doorkeeper 5.3.3 → 5.4.0

data/spec/lib/oauth/token_response_spec.rb

@@ -1,84 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe Doorkeeper::OAuth::TokenResponse do
-  subject { described_class.new(double.as_null_object) }
-
-  it "includes access token response headers" do
-    headers = subject.headers
-    expect(headers.fetch("Cache-Control")).to eq("no-store")
-    expect(headers.fetch("Pragma")).to eq("no-cache")
-  end
-
-  it "status is ok" do
-    expect(subject.status).to eq(:ok)
-  end
-
-  describe ".body" do
-    let(:access_token) do
-      double :access_token,
-             plaintext_token: "some-token",
-             expires_in: "3600",
-             expires_in_seconds: "300",
-             scopes_string: "two scopes",
-             plaintext_refresh_token: "some-refresh-token",
-             token_type: "bearer",
-             created_at: 0
-    end
-
-    subject { described_class.new(access_token).body }
-
-    it "includes :access_token" do
-      expect(subject["access_token"]).to eq("some-token")
-    end
-
-    it "includes :token_type" do
-      expect(subject["token_type"]).to eq("bearer")
-    end
-
-    # expires_in_seconds is returned as `expires_in` in order to match
-    # the OAuth spec (section 4.2.2)
-    it "includes :expires_in" do
-      expect(subject["expires_in"]).to eq("300")
-    end
-
-    it "includes :scope" do
-      expect(subject["scope"]).to eq("two scopes")
-    end
-
-    it "includes :refresh_token" do
-      expect(subject["refresh_token"]).to eq("some-refresh-token")
-    end
-
-    it "includes :created_at" do
-      expect(subject["created_at"]).to eq(0)
-    end
-  end
-
-  describe ".body filters out empty values" do
-    let(:access_token) do
-      double :access_token,
-             plaintext_token: "some-token",
-             expires_in_seconds: "",
-             scopes_string: "",
-             plaintext_refresh_token: "",
-             token_type: "bearer",
-             created_at: 0
-    end
-
-    subject { described_class.new(access_token).body }
-
-    it "includes :expires_in" do
-      expect(subject["expires_in"]).to be_nil
-    end
-
-    it "includes :scope" do
-      expect(subject["scope"]).to be_nil
-    end
-
-    it "includes :refresh_token" do
-      expect(subject["refresh_token"]).to be_nil
-    end
-  end
-end

data/spec/lib/oauth/token_spec.rb

@@ -1,156 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-module Doorkeeper
-  unless defined?(AccessToken)
-    class AccessToken
-    end
-  end
-end
-
-describe Doorkeeper::OAuth::Token do
-  describe ".from_request" do
-    let(:request) { double.as_null_object }
-
-    let(:method) do
-      ->(*) { "token-value" }
-    end
-
-    it "accepts anything that responds to #call" do
-      expect(method).to receive(:call).with(request)
-      described_class.from_request request, method
-    end
-
-    it "delegates methods received as symbols to described_class class" do
-      expect(described_class).to receive(:from_params).with(request)
-      described_class.from_request request, :from_params
-    end
-
-    it "stops at the first credentials found" do
-      not_called_method = double
-      expect(not_called_method).not_to receive(:call)
-      described_class.from_request request, ->(_r) {}, method, not_called_method
-    end
-
-    it "returns the credential from extractor method" do
-      credentials = described_class.from_request request, method
-      expect(credentials).to eq("token-value")
-    end
-  end
-
-  describe ".from_access_token_param" do
-    it "returns token from access_token parameter" do
-      request = double parameters: { access_token: "some-token" }
-      token   = described_class.from_access_token_param(request)
-      expect(token).to eq("some-token")
-    end
-  end
-
-  describe ".from_bearer_param" do
-    it "returns token from bearer_token parameter" do
-      request = double parameters: { bearer_token: "some-token" }
-      token   = described_class.from_bearer_param(request)
-      expect(token).to eq("some-token")
-    end
-  end
-
-  describe ".from_bearer_authorization" do
-    it "returns token from capitalized authorization bearer" do
-      request = double authorization: "Bearer SomeToken"
-      token   = described_class.from_bearer_authorization(request)
-      expect(token).to eq("SomeToken")
-    end
-
-    it "returns token from lowercased authorization bearer" do
-      request = double authorization: "bearer SomeToken"
-      token   = described_class.from_bearer_authorization(request)
-      expect(token).to eq("SomeToken")
-    end
-
-    it "does not return token if authorization is not bearer" do
-      request = double authorization: "MAC SomeToken"
-      token   = described_class.from_bearer_authorization(request)
-      expect(token).to be_blank
-    end
-  end
-
-  describe ".from_basic_authorization" do
-    it "returns token from capitalized authorization basic" do
-      request = double authorization: "Basic #{Base64.encode64 "SomeToken:"}"
-      token   = described_class.from_basic_authorization(request)
-      expect(token).to eq("SomeToken")
-    end
-
-    it "returns token from lowercased authorization basic" do
-      request = double authorization: "basic #{Base64.encode64 "SomeToken:"}"
-      token   = described_class.from_basic_authorization(request)
-      expect(token).to eq("SomeToken")
-    end
-
-    it "does not return token if authorization is not basic" do
-      request = double authorization: "MAC #{Base64.encode64 "SomeToken:"}"
-      token   = described_class.from_basic_authorization(request)
-      expect(token).to be_blank
-    end
-  end
-
-  describe ".authenticate" do
-    context "refresh tokens are disabled (default)" do
-      context "refresh tokens are enabled" do
-        it "does not revoke previous refresh_token if token was found" do
-          token = ->(_r) { "token" }
-          expect(
-            Doorkeeper::AccessToken,
-          ).to receive(:by_token).with("token").and_return(token)
-          expect(token).not_to receive(:revoke_previous_refresh_token!)
-          described_class.authenticate double, token
-        end
-      end
-
-      it "calls the finder if token was returned" do
-        token = ->(_r) { "token" }
-        expect(Doorkeeper::AccessToken).to receive(:by_token).with("token")
-        described_class.authenticate double, token
-      end
-    end
-
-    context "token hashing is enabled" do
-      include_context "with token hashing enabled"
-
-      let(:hashed_token) { hashed_or_plain_token_func.call("token") }
-      let(:token) { ->(_r) { "token" } }
-
-      it "searches with the hashed token" do
-        expect(
-          Doorkeeper::AccessToken,
-        ).to receive(:find_by).with(token: hashed_token).and_return(token)
-        described_class.authenticate double, token
-      end
-    end
-
-    context "refresh tokens are enabled" do
-      before do
-        Doorkeeper.configure do
-          orm DOORKEEPER_ORM
-          use_refresh_token
-        end
-      end
-
-      it "revokes previous refresh_token if token was found" do
-        token = ->(_r) { "token" }
-        expect(
-          Doorkeeper::AccessToken,
-        ).to receive(:by_token).with("token").and_return(token)
-        expect(token).to receive(:revoke_previous_refresh_token!)
-        described_class.authenticate double, token
-      end
-
-      it "calls the finder if token was returned" do
-        token = ->(_r) { "token" }
-        expect(Doorkeeper::AccessToken).to receive(:by_token).with("token")
-        described_class.authenticate double, token
-      end
-    end
-  end
-end

data/spec/lib/request/strategy_spec.rb

@@ -1,54 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-module Doorkeeper
-  module Request
-    describe Strategy do
-      let(:server) { double }
-      subject(:strategy) { Strategy.new(server) }
-
-      describe :initialize do
-        it "sets the server attribute" do
-          expect(strategy.server).to eq server
-        end
-      end
-
-      describe :request do
-        it "requires an implementation" do
-          expect { strategy.request }.to raise_exception NotImplementedError
-        end
-      end
-
-      describe "a sample Strategy subclass" do
-        let(:fake_request) { double }
-
-        let(:strategy_class) do
-          subclass = Class.new(Strategy) do
-            class << self
-              attr_accessor :fake_request
-            end
-
-            def request
-              self.class.fake_request
-            end
-          end
-
-          subclass.fake_request = fake_request
-          subclass
-        end
-
-        subject(:strategy) { strategy_class.new(server) }
-
-        it "provides a request implementation" do
-          expect(strategy.request).to eq fake_request
-        end
-
-        it "authorizes the request" do
-          expect(fake_request).to receive :authorize
-          strategy.authorize
-        end
-      end
-    end
-  end
-end

data/spec/lib/secret_storing/base_spec.rb

@@ -1,60 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe ::Doorkeeper::SecretStoring::Base do
-  let(:instance) { double("instance", token: "foo") }
-  subject { described_class }
-
-  describe "#transform_secret" do
-    it "raises" do
-      expect { subject.transform_secret("foo") }.to raise_error(NotImplementedError)
-    end
-  end
-
-  describe "#store_secret" do
-    it "sends to response of #transform_secret to the instance" do
-      expect(described_class)
-        .to receive(:transform_secret).with("bar")
-        .and_return "bar+transform"
-
-      expect(instance).to receive(:token=).with "bar+transform"
-      result = subject.store_secret instance, :token, "bar"
-      expect(result).to eq "bar+transform"
-    end
-  end
-
-  describe "#restore_secret" do
-    it "raises" do
-      expect { subject.restore_secret(subject, :token) }.to raise_error(NotImplementedError)
-    end
-  end
-
-  describe "#allows_restoring_secrets?" do
-    it "does not allow it" do
-      expect(subject.allows_restoring_secrets?).to eq false
-    end
-  end
-
-  describe "validate_for" do
-    it "allows for valid model" do
-      expect(subject.validate_for(:application)).to eq true
-      expect(subject.validate_for(:token)).to eq true
-    end
-
-    it "raises for invalid model" do
-      expect { subject.validate_for(:wat) }.to raise_error(ArgumentError, /can not be used for wat/)
-    end
-  end
-
-  describe "secret_matches?" do
-    before do
-      allow(subject).to receive(:transform_secret) { |input| "transformed: #{input}" }
-    end
-
-    it "compares input with #transform_secret" do
-      expect(subject.secret_matches?("input", "input")).to eq false
-      expect(subject.secret_matches?("a", "transformed: a")).to eq true
-    end
-  end
-end

data/spec/lib/secret_storing/bcrypt_spec.rb

@@ -1,49 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-require "bcrypt"
-
-describe ::Doorkeeper::SecretStoring::BCrypt do
-  subject { described_class }
-  let(:instance) { double("instance", token: "foo") }
-
-  describe "#transform_secret" do
-    it "creates a bcrypt password" do
-      expect(subject.transform_secret("foo")).to be_a BCrypt::Password
-    end
-  end
-
-  describe "#restore_secret" do
-    it "raises" do
-      expect { subject.restore_secret(instance, :token) }.to raise_error(NotImplementedError)
-    end
-  end
-
-  describe "#allows_restoring_secrets?" do
-    it "does not allow it" do
-      expect(subject.allows_restoring_secrets?).to eq false
-    end
-  end
-
-  describe "validate_for" do
-    it "allows for valid model" do
-      expect(subject.validate_for(:application)).to eq true
-    end
-
-    it "raises for invalid model" do
-      expect { subject.validate_for(:wat) }
-        .to raise_error(ArgumentError, /can only be used for storing application secrets/)
-      expect { subject.validate_for(:token) }
-        .to raise_error(ArgumentError, /can only be used for storing application secrets/)
-    end
-  end
-
-  describe "secret_matches?" do
-    it "compares input with #transform_secret" do
-      expect(subject.secret_matches?("input", "input")).to eq false
-
-      password = BCrypt::Password.create "foobar"
-      expect(subject.secret_matches?("foobar", password.to_s)).to eq true
-    end
-  end
-end

data/spec/lib/secret_storing/plain_spec.rb

@@ -1,44 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe ::Doorkeeper::SecretStoring::Plain do
-  subject { described_class }
-  let(:instance) { double("instance", token: "foo") }
-
-  describe "#transform_secret" do
-    it "raises" do
-      expect(subject.transform_secret("foo")).to eq "foo"
-    end
-  end
-
-  describe "#restore_secret" do
-    it "raises" do
-      expect(subject.restore_secret(instance, :token)).to eq "foo"
-    end
-  end
-
-  describe "#allows_restoring_secrets?" do
-    it "does allow it" do
-      expect(subject.allows_restoring_secrets?).to eq true
-    end
-  end
-
-  describe "validate_for" do
-    it "allows for valid model" do
-      expect(subject.validate_for(:application)).to eq true
-      expect(subject.validate_for(:token)).to eq true
-    end
-
-    it "raises for invalid model" do
-      expect { subject.validate_for(:wat) }.to raise_error(ArgumentError, /can not be used for wat/)
-    end
-  end
-
-  describe "secret_matches?" do
-    it "compares input with #transform_secret" do
-      expect(subject.secret_matches?("input", "input")).to eq true
-      expect(subject.secret_matches?("a", "b")).to eq false
-    end
-  end
-end

data/spec/lib/secret_storing/sha256_hash_spec.rb

@@ -1,48 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe ::Doorkeeper::SecretStoring::Sha256Hash do
-  subject { described_class }
-  let(:instance) { double("instance") }
-
-  let(:hash_function) do
-    ->(input) { ::Digest::SHA256.hexdigest(input) }
-  end
-
-  describe "#transform_secret" do
-    it "raises" do
-      expect(subject.transform_secret("foo")).to eq hash_function.call("foo")
-    end
-  end
-
-  describe "#restore_secret" do
-    it "raises" do
-      expect { subject.restore_secret(instance, :token) }.to raise_error(NotImplementedError)
-    end
-  end
-
-  describe "#allows_restoring_secrets?" do
-    it "does not allow it" do
-      expect(subject.allows_restoring_secrets?).to eq false
-    end
-  end
-
-  describe "validate_for" do
-    it "allows for valid model" do
-      expect(subject.validate_for(:application)).to eq true
-      expect(subject.validate_for(:token)).to eq true
-    end
-
-    it "raises for invalid model" do
-      expect { subject.validate_for(:wat) }.to raise_error(ArgumentError, /can not be used for wat/)
-    end
-  end
-
-  describe "secret_matches?" do
-    it "compares input with #transform_secret" do
-      expect(subject.secret_matches?("input", "input")).to eq false
-      expect(subject.secret_matches?("a", hash_function.call("a"))).to eq true
-    end
-  end
-end

data/spec/lib/server_spec.rb

@@ -1,49 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe Doorkeeper::Server do
-  let(:fake_class) { double :fake_class }
-
-  subject do
-    described_class.new
-  end
-
-  describe ".authorization_request" do
-    it "raises error when strategy does not match phase" do
-      expect do
-        subject.token_request(:code)
-      end.to raise_error(Doorkeeper::Errors::InvalidTokenStrategy)
-    end
-
-    context "when only Authorization Code strategy is enabled" do
-      before do
-        allow(Doorkeeper.configuration)
-          .to receive(:grant_flows)
-          .and_return(["authorization_code"])
-      end
-
-      it "raises error when using the disabled Client Credentials strategy" do
-        expect do
-          subject.token_request(:client_credentials)
-        end.to raise_error(Doorkeeper::Errors::InvalidTokenStrategy)
-      end
-    end
-
-    it "builds the request with selected strategy" do
-      stub_const "Doorkeeper::Request::Code", fake_class
-      expect(fake_class).to receive(:new).with(subject)
-      subject.authorization_request :code
-    end
-
-    it "builds the request with composite strategy name" do
-      allow(Doorkeeper.configuration)
-        .to receive(:authorization_response_types)
-        .and_return(["id_token token"])
-
-      stub_const "Doorkeeper::Request::IdTokenToken", fake_class
-      expect(fake_class).to receive(:new).with(subject)
-      subject.authorization_request "id_token token"
-    end
-  end
-end

data/spec/lib/stale_records_cleaner_spec.rb

@@ -1,89 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe Doorkeeper::StaleRecordsCleaner do
-  let(:cleaner) { described_class.new(model) }
-  let(:models_by_name) do
-    {
-      access_token: Doorkeeper::AccessToken,
-      access_grant: Doorkeeper::AccessGrant,
-    }
-  end
-
-  context "when ORM has no cleaner class" do
-    it "raises an error" do
-      allow_any_instance_of(Doorkeeper::Config).to receive(:orm).and_return("hibernate")
-
-      expect do
-        described_class.for(Doorkeeper::AccessToken)
-      end.to raise_error(Doorkeeper::Errors::NoOrmCleaner, /has no cleaner/)
-    end
-  end
-
-  %i[access_token access_grant].each do |model_name|
-    context "(#{model_name})" do
-      let(:model) { models_by_name.fetch(model_name) }
-
-      describe "#clean_revoked" do
-        subject { cleaner.clean_revoked }
-
-        context "with revoked record" do
-          before do
-            FactoryBot.create model_name, revoked_at: Time.current - 1.minute
-          end
-
-          it "removes the record" do
-            expect { subject }.to change { model.count }.to(0)
-          end
-        end
-
-        context "with record revoked in the future" do
-          before do
-            FactoryBot.create model_name, revoked_at: Time.current + 1.minute
-          end
-
-          it "keeps the record" do
-            expect { subject }.not_to(change { model.count })
-          end
-        end
-
-        context "with unrevoked record" do
-          before do
-            FactoryBot.create model_name, revoked_at: nil
-          end
-
-          it "keeps the record" do
-            expect { subject }.not_to(change { model.count })
-          end
-        end
-      end
-
-      describe "#clean_expired" do
-        subject { cleaner.clean_expired(ttl) }
-        let(:ttl) { 500 }
-        let(:expiry_border) { ttl.seconds.ago }
-
-        context "with record that is expired" do
-          before do
-            FactoryBot.create model_name, created_at: expiry_border - 1.minute
-          end
-
-          it "removes the record" do
-            expect { subject }.to change { model.count }.to(0)
-          end
-        end
-
-        context "with record that is not expired" do
-          before do
-            FactoryBot.create model_name, created_at: expiry_border + 1.minute
-          end
-
-          it "keeps the record" do
-            expect { subject }.not_to(change { model.count })
-          end
-        end
-      end
-    end
-  end
-end