doorkeeper 5.3.3 → 5.6.6

data/spec/requests/applications/applications_request_spec.rb

@@ -1,259 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-feature "Adding applications" do
-  context "in application form" do
-    background do
-      i_am_logged_in
-      visit "/oauth/applications/new"
-    end
-
-    scenario "adding a valid app" do
-      fill_in "doorkeeper_application[name]", with: "My Application"
-      fill_in "doorkeeper_application[redirect_uri]",
-              with: "https://example.com"
-
-      click_button "Submit"
-      i_should_see "Application created"
-      i_should_see "My Application"
-    end
-
-    scenario "adding invalid app" do
-      click_button "Submit"
-      i_should_see "Whoops! Check your form for possible errors"
-    end
-
-    scenario "adding app ignoring bad scope" do
-      config_is_set("enforce_configured_scopes", false)
-
-      fill_in "doorkeeper_application[name]", with: "My Application"
-      fill_in "doorkeeper_application[redirect_uri]",
-              with: "https://example.com"
-      fill_in "doorkeeper_application[scopes]", with: "blahblah"
-
-      click_button "Submit"
-      i_should_see "Application created"
-      i_should_see "My Application"
-    end
-
-    scenario "adding app validating bad scope" do
-      config_is_set("enforce_configured_scopes", true)
-
-      fill_in "doorkeeper_application[name]", with: "My Application"
-      fill_in "doorkeeper_application[redirect_uri]",
-              with: "https://example.com"
-      fill_in "doorkeeper_application[scopes]", with: "blahblah"
-
-      click_button "Submit"
-      i_should_see "Whoops! Check your form for possible errors"
-    end
-
-    scenario "adding app validating scope, blank scope is accepted" do
-      config_is_set("enforce_configured_scopes", true)
-
-      fill_in "doorkeeper_application[name]", with: "My Application"
-      fill_in "doorkeeper_application[redirect_uri]",
-              with: "https://example.com"
-      fill_in "doorkeeper_application[scopes]", with: ""
-
-      click_button "Submit"
-      i_should_see "Application created"
-      i_should_see "My Application"
-    end
-
-    scenario "adding app validating scope, multiple scopes configured" do
-      config_is_set("enforce_configured_scopes", true)
-      scopes = Doorkeeper::OAuth::Scopes.from_array(%w[read write admin])
-      config_is_set("optional_scopes", scopes)
-
-      fill_in "doorkeeper_application[name]", with: "My Application"
-      fill_in "doorkeeper_application[redirect_uri]",
-              with: "https://example.com"
-      fill_in "doorkeeper_application[scopes]", with: "read write"
-
-      click_button "Submit"
-      i_should_see "Application created"
-      i_should_see "My Application"
-    end
-
-    scenario "adding app validating scope, bad scope with multiple scopes configured" do
-      config_is_set("enforce_configured_scopes", true)
-      scopes = Doorkeeper::OAuth::Scopes.from_array(%w[read write admin])
-      config_is_set("optional_scopes", scopes)
-
-      fill_in "doorkeeper_application[name]", with: "My Application"
-      fill_in "doorkeeper_application[redirect_uri]",
-              with: "https://example.com"
-      fill_in "doorkeeper_application[scopes]", with: "read blah"
-
-      click_button "Submit"
-      i_should_see "Whoops! Check your form for possible errors"
-      i_should_see Regexp.new(
-        I18n.t("activerecord.errors.models.doorkeeper/application.attributes.scopes.not_match_configured"),
-        true,
-      )
-    end
-
-    context "redirect URI" do
-      scenario "adding app with blank redirect URI when configured flows requires redirect uri" do
-        config_is_set("grant_flows", %w[authorization_code implicit client_credentials])
-
-        fill_in "doorkeeper_application[name]", with: "My Application"
-        fill_in "doorkeeper_application[redirect_uri]",
-                with: ""
-
-        click_button "Submit"
-        i_should_see "Whoops! Check your form for possible errors"
-      end
-
-      scenario "adding app with blank redirect URI when configured flows without redirect uri" do
-        config_is_set("grant_flows", %w[client_credentials password])
-
-        # Visit it once again to consider grant flows
-        visit "/oauth/applications/new"
-
-        i_should_see I18n.t("doorkeeper.applications.help.blank_redirect_uri")
-
-        fill_in "doorkeeper_application[name]", with: "My Application"
-        fill_in "doorkeeper_application[redirect_uri]",
-                with: ""
-
-        click_button "Submit"
-        i_should_see "Application created"
-        i_should_see "My Application"
-      end
-    end
-  end
-end
-
-feature "Listing applications" do
-  background do
-    i_am_logged_in
-
-    FactoryBot.create :application, name: "Oauth Dude"
-    FactoryBot.create :application, name: "Awesome App"
-  end
-
-  scenario "application list" do
-    visit "/oauth/applications"
-
-    i_should_see "Awesome App"
-    i_should_see "Oauth Dude"
-  end
-end
-
-feature "Renders assets" do
-  scenario "admin stylesheets" do
-    visit "/assets/doorkeeper/admin/application.css"
-
-    i_should_see "Bootstrap"
-    i_should_see ".doorkeeper-admin"
-  end
-
-  scenario "application stylesheets" do
-    visit "/assets/doorkeeper/application.css"
-
-    i_should_see "Bootstrap"
-    i_should_see "#oauth-permissions"
-    i_should_see "#container"
-  end
-end
-
-feature "Show application" do
-  given :app do
-    i_am_logged_in
-
-    FactoryBot.create :application, name: "Just another oauth app"
-  end
-
-  scenario "visiting application page" do
-    visit "/oauth/applications/#{app.id}"
-
-    i_should_see "Just another oauth app"
-  end
-end
-
-feature "Edit application" do
-  let :app do
-    FactoryBot.create :application, name: "OMG my app"
-  end
-
-  background do
-    i_am_logged_in
-
-    visit "/oauth/applications/#{app.id}/edit"
-  end
-
-  scenario "updating a valid app" do
-    fill_in "doorkeeper_application[name]", with: "Serious app"
-    click_button "Submit"
-
-    i_should_see "Application updated"
-    i_should_see "Serious app"
-    i_should_not_see "OMG my app"
-  end
-
-  scenario "updating an invalid app" do
-    fill_in "doorkeeper_application[name]", with: ""
-    click_button "Submit"
-
-    i_should_see "Whoops! Check your form for possible errors"
-  end
-end
-
-feature "Remove application" do
-  background do
-    i_am_logged_in
-
-    @app = FactoryBot.create :application
-  end
-
-  scenario "deleting an application from list" do
-    visit "/oauth/applications"
-
-    i_should_see @app.name
-
-    within(:css, "tr#application_#{@app.id}") do
-      click_button "Destroy"
-    end
-
-    i_should_see "Application deleted"
-    i_should_not_see @app.name
-  end
-
-  scenario "deleting an application from show" do
-    visit "/oauth/applications/#{@app.id}"
-    click_button "Destroy"
-
-    i_should_see "Application deleted"
-  end
-end
-
-context "when admin authenticator block is default" do
-  let(:app) { FactoryBot.create :application, name: "app" }
-
-  feature "application list" do
-    scenario "fails with forbidden" do
-      visit "/oauth/applications"
-
-      should_have_status 403
-    end
-  end
-
-  feature "adding an app" do
-    scenario "fails with forbidden" do
-      visit "/oauth/applications/new"
-
-      should_have_status 403
-    end
-  end
-
-  feature "editing an app" do
-    scenario "fails with forbidden" do
-      visit "/oauth/applications/#{app.id}/edit"
-
-      should_have_status 403
-    end
-  end
-end

data/spec/requests/applications/authorized_applications_spec.rb

@@ -1,32 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-feature "Authorized applications" do
-  background do
-    @user   = User.create!(name: "Joe", password: "sekret")
-    @client = client_exists(name: "Amazing Client App")
-    resource_owner_is_authenticated @user
-    client_is_authorized @client, @user
-  end
-
-  scenario "display user's authorized applications" do
-    visit "/oauth/authorized_applications"
-    i_should_see "Amazing Client App"
-  end
-
-  scenario "do not display other user's authorized applications" do
-    client = client_exists(name: "Another Client App")
-    client_is_authorized client, User.create!(name: "Joe", password: "sekret")
-    visit "/oauth/authorized_applications"
-    i_should_not_see "Another Client App"
-  end
-
-  scenario "user revoke access to application" do
-    visit "/oauth/authorized_applications"
-    i_should_see "Amazing Client App"
-    click_on "Revoke"
-    i_should_see "Application revoked"
-    i_should_not_see "Amazing Client App"
-  end
-end

data/spec/requests/endpoints/authorization_spec.rb

@@ -1,91 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-feature "Authorization endpoint" do
-  background do
-    default_scopes_exist :default
-    config_is_set(:authenticate_resource_owner) { User.first || redirect_to("/sign_in") }
-    client_exists(name: "MyApp")
-  end
-
-  scenario "requires resource owner to be authenticated" do
-    visit authorization_endpoint_url(client: @client)
-    i_should_see "Sign in"
-    i_should_be_on "/"
-  end
-
-  context "with authenticated resource owner" do
-    background do
-      create_resource_owner
-      sign_in
-    end
-
-    scenario "displays the authorization form" do
-      visit authorization_endpoint_url(client: @client)
-      i_should_see "Authorize MyApp to use your account?"
-    end
-
-    scenario "displays all requested scopes" do
-      default_scopes_exist :public
-      optional_scopes_exist :write
-      visit authorization_endpoint_url(client: @client, scope: "public write")
-      i_should_see "Access your public data"
-      i_should_see "Update your data"
-    end
-  end
-
-  context "with a invalid request's param" do
-    background do
-      create_resource_owner
-      sign_in
-    end
-
-    context "when missing required param" do
-      scenario "displays invalid_request error when missing client" do
-        visit authorization_endpoint_url(client: nil, response_type: "code")
-        i_should_not_see "Authorize"
-        i_should_see_translated_invalid_request_error_message :missing_param, :client_id
-      end
-
-      scenario "displays invalid_request error when missing response_type param" do
-        visit authorization_endpoint_url(client: @client, response_type: "")
-        i_should_not_see "Authorize"
-        i_should_see_translated_invalid_request_error_message :missing_param, :response_type
-      end
-
-      scenario "displays invalid_request error when missing scope param and authorization server has no default scopes" do
-        config_is_set(:default_scopes, [])
-        visit authorization_endpoint_url(client: @client, response_type: "code", scope: "")
-        i_should_not_see "Authorize"
-        i_should_see_translated_invalid_request_error_message :missing_param, :scope
-      end
-    end
-
-    scenario "displays unsupported_response_type error when using a disabled response type" do
-      config_is_set(:grant_flows, ["implicit"])
-      visit authorization_endpoint_url(client: @client, response_type: "code")
-      i_should_not_see "Authorize"
-      i_should_see_translated_error_message :unsupported_response_type
-    end
-  end
-
-  context "forgery protection enabled" do
-    background do
-      create_resource_owner
-      sign_in
-    end
-
-    scenario "raises exception on forged requests" do
-      allowing_forgery_protection do
-        expect do
-          page.driver.post authorization_endpoint_url(
-            client_id: @client.uid,
-            redirect_uri: @client.redirect_uri,
-            response_type: "code",
-          )
-        end.to raise_error(ActionController::InvalidAuthenticityToken)
-      end
-    end
-  end
-end

data/spec/requests/endpoints/token_spec.rb

@@ -1,75 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe "Token endpoint" do
-  before do
-    client_exists
-    authorization_code_exists application: @client, scopes: "public"
-  end
-
-  it "respond with correct headers" do
-    post token_endpoint_url(code: @authorization.token, client: @client)
-    should_have_header "Pragma", "no-cache"
-
-    # Rails 5.2 changed headers
-    if ::Rails::VERSION::MAJOR >= 5 && ::Rails::VERSION::MINOR >= 2 || ::Rails::VERSION::MAJOR >= 6
-      should_have_header "Cache-Control", "private, no-store"
-    else
-      should_have_header "Cache-Control", "no-store"
-    end
-
-    should_have_header "Content-Type", "application/json; charset=utf-8"
-  end
-
-  it "accepts client credentials with basic auth header" do
-    post token_endpoint_url,
-         params: {
-           code: @authorization.token,
-           redirect_uri: @client.redirect_uri,
-         },
-         headers: { "HTTP_AUTHORIZATION" => basic_auth_header_for_client(@client) }
-
-    should_have_json "access_token", Doorkeeper::AccessToken.first.token
-  end
-
-  it "returns null for expires_in when a permanent token is set" do
-    config_is_set(:access_token_expires_in, nil)
-    post token_endpoint_url(code: @authorization.token, client: @client)
-    should_have_json "access_token", Doorkeeper::AccessToken.first.token
-    should_not_have_json "expires_in"
-  end
-
-  it "returns unsupported_grant_type for invalid grant_type param" do
-    post token_endpoint_url(code: @authorization.token, client: @client, grant_type: "nothing")
-
-    should_not_have_json "access_token"
-    should_have_json "error", "unsupported_grant_type"
-    should_have_json "error_description", translated_error_message("unsupported_grant_type")
-  end
-
-  it "returns unsupported_grant_type for disabled grant flows" do
-    config_is_set(:grant_flows, ["implicit"])
-    post token_endpoint_url(code: @authorization.token, client: @client, grant_type: "authorization_code")
-
-    should_not_have_json "access_token"
-    should_have_json "error", "unsupported_grant_type"
-    should_have_json "error_description", translated_error_message("unsupported_grant_type")
-  end
-
-  it "returns unsupported_grant_type when refresh_token is not in use" do
-    post token_endpoint_url(code: @authorization.token, client: @client, grant_type: "refresh_token")
-
-    should_not_have_json "access_token"
-    should_have_json "error", "unsupported_grant_type"
-    should_have_json "error_description", translated_error_message("unsupported_grant_type")
-  end
-
-  it "returns invalid_request if grant_type is missing" do
-    post token_endpoint_url(code: @authorization.token, client: @client, grant_type: "")
-
-    should_not_have_json "access_token"
-    should_have_json "error", "invalid_request"
-    should_have_json "error_description", translated_invalid_request_error_message(:missing_param, :grant_type)
-  end
-end

data/spec/requests/flows/authorization_code_errors_spec.rb

@@ -1,79 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-feature "Authorization Code Flow Errors" do
-  let(:client_params) { {} }
-  background do
-    default_scopes_exist :default
-    config_is_set(:authenticate_resource_owner) { User.first || redirect_to("/sign_in") }
-    client_exists client_params
-    create_resource_owner
-    sign_in
-  end
-
-  after do
-    access_grant_should_not_exist
-  end
-
-  context "with a client trying to xss resource owner" do
-    let(:client_name) { "<div id='xss'>XSS</div>" }
-    let(:client_params) { { name: client_name } }
-    scenario "resource owner visit authorization endpoint" do
-      visit authorization_endpoint_url(client: @client)
-      expect(page).not_to have_css("#xss")
-    end
-  end
-
-  context "when access was denied" do
-    scenario "redirects with error" do
-      visit authorization_endpoint_url(client: @client)
-      click_on "Deny"
-
-      i_should_be_on_client_callback @client
-      url_should_not_have_param "code"
-      url_should_have_param "error", "access_denied"
-      url_should_have_param "error_description", translated_error_message(:access_denied)
-    end
-
-    scenario "redirects with state parameter" do
-      visit authorization_endpoint_url(client: @client, state: "return-this")
-      click_on "Deny"
-
-      i_should_be_on_client_callback @client
-      url_should_not_have_param "code"
-      url_should_have_param "state", "return-this"
-    end
-  end
-end
-
-describe "Authorization Code Flow Errors", "after authorization" do
-  before do
-    client_exists
-    authorization_code_exists application: @client
-  end
-
-  it "returns :invalid_grant error when posting an already revoked grant code" do
-    # First successful request
-    post token_endpoint_url(code: @authorization.token, client: @client)
-
-    # Second attempt with same token
-    expect do
-      post token_endpoint_url(code: @authorization.token, client: @client)
-    end.to_not(change { Doorkeeper::AccessToken.count })
-
-    should_not_have_json "access_token"
-    should_have_json "error", "invalid_grant"
-    should_have_json "error_description", translated_error_message("invalid_grant")
-  end
-
-  it "returns :invalid_grant error for invalid grant code" do
-    post token_endpoint_url(code: "invalid", client: @client)
-
-    access_token_should_not_exist
-
-    should_not_have_json "access_token"
-    should_have_json "error", "invalid_grant"
-    should_have_json "error_description", translated_error_message("invalid_grant")
-  end
-end