_render_options(**)
-            { plain: "Unauthorized" }
-          end
-        end
-      end
-
-      after do
-        module ControllerActions
-          remove_method :doorkeeper_unauthorized_render_options
-
-          def doorkeeper_unauthorized_render_options(error: nil); end
-        end
-      end
-
-      it "it renders a custom text response", token: :invalid do
-        get :index, params: { access_token: token_string }
-        expect(response.status).to eq 401
-        expect(response.content_type).to include("text/plain")
-        expect(response.header["WWW-Authenticate"]).to match(/^Bearer/)
-        expect(response.body).to eq("Unauthorized")
-      end
-    end
-  end
-
-  context "when custom forbidden render options are configured" do
-    before do
-      expect(Doorkeeper::AccessToken).to receive(:by_token).with(token_string).and_return(token)
-      expect(token).to receive(:acceptable?).with([:write]).and_return(false)
-    end
-
-    after do
-      module ControllerActions
-        remove_method :doorkeeper_forbidden_render_options
-
-        def doorkeeper_forbidden_render_options(*); end
-      end
-    end
-
-    controller do
-      before_action -> { doorkeeper_authorize! :write }
-
-      include ControllerActions
-    end
-
-    let(:token) do
-      double(
-        Doorkeeper::AccessToken,
-        accessible?: true, scopes: ["public"], revoked?: false,
-        expired?: false, previous_refresh_token: "",
-        revoke_previous_refresh_token!: true,
-      )
-    end
-
-    let(:token_string) { "1A2DUWE" }
-
-    context "with a JSON custom render" do
-      before do
-        module ControllerActions
-          remove_method :doorkeeper_forbidden_render_options
-
-          def doorkeeper_forbidden_render_options(*)
-            { json: { error_message: "Forbidden" } }
-          end
-        end
-      end
-
-      it "renders a custom JSON response" do
-        get :index, params: { access_token: token_string }
-        expect(response.header).to_not include("WWW-Authenticate")
-        expect(response.content_type).to include("application/json")
-        expect(response.status).to eq 403
-
-        expect(json_response).not_to be_nil
-        expect(json_response["error_message"]).to match("Forbidden")
-      end
-    end
-
-    context "with a status and JSON custom render" do
-      before do
-        module ControllerActions
-          remove_method :doorkeeper_forbidden_render_options
-          def doorkeeper_forbidden_render_options(*)
-            { json: { error_message: "Not Found" },
-              respond_not_found_when_forbidden: true, }
-          end
-        end
-      end
-
-      it "overrides the default status code" do
-        get :index, params: { access_token: token_string }
-        expect(response.status).to eq 404
-      end
-    end
-
-    context "with a text custom render" do
-      before do
-        module ControllerActions
-          remove_method :doorkeeper_forbidden_render_options
-
-          def doorkeeper_forbidden_render_options(*)
-            { plain: "Forbidden" }
-          end
-        end
-      end
-
-      it "renders a custom status code and text response" do
-        get :index, params: { access_token: token_string }
-        expect(response.header).to_not include("WWW-Authenticate")
-        expect(response.status).to eq 403
-        expect(response.body).to eq("Forbidden")
-      end
-    end
-
-    context "with a status and text custom render" do
-      before do
-        module ControllerActions
-          remove_method :doorkeeper_forbidden_render_options
-
-          def doorkeeper_forbidden_render_options(*)
-            { respond_not_found_when_forbidden: true, plain: "Not Found" }
-          end
-        end
-      end
-
-      it "overrides the default status code" do
-        get :index, params: { access_token: token_string }
-        expect(response.status).to eq 404
-      end
-    end
-  end
-
-  context "when handle_auth_errors option is set to :raise" do
-    subject { get :index, params: { access_token: token_string } }
-
-    before do
-      config_is_set(:handle_auth_errors, :raise)
-    end
-
-    controller do
-      before_action :doorkeeper_authorize!
-      include ControllerActions
-    end
-
-    context "when token is unknown" do
-      it "raises Doorkeeper::Errors::TokenUnknown exception", token: :invalid do
-        expect { subject }.to raise_error(Doorkeeper::Errors::TokenUnknown)
-      end
-    end
-
-    context "when token is expired" do
-      it "raises Doorkeeper::Errors::TokenExpired exception", token: :expired do
-        expect { subject }.to raise_error(Doorkeeper::Errors::TokenExpired)
-      end
-    end
-
-    context "when token is revoked" do
-      it "raises Doorkeeper::Errors::TokenRevoked exception", token: :revoked do
-        expect { subject }.to raise_error(Doorkeeper::Errors::TokenRevoked)
-      end
-    end
-
-    context "when token is forbidden" do
-      it "raises Doorkeeper::Errors::TokenForbidden exception", token: :forbidden do
-        expect { subject }.to raise_error(Doorkeeper::Errors::TokenForbidden)
-      end
-    end
-
-    context "when token is valid" do
-      it "allows into index action", token: :valid do
-        expect(response).to be_successful
-      end
-    end
-  end
-end

data/spec/controllers/token_info_controller_spec.rb

@@ -1,50 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe Doorkeeper::TokenInfoController do
-  describe "when requesting token info with valid token" do
-    let(:doorkeeper_token) { FactoryBot.create(:access_token) }
-
-    describe "successful request" do
-      it "responds with token info" do
-        get :show, params: { access_token: doorkeeper_token.token }
-
-        expect(response.body).to eq(doorkeeper_token.to_json)
-      end
-
-      it "responds with a 200 status" do
-        get :show, params: { access_token: doorkeeper_token.token }
-
-        expect(response.status).to eq 200
-      end
-    end
-
-    describe "invalid token response" do
-      it "responds with 401 when doorkeeper_token is not valid" do
-        get :show
-
-        expect(response.status).to eq 401
-        expect(response.headers["WWW-Authenticate"]).to match(/^Bearer/)
-      end
-
-      it "responds with 401 when doorkeeper_token is invalid, expired or revoked" do
-        allow(controller).to receive(:doorkeeper_token).and_return(doorkeeper_token)
-        allow(doorkeeper_token).to receive(:accessible?).and_return(false)
-
-        get :show
-
-        expect(response.status).to eq 401
-        expect(response.headers["WWW-Authenticate"]).to match(/^Bearer/)
-      end
-
-      it "responds body message for error" do
-        get :show
-
-        expect(response.body).to eq(
-          Doorkeeper::OAuth::InvalidTokenResponse.new.body.to_json,
-        )
-      end
-    end
-  end
-end

data/spec/controllers/tokens_controller_spec.rb

@@ -1,498 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe Doorkeeper::TokensController do
-  let(:client) { FactoryBot.create :application }
-  let!(:user)  { User.create!(name: "Joe", password: "sekret") }
-
-  before do
-    Doorkeeper.configure do
-      resource_owner_from_credentials do
-        User.first
-      end
-    end
-
-    allow(Doorkeeper.configuration).to receive(:grant_flows).and_return(["password"])
-  end
-
-  subject { JSON.parse(response.body) }
-
-  describe "POST #create" do
-    before do
-      post :create, params: {
-        client_id: client.uid,
-        client_secret: client.secret,
-        grant_type: "password",
-      }
-    end
-
-    it "responds after authorization" do
-      expect(response).to be_successful
-    end
-
-    it "includes access token in response" do
-      expect(subject["access_token"]).to eq(Doorkeeper::AccessToken.first.token)
-    end
-
-    it "includes token type in response" do
-      expect(subject["token_type"]).to eq("Bearer")
-    end
-
-    it "includes token expiration in response" do
-      expect(subject["expires_in"].to_i).to eq(Doorkeeper.configuration.access_token_expires_in)
-    end
-
-    it "issues the token for the current client" do
-      expect(Doorkeeper::AccessToken.first.application_id).to eq(client.id)
-    end
-
-    it "issues the token for the current resource owner" do
-      expect(Doorkeeper::AccessToken.first.resource_owner_id).to eq(user.id)
-    end
-  end
-
-  describe "POST #create with errors" do
-    before do
-      post :create, params: {
-        client_id: client.uid,
-        client_secret: "invalid",
-        grant_type: "password",
-      }
-    end
-
-    it "responds after authorization" do
-      expect(response).to be_unauthorized
-    end
-
-    it "include error in response" do
-      expect(subject["error"]).to eq("invalid_client")
-    end
-
-    it "include error_description in response" do
-      expect(subject["error_description"]).to be
-    end
-
-    it "does not include access token in response" do
-      expect(subject["access_token"]).to be_nil
-    end
-
-    it "does not include token type in response" do
-      expect(subject["token_type"]).to be_nil
-    end
-
-    it "does not include token expiration in response" do
-      expect(subject["expires_in"]).to be_nil
-    end
-
-    it "does not issue any access token" do
-      expect(Doorkeeper::AccessToken.all).to be_empty
-    end
-  end
-
-  describe "POST #create with callbacks" do
-    after do
-      client.update_attribute :redirect_uri, "urn:ietf:wg:oauth:2.0:oob"
-    end
-
-    describe "when successful" do
-      after do
-        post :create, params: {
-          client_id: client.uid,
-          client_secret: client.secret,
-          grant_type: "password",
-        }
-      end
-
-      it "should call :before_successful_authorization callback" do
-        expect(Doorkeeper.configuration)
-          .to receive_message_chain(:before_successful_authorization, :call).with(instance_of(described_class))
-      end
-
-      it "should call :after_successful_authorization callback" do
-        expect(Doorkeeper.configuration)
-          .to receive_message_chain(:after_successful_authorization, :call).with(instance_of(described_class))
-      end
-    end
-
-    describe "with errors" do
-      after do
-        post :create, params: {
-          client_id: client.uid,
-          client_secret: "invalid",
-          grant_type: "password",
-        }
-      end
-
-      it "should call :before_successful_authorization callback" do
-        expect(Doorkeeper.configuration)
-          .to receive_message_chain(:before_successful_authorization, :call).with(instance_of(described_class))
-      end
-
-      it "should not call :after_successful_authorization callback" do
-        expect(Doorkeeper.configuration).not_to receive(:after_successful_authorization)
-      end
-    end
-  end
-
-  describe "POST #create with custom error" do
-    it "returns the error response with a custom message" do
-      # I18n looks for `doorkeeper.errors.messages.custom_message` in locale files
-      custom_message = "my_message"
-      allow(I18n).to receive(:translate)
-        .with(
-          custom_message,
-          hash_including(scope: %i[doorkeeper errors messages]),
-        )
-        .and_return("Authorization custom message")
-
-      doorkeeper_error = Doorkeeper::Errors::DoorkeeperError.new(custom_message)
-
-      strategy = double(:strategy)
-      request = double(token_request: strategy)
-      allow(strategy).to receive(:authorize).and_raise(doorkeeper_error)
-      allow(controller).to receive(:server).and_return(request)
-
-      post :create
-
-      expected_response_body = {
-        "error" => custom_message,
-        "error_description" => "Authorization custom message",
-      }
-      expect(response.status).to eq 400
-      expect(response.headers["WWW-Authenticate"]).to match(/Bearer/)
-      expect(JSON.parse(response.body)).to eq expected_response_body
-    end
-  end
-
-  # http://tools.ietf.org/html/rfc7009#section-2.2
-  describe "POST #revoke" do
-    let(:client) { FactoryBot.create(:application) }
-    let(:access_token) { FactoryBot.create(:access_token, application: client) }
-
-    context "when associated app is public" do
-      let(:client) { FactoryBot.create(:application, confidential: false) }
-
-      it "returns 200" do
-        post :revoke, params: { token: access_token.token }
-
-        expect(response.status).to eq 200
-      end
-
-      it "revokes the access token" do
-        post :revoke, params: { token: access_token.token }
-
-        expect(access_token.reload).to have_attributes(revoked?: true)
-      end
-    end
-
-    context "when associated app is confidential" do
-      let(:client) { FactoryBot.create(:application, confidential: true) }
-      let(:oauth_client) { Doorkeeper::OAuth::Client.new(client) }
-
-      before(:each) do
-        allow_any_instance_of(Doorkeeper::Server).to receive(:client) { oauth_client }
-      end
-
-      it "returns 200" do
-        post :revoke, params: { token: access_token.token }
-
-        expect(response.status).to eq 200
-      end
-
-      it "revokes the access token" do
-        post :revoke, params: { token: access_token.token }
-
-        expect(access_token.reload).to have_attributes(revoked?: true)
-      end
-
-      context "when authorization fails" do
-        let(:some_other_client) { FactoryBot.create(:application, confidential: true) }
-        let(:oauth_client) { Doorkeeper::OAuth::Client.new(some_other_client) }
-
-        it "returns 403" do
-          post :revoke, params: { token: access_token.token }
-
-          expect(response.status).to eq 403
-        end
-
-        it "does not revoke the access token" do
-          post :revoke, params: { token: access_token.token }
-
-          expect(access_token.reload).to have_attributes(revoked?: false)
-        end
-      end
-    end
-  end
-
-  describe "POST #introspect" do
-    let(:client) { FactoryBot.create(:application) }
-    let(:access_token) { FactoryBot.create(:access_token, application: client) }
-    let(:token_for_introspection) { FactoryBot.create(:access_token, application: client) }
-
-    context "authorized using valid Bearer token" do
-      it "responds with full token introspection" do
-        request.headers["Authorization"] = "Bearer #{access_token.token}"
-
-        post :introspect, params: { token: token_for_introspection.token }
-
-        should_have_json "active", true
-        expect(json_response).to include("client_id", "token_type", "exp", "iat")
-      end
-    end
-
-    context "authorized using Client Credentials of the client that token is issued to" do
-      it "responds with full token introspection" do
-        request.headers["Authorization"] = basic_auth_header_for_client(client)
-
-        post :introspect, params: { token: token_for_introspection.token }
-
-        should_have_json "active", true
-        expect(json_response).to include("client_id", "token_type", "exp", "iat")
-        should_have_json "client_id", client.uid
-      end
-    end
-
-    context "configured token introspection disabled" do
-      before do
-        Doorkeeper.configure do
-          orm DOORKEEPER_ORM
-          allow_token_introspection false
-        end
-      end
-
-      it "responds with invalid_token error" do
-        request.headers["Authorization"] = "Bearer #{access_token.token}"
-
-        post :introspect, params: { token: token_for_introspection.token }
-
-        response_status_should_be 401
-
-        should_not_have_json "active"
-        should_have_json "error", "invalid_token"
-      end
-    end
-
-    context "using custom introspection response" do
-      before do
-        Doorkeeper.configure do
-          orm DOORKEEPER_ORM
-          custom_introspection_response do |_token, _context|
-            {
-              sub: "Z5O3upPC88QrAjx00dis",
-              aud: "https://protected.example.net/resource",
-            }
-          end
-        end
-      end
-
-      it "responds with full token introspection" do
-        request.headers["Authorization"] = "Bearer #{access_token.token}"
-
-        post :introspect, params: { token: token_for_introspection.token }
-
-        expect(json_response).to include("client_id", "token_type", "exp", "iat", "sub", "aud")
-        should_have_json "sub", "Z5O3upPC88QrAjx00dis"
-        should_have_json "aud", "https://protected.example.net/resource"
-      end
-    end
-
-    context "public access token" do
-      let(:token_for_introspection) { FactoryBot.create(:access_token, application: nil) }
-
-      it "responds with full token introspection" do
-        request.headers["Authorization"] = basic_auth_header_for_client(client)
-
-        post :introspect, params: { token: token_for_introspection.token }
-
-        should_have_json "active", true
-        expect(json_response).to include("client_id", "token_type", "exp", "iat")
-        should_have_json "client_id", nil
-      end
-    end
-
-    context "token was issued to a different client than is making this request" do
-      let(:different_client) { FactoryBot.create(:application) }
-
-      it "responds with only active state" do
-        request.headers["Authorization"] = basic_auth_header_for_client(different_client)
-
-        post :introspect, params: { token: token_for_introspection.token }
-
-        expect(response).to be_successful
-
-        should_have_json "active", false
-        expect(json_response).not_to include("client_id", "token_type", "exp", "iat")
-      end
-    end
-
-    context "introspection request authorized by a client and allow_token_introspection is true" do
-      let(:different_client) { FactoryBot.create(:application) }
-
-      before do
-        allow(Doorkeeper.configuration).to receive(:allow_token_introspection).and_return(proc do
-          true
-        end)
-      end
-
-      it "responds with full token introspection" do
-        request.headers["Authorization"] = basic_auth_header_for_client(different_client)
-
-        post :introspect, params: { token: token_for_introspection.token }
-
-        should_have_json "active", true
-        expect(json_response).to include("client_id", "token_type", "exp", "iat")
-        should_have_json "client_id", client.uid
-      end
-    end
-
-    context "allow_token_introspection requires authorized token with special scope" do
-      let(:access_token) { FactoryBot.create(:access_token, scopes: "introspection") }
-
-      before do
-        allow(Doorkeeper.configuration).to receive(:allow_token_introspection).and_return(proc do |_token, _client, authorized_token|
-          authorized_token.scopes.include?("introspection")
-        end)
-      end
-
-      it "responds with full token introspection if authorized token has introspection scope" do
-        request.headers["Authorization"] = "Bearer #{access_token.token}"
-
-        post :introspect, params: { token: token_for_introspection.token }
-
-        should_have_json "active", true
-        expect(json_response).to include("client_id", "token_type", "exp", "iat")
-      end
-
-      it "responds with invalid_token error if authorized token doesn't have introspection scope" do
-        access_token.update(scopes: "read write")
-
-        request.headers["Authorization"] = "Bearer #{access_token.token}"
-
-        post :introspect, params: { token: token_for_introspection.token }
-
-        response_status_should_be 401
-
-        should_not_have_json "active"
-        should_have_json "error", "invalid_token"
-      end
-    end
-
-    context "authorized using invalid Bearer token" do
-      let(:access_token) do
-        FactoryBot.create(:access_token, application: client, revoked_at: 1.day.ago)
-      end
-
-      it "responds with invalid_token error" do
-        request.headers["Authorization"] = "Bearer #{access_token.token}"
-
-        post :introspect, params: { token: token_for_introspection.token }
-
-        response_status_should_be 401
-
-        should_not_have_json "active"
-        should_have_json "error", "invalid_token"
-      end
-    end
-
-    context "authorized using the Bearer token that need to be introspected" do
-      it "responds with invalid token error" do
-        request.headers["Authorization"] = "Bearer #{access_token.token}"
-
-        post :introspect, params: { token: access_token.token }
-
-        response_status_should_be 401
-
-        should_not_have_json "active"
-        should_have_json "error", "invalid_token"
-      end
-    end
-
-    context "using invalid credentials to authorize" do
-      let(:client) { double(uid: "123123", secret: "666999") }
-      let(:access_token) { FactoryBot.create(:access_token) }
-
-      it "responds with invalid_client error" do
-        request.headers["Authorization"] = basic_auth_header_for_client(client)
-
-        post :introspect, params: { token: access_token.token }
-
-        expect(response).not_to be_successful
-        response_status_should_be 401
-
-        should_not_have_json "active"
-        should_have_json "error", "invalid_client"
-      end
-    end
-
-    context "using wrong token value" do
-      context "authorized using client credentials" do
-        it "responds with only active state" do
-          request.headers["Authorization"] = basic_auth_header_for_client(client)
-
-          post :introspect, params: { token: SecureRandom.hex(16) }
-
-          should_have_json "active", false
-          expect(json_response).not_to include("client_id", "token_type", "exp", "iat")
-        end
-      end
-
-      context "authorized using valid Bearer token" do
-        it "responds with invalid_token error" do
-          request.headers["Authorization"] = "Bearer #{access_token.token}"
-
-          post :introspect, params: { token: SecureRandom.hex(16) }
-
-          response_status_should_be 401
-
-          should_not_have_json "active"
-          should_have_json "error", "invalid_token"
-        end
-      end
-    end
-
-    context "when requested access token expired" do
-      let(:token_for_introspection) do
-        FactoryBot.create(:access_token, application: client, created_at: 1.year.ago)
-      end
-
-      it "responds with only active state" do
-        request.headers["Authorization"] = basic_auth_header_for_client(client)
-
-        post :introspect, params: { token: token_for_introspection.token }
-
-        should_have_json "active", false
-        expect(json_response).not_to include("client_id", "token_type", "exp", "iat")
-      end
-    end
-
-    context "when requested Access Token revoked" do
-      let(:token_for_introspection) do
-        FactoryBot.create(:access_token, application: client, revoked_at: 1.year.ago)
-      end
-
-      it "responds with only active state" do
-        request.headers["Authorization"] = basic_auth_header_for_client(client)
-
-        post :introspect, params: { token: token_for_introspection.token }
-
-        should_have_json "active", false
-        expect(json_response).not_to include("client_id", "token_type", "exp", "iat")
-      end
-    end
-
-    context "unauthorized (no bearer token or client credentials)" do
-      let(:token_for_introspection) { FactoryBot.create(:access_token) }
-
-      it "responds with invalid_request error" do
-        post :introspect, params: { token: token_for_introspection.token }
-
-        expect(response).not_to be_successful
-        response_status_should_be 400
-
-        should_not_have_json "active"
-        should_have_json "error", "invalid_request"
-      end
-    end
-  end
-end