doorkeeper 5.3.2 → 5.4.0

data/spec/lib/oauth/client_credentials/issuer_spec.rb

@@ -1,112 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-class Doorkeeper::OAuth::ClientCredentialsRequest
-  describe Issuer do
-    let(:creator) { double :access_token_creator }
-    let(:server) do
-      double(
-        :server,
-        access_token_expires_in: 100,
-      )
-    end
-    let(:validator) { double :validator, valid?: true }
-
-    before do
-      allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(false)
-    end
-
-    subject { Issuer.new(server, validator) }
-
-    describe :create do
-      let(:client) { double :client, id: "some-id" }
-      let(:scopes) { "some scope" }
-
-      it "creates and sets the token" do
-        expect(creator).to receive(:call).and_return("token")
-        subject.create client, scopes, creator
-
-        expect(subject.token).to eq("token")
-      end
-
-      it "creates with correct token parameters" do
-        expect(creator).to receive(:call).with(
-          client,
-          scopes,
-          expires_in: 100,
-          use_refresh_token: false,
-        )
-
-        subject.create client, scopes, creator
-      end
-
-      it "has error set to :server_error if creator fails" do
-        expect(creator).to receive(:call).and_return(false)
-        subject.create client, scopes, creator
-
-        expect(subject.error).to eq(:server_error)
-      end
-
-      context "when validator fails" do
-        before do
-          allow(validator).to receive(:valid?).and_return(false)
-          allow(validator).to receive(:error).and_return(:validation_error)
-          expect(creator).not_to receive(:create)
-        end
-
-        it "has error set from validator" do
-          subject.create client, scopes, creator
-          expect(subject.error).to eq(:validation_error)
-        end
-
-        it "returns false" do
-          expect(subject.create(client, scopes, creator)).to be_falsey
-        end
-      end
-
-      context "with custom expiration" do
-        let(:custom_ttl_grant) { 1234 }
-        let(:custom_ttl_scope) { 1235 }
-        let(:custom_scope) { "special" }
-        let(:server) do
-          double(
-            :server,
-            custom_access_token_expires_in: lambda { |context|
-              # scopes is normally an object but is a string in this test
-              if context.scopes == custom_scope
-                custom_ttl_scope
-              elsif context.grant_type == Doorkeeper::OAuth::CLIENT_CREDENTIALS
-                custom_ttl_grant
-              end
-            },
-          )
-        end
-
-        before do
-          allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
-        end
-
-        it "respects grant based rules" do
-          expect(creator).to receive(:call).with(
-            client,
-            scopes,
-            expires_in: custom_ttl_grant,
-            use_refresh_token: false,
-          )
-          subject.create client, scopes, creator
-        end
-
-        it "respects scope based rules" do
-          expect(creator).to receive(:call).with(
-            client,
-            custom_scope,
-            expires_in: custom_ttl_scope,
-            use_refresh_token: false,
-          )
-          subject.create client, custom_scope, creator
-        end
-      end
-    end
-  end
-end

data/spec/lib/oauth/client_credentials/validation_spec.rb

@@ -1,59 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-class Doorkeeper::OAuth::ClientCredentialsRequest
-  describe Validator do
-    let(:server)      { double :server, scopes: nil }
-    let(:application) { double scopes: nil }
-    let(:client)      { double application: application }
-    let(:request)     { double :request, client: client, scopes: nil }
-
-    subject { described_class.new(server, request) }
-
-    it "is valid with valid request" do
-      expect(subject).to be_valid
-    end
-
-    it "is invalid when client is not present" do
-      allow(request).to receive(:client).and_return(nil)
-      expect(subject).not_to be_valid
-    end
-
-    context "with scopes" do
-      it "is invalid when scopes are not included in the server" do
-        server_scopes = Doorkeeper::OAuth::Scopes.from_string "email"
-        allow(request).to receive(:grant_type).and_return(Doorkeeper::OAuth::CLIENT_CREDENTIALS)
-        allow(server).to receive(:scopes).and_return(server_scopes)
-        allow(request).to receive(:scopes).and_return(
-          Doorkeeper::OAuth::Scopes.from_string("invalid"),
-        )
-        expect(subject).not_to be_valid
-      end
-
-      context "with application scopes" do
-        it "is valid when scopes are included in the application" do
-          application_scopes = Doorkeeper::OAuth::Scopes.from_string "app"
-          server_scopes = Doorkeeper::OAuth::Scopes.from_string "email app"
-          allow(application).to receive(:scopes).and_return(application_scopes)
-          allow(server).to receive(:scopes).and_return(server_scopes)
-          allow(request).to receive(:grant_type).and_return(Doorkeeper::OAuth::CLIENT_CREDENTIALS)
-          allow(request).to receive(:scopes).and_return(application_scopes)
-          expect(subject).to be_valid
-        end
-
-        it "is invalid when scopes are not included in the application" do
-          application_scopes = Doorkeeper::OAuth::Scopes.from_string "app"
-          server_scopes = Doorkeeper::OAuth::Scopes.from_string "email app"
-          allow(application).to receive(:scopes).and_return(application_scopes)
-          allow(request).to receive(:grant_type).and_return(Doorkeeper::OAuth::CLIENT_CREDENTIALS)
-          allow(server).to receive(:scopes).and_return(server_scopes)
-          allow(request).to receive(:scopes).and_return(
-            Doorkeeper::OAuth::Scopes.from_string("email"),
-          )
-          expect(subject).not_to be_valid
-        end
-      end
-    end
-  end
-end

data/spec/lib/oauth/client_credentials_integration_spec.rb

@@ -1,27 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe Doorkeeper::OAuth::ClientCredentialsRequest do
-  let(:server) { Doorkeeper.configuration }
-
-  context "with a valid request" do
-    let(:client) { FactoryBot.create :application }
-
-    it "issues an access token" do
-      request = Doorkeeper::OAuth::ClientCredentialsRequest.new(server, client, {})
-      expect do
-        request.authorize
-      end.to change { Doorkeeper::AccessToken.count }.by(1)
-    end
-  end
-
-  describe "with an invalid request" do
-    it "does not issue an access token" do
-      request = Doorkeeper::OAuth::ClientCredentialsRequest.new(server, nil, {})
-      expect do
-        request.authorize
-      end.to_not(change { Doorkeeper::AccessToken.count })
-    end
-  end
-end

data/spec/lib/oauth/client_credentials_request_spec.rb

@@ -1,107 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe Doorkeeper::OAuth::ClientCredentialsRequest do
-  let(:server) do
-    double(
-      default_scopes: nil,
-      access_token_expires_in: 2.hours,
-      custom_access_token_expires_in: ->(_context) { nil },
-    )
-  end
-
-  let(:application)   { FactoryBot.create(:application, scopes: "") }
-  let(:client)        { double :client, application: application }
-  let(:token_creator) { double :issuer, create: true, token: double }
-
-  before do
-    allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
-  end
-
-  subject { Doorkeeper::OAuth::ClientCredentialsRequest.new(server, client) }
-
-  before do
-    subject.issuer = token_creator
-  end
-
-  it "issues an access token for the current client" do
-    expect(token_creator).to receive(:create).with(client, nil)
-    subject.authorize
-  end
-
-  it "has successful response when issue was created" do
-    subject.authorize
-    expect(subject.response).to be_a(Doorkeeper::OAuth::TokenResponse)
-  end
-
-  context "if issue was not created" do
-    before do
-      subject.issuer = double create: false, error: :invalid
-    end
-
-    it "has an error response" do
-      subject.authorize
-      expect(subject.response).to be_a(Doorkeeper::OAuth::ErrorResponse)
-    end
-
-    it "delegates the error to issuer" do
-      subject.authorize
-      expect(subject.error).to eq(:invalid)
-    end
-  end
-
-  context "with scopes" do
-    let(:default_scopes) { Doorkeeper::OAuth::Scopes.from_string("public email") }
-
-    before do
-      allow(server).to receive(:default_scopes).and_return(default_scopes)
-    end
-
-    it "issues an access token with default scopes if none was requested" do
-      expect(token_creator).to receive(:create).with(client, default_scopes)
-      subject.authorize
-    end
-
-    it "issues an access token with requested scopes" do
-      subject = Doorkeeper::OAuth::ClientCredentialsRequest.new(server, client, scope: "email")
-      subject.issuer = token_creator
-      expect(token_creator).to receive(:create).with(client, Doorkeeper::OAuth::Scopes.from_string("email"))
-      subject.authorize
-    end
-  end
-
-  context "with restricted client" do
-    let(:default_scopes) do
-      Doorkeeper::OAuth::Scopes.from_string("public email")
-    end
-    let(:server_scopes) do
-      Doorkeeper::OAuth::Scopes.from_string("public email phone")
-    end
-    let(:client_scopes) do
-      Doorkeeper::OAuth::Scopes.from_string("public phone")
-    end
-
-    before do
-      allow(server).to receive(:default_scopes).and_return(default_scopes)
-      allow(server).to receive(:scopes).and_return(server_scopes)
-      allow(server).to receive(:access_token_expires_in).and_return(100)
-      allow(application).to receive(:scopes).and_return(client_scopes)
-      allow(client).to receive(:id).and_return(nil)
-    end
-
-    it "delegates the error to issuer if no scope was requested" do
-      subject = Doorkeeper::OAuth::ClientCredentialsRequest.new(server, client)
-      subject.authorize
-      expect(subject.response).to be_a(Doorkeeper::OAuth::ErrorResponse)
-      expect(subject.error).to eq(:invalid_scope)
-    end
-
-    it "issues an access token with requested scopes" do
-      subject = Doorkeeper::OAuth::ClientCredentialsRequest.new(server, client, scope: "phone")
-      subject.authorize
-      expect(subject.response).to be_a(Doorkeeper::OAuth::TokenResponse)
-      expect(subject.response.token.scopes_string).to eq("phone")
-    end
-  end
-end

data/spec/lib/oauth/client_spec.rb

@@ -1,38 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe Doorkeeper::OAuth::Client do
-  describe :find do
-    let(:method) { double }
-
-    it "finds the client via uid" do
-      client = double
-      expect(method).to receive(:call).with("uid").and_return(client)
-      expect(Doorkeeper::OAuth::Client.find("uid", method))
-        .to be_a(Doorkeeper::OAuth::Client)
-    end
-
-    it "returns nil if client was not found" do
-      expect(method).to receive(:call).with("uid").and_return(nil)
-      expect(Doorkeeper::OAuth::Client.find("uid", method)).to be_nil
-    end
-  end
-
-  describe ".authenticate" do
-    it "returns the authenticated client via credentials" do
-      credentials = Doorkeeper::OAuth::Client::Credentials.new("some-uid", "some-secret")
-      authenticator = double
-      expect(authenticator).to receive(:call).with("some-uid", "some-secret").and_return(double)
-      expect(Doorkeeper::OAuth::Client.authenticate(credentials, authenticator))
-        .to be_a(Doorkeeper::OAuth::Client)
-    end
-
-    it "returns nil if client was not authenticated" do
-      credentials = Doorkeeper::OAuth::Client::Credentials.new("some-uid", "some-secret")
-      authenticator = double
-      expect(authenticator).to receive(:call).with("some-uid", "some-secret").and_return(nil)
-      expect(Doorkeeper::OAuth::Client.authenticate(credentials, authenticator)).to be_nil
-    end
-  end
-end

data/spec/lib/oauth/code_request_spec.rb

@@ -1,46 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe Doorkeeper::OAuth::CodeRequest do
-  let(:pre_auth) do
-    server = Doorkeeper.configuration
-    allow(server)
-      .to receive(:default_scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
-    allow(server)
-      .to receive(:grant_flows).and_return(Doorkeeper::OAuth::Scopes.from_string("authorization_code"))
-
-    application = FactoryBot.create(:application, scopes: "public")
-    client = Doorkeeper::OAuth::Client.new(application)
-
-    attributes = {
-      client_id: client.uid,
-      response_type: "code",
-      redirect_uri: "https://app.com/callback",
-    }
-
-    pre_auth = Doorkeeper::OAuth::PreAuthorization.new(server, attributes)
-    pre_auth.authorizable?
-    pre_auth
-  end
-
-  let(:owner) { double :owner, id: 8900 }
-
-  subject do
-    described_class.new(pre_auth, owner)
-  end
-
-  context "when pre_auth is authorized" do
-    it "creates an access grant and returns a code response" do
-      expect { subject.authorize }.to change { Doorkeeper::AccessGrant.count }.by(1)
-      expect(subject.authorize).to be_a(Doorkeeper::OAuth::CodeResponse)
-    end
-  end
-
-  context "when pre_auth is denied" do
-    it "does not create access grant and returns a error response" do
-      expect { subject.deny }.not_to(change { Doorkeeper::AccessGrant.count })
-      expect(subject.deny).to be_a(Doorkeeper::OAuth::ErrorResponse)
-    end
-  end
-end

data/spec/lib/oauth/code_response_spec.rb

@@ -1,32 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe Doorkeeper::OAuth::CodeResponse do
-  describe "#redirect_uri" do
-    context "when generating the redirect URI for an implicit grant" do
-      let :pre_auth do
-        double(
-          :pre_auth,
-          client: double(:application, id: 1),
-          redirect_uri: "http://tst.com/cb",
-          state: nil,
-          scopes: Doorkeeper::OAuth::Scopes.from_string("public"),
-        )
-      end
-
-      let :auth do
-        Doorkeeper::OAuth::Authorization::Token.new(pre_auth, double(id: 1)).tap do |c|
-          c.issue_token
-          allow(c.token).to receive(:expires_in_seconds).and_return(3600)
-        end
-      end
-
-      subject { described_class.new(pre_auth, auth, response_on_fragment: true).redirect_uri }
-
-      it "includes the remaining TTL of the token relative to the time the token was generated" do
-        expect(subject).to include("expires_in=3600")
-      end
-    end
-  end
-end

data/spec/lib/oauth/error_response_spec.rb

@@ -1,64 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe Doorkeeper::OAuth::ErrorResponse do
-  describe "#status" do
-    it "should have a status of bad_request" do
-      expect(subject.status).to eq(:bad_request)
-    end
-
-    it "should have a status of unauthorized for an invalid_client error" do
-      subject = described_class.new(name: :invalid_client)
-
-      expect(subject.status).to eq(:unauthorized)
-    end
-  end
-
-  describe ".from_request" do
-    it "has the error from request" do
-      error = described_class.from_request double(error: :some_error)
-      expect(error.name).to eq(:some_error)
-    end
-
-    it "ignores state if request does not respond to state" do
-      error = described_class.from_request double(error: :some_error)
-      expect(error.state).to be_nil
-    end
-
-    it "has state if request responds to state" do
-      error = described_class.from_request double(error: :some_error, state: :hello)
-      expect(error.state).to eq(:hello)
-    end
-  end
-
-  it "ignores empty error values" do
-    subject = described_class.new(error: :some_error, state: nil)
-    expect(subject.body).not_to have_key(:state)
-  end
-
-  describe ".body" do
-    subject { described_class.new(name: :some_error, state: :some_state).body }
-
-    describe "#body" do
-      it { expect(subject).to have_key(:error) }
-      it { expect(subject).to have_key(:error_description) }
-      it { expect(subject).to have_key(:state) }
-    end
-  end
-
-  describe ".headers" do
-    let(:error_response) { described_class.new(name: :some_error, state: :some_state) }
-    subject { error_response.headers }
-
-    it { expect(subject).to include "WWW-Authenticate" }
-
-    describe "WWW-Authenticate header" do
-      subject { error_response.headers["WWW-Authenticate"] }
-
-      it { expect(subject).to include("realm=\"#{error_response.realm}\"") }
-      it { expect(subject).to include("error=\"#{error_response.name}\"") }
-      it { expect(subject).to include("error_description=\"#{error_response.description}\"") }
-    end
-  end
-end