doorkeeper 5.4.0.rc1 → 5.4.0.rc2

data/gemfiles/rails_6_0.gemfile

@@ -1,19 +0,0 @@
-# This file was generated by Appraisal
-
-source "https://rubygems.org"
-
-gem "rails", "~> 6.0.0"
-gem "rspec-core"
-gem "rspec-expectations"
-gem "rspec-mocks"
-gem "rspec-rails", "~> 4.0"
-gem "rspec-support"
-gem "rubocop", "~> 0.80"
-gem "rubocop-performance", require: false
-gem "rubocop-rails", require: false
-gem "bcrypt", "~> 3.1", require: false
-gem "activerecord-jdbcsqlite3-adapter", platform: :jruby
-gem "sqlite3", "~> 1.4", platform: [:ruby, :mswin, :mingw, :x64_mingw]
-gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw]
-
-gemspec path: "../"

data/gemfiles/rails_master.gemfile

@@ -1,19 +0,0 @@
-# This file was generated by Appraisal
-
-source "https://rubygems.org"
-
-gem "rails", git: "https://github.com/rails/rails"
-gem "rspec-core"
-gem "rspec-expectations"
-gem "rspec-mocks"
-gem "rspec-rails", "~> 4.0"
-gem "rspec-support"
-gem "rubocop", "~> 0.80"
-gem "rubocop-performance", require: false
-gem "rubocop-rails", require: false
-gem "bcrypt", "~> 3.1", require: false
-gem "activerecord-jdbcsqlite3-adapter", platform: :jruby
-gem "sqlite3", "~> 1.4", platform: [:ruby, :mswin, :mingw, :x64_mingw]
-gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw]
-
-gemspec path: "../"

data/spec/controllers/application_metal_controller_spec.rb

@@ -1,64 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper_integration"
-
-describe Doorkeeper::ApplicationMetalController do
-  controller(Doorkeeper::ApplicationMetalController) do
-    def index
-      render json: {}, status: 200
-    end
-
-    def create
-      render json: {}, status: 200
-    end
-  end
-
-  it "lazy run hooks" do
-    i = 0
-    ActiveSupport.on_load(:doorkeeper_metal_controller) { i += 1 }
-
-    expect(i).to eq 1
-  end
-
-  describe "enforce_content_type" do
-    before { allow(Doorkeeper.config).to receive(:enforce_content_type).and_return(flag) }
-
-    context "enabled" do
-      let(:flag) { true }
-
-      it "returns a 200 for the requests without body" do
-        get :index, params: {}
-        expect(response).to have_http_status 200
-      end
-
-      it "returns a 200 for the requests with body and correct media type" do
-        post :create, params: {}, as: :url_encoded_form
-        expect(response).to have_http_status 200
-      end
-
-      it "returns a 415 for the requests with body and incorrect media type" do
-        post :create, params: {}, as: :json
-        expect(response).to have_http_status 415
-      end
-    end
-
-    context "disabled" do
-      let(:flag) { false }
-
-      it "returns a 200 for the correct media type" do
-        get :index, as: :url_encoded_form
-        expect(response).to have_http_status 200
-      end
-
-      it "returns a 200 for an incorrect media type" do
-        get :index, as: :json
-        expect(response).to have_http_status 200
-      end
-
-      it "returns a 200 for the requests with body and incorrect media type" do
-        post :create, params: {}, as: :json
-        expect(response).to have_http_status 200
-      end
-    end
-  end
-end

data/spec/controllers/applications_controller_spec.rb

@@ -1,274 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-module Doorkeeper
-  describe ApplicationsController do
-    context "JSON API" do
-      render_views
-
-      before do
-        allow(Doorkeeper.configuration).to receive(:api_only).and_return(true)
-        allow(Doorkeeper.configuration).to receive(:authenticate_admin).and_return(->(*) { true })
-      end
-
-      it "creates an application" do
-        expect do
-          post :create, params: {
-            doorkeeper_application: {
-              name: "Example",
-              redirect_uri: "https://example.com",
-            }, format: :json,
-          }
-        end.to(change { Doorkeeper::Application.count })
-
-        expect(response).to be_successful
-
-        expect(json_response).to include("id", "name", "uid", "secret", "redirect_uri", "scopes")
-
-        application = Application.last
-        secret_from_response = json_response["secret"]
-        expect(application.secret_matches?(secret_from_response)).to be_truthy
-
-        expect(json_response["name"]).to eq("Example")
-        expect(json_response["redirect_uri"]).to eq("https://example.com")
-      end
-
-      it "returns validation errors on wrong create params" do
-        expect do
-          post :create, params: {
-            doorkeeper_application: {
-              name: "Example",
-            }, format: :json,
-          }
-        end.not_to(change { Doorkeeper::Application.count })
-
-        expect(response).to have_http_status(422)
-
-        expect(json_response).to include("errors")
-      end
-
-      it "returns validations on wrong create params (unspecified scheme)" do
-        expect do
-          post :create, params: {
-            doorkeeper_application: {
-              name: "Example",
-              redirect_uri: "app.com:80",
-            }, format: :json,
-          }
-        end.not_to(change { Doorkeeper::Application.count })
-
-        expect(response).to have_http_status(422)
-
-        expect(json_response).to include("errors")
-      end
-
-      it "returns application info" do
-        application = FactoryBot.create(:application, name: "Change me")
-
-        get :show, params: { id: application.id, format: :json }
-
-        expect(response).to be_successful
-
-        expect(json_response).to include("id", "name", "uid", "secret", "redirect_uri", "scopes")
-      end
-
-      it "updates application" do
-        application = FactoryBot.create(:application, name: "Change me")
-
-        put :update, params: {
-          id: application.id,
-          doorkeeper_application: {
-            name: "Example App",
-            redirect_uri: "https://example.com",
-          }, format: :json,
-        }
-
-        expect(application.reload.name).to eq "Example App"
-
-        expect(json_response).to include("id", "name", "uid", "secret", "redirect_uri", "scopes")
-      end
-
-      it "returns validation errors on wrong update params" do
-        application = FactoryBot.create(:application, name: "Change me")
-
-        put :update, params: {
-          id: application.id,
-          doorkeeper_application: {
-            name: "Example App",
-            redirect_uri: "localhost:3000",
-          }, format: :json,
-        }
-
-        expect(response).to have_http_status(422)
-
-        expect(json_response).to include("errors")
-      end
-
-      it "destroys an application" do
-        application = FactoryBot.create(:application)
-
-        delete :destroy, params: { id: application.id, format: :json }
-
-        expect(response).to have_http_status(204)
-        expect(Application.count).to be_zero
-      end
-    end
-
-    context "when admin is not authenticated" do
-      before do
-        allow(Doorkeeper.config).to receive(:authenticate_admin).and_return(proc do
-          redirect_to main_app.root_url
-        end)
-      end
-
-      it "redirects as set in Doorkeeper.authenticate_admin" do
-        get :index
-        expect(response).to redirect_to(controller.main_app.root_url)
-      end
-
-      it "does not create application" do
-        expect do
-          post :create, params: {
-            doorkeeper_application: {
-              name: "Example",
-              redirect_uri: "https://example.com",
-            },
-          }
-        end.not_to(change { Doorkeeper::Application.count })
-      end
-    end
-
-    context "when admin is authenticated" do
-      context "when application secrets are hashed" do
-        before do
-          allow(Doorkeeper.configuration)
-            .to receive(:application_secret_strategy).and_return(Doorkeeper::SecretStoring::Sha256Hash)
-        end
-
-        it "shows the application secret after creating a new application" do
-          expect do
-            post :create, params: {
-              doorkeeper_application: {
-                name: "Example",
-                redirect_uri: "https://example.com",
-              },
-            }
-          end.to change { Doorkeeper::Application.count }.by(1)
-
-          application = Application.last
-
-          secret_from_flash = flash[:application_secret]
-          expect(secret_from_flash).not_to be_empty
-          expect(application.secret_matches?(secret_from_flash)).to be_truthy
-          expect(response).to redirect_to(controller.main_app.oauth_application_url(application.id))
-
-          get :show, params: { id: application.id, format: :html }
-
-          # We don't know the application secret here (because its hashed) so we can not assert its text on the page
-          # Instead, we read it from the page and then check if it matches the application secret
-          code_element = /code.*id="secret">\s*\K([^<]*)/m.match(response.body)
-          secret_from_page = code_element[1].strip
-
-          expect(response.body).to have_selector("code#application_id", text: application.uid)
-          expect(response.body).to have_selector("code#secret")
-          expect(secret_from_page).not_to be_empty
-          expect(application.secret_matches?(secret_from_page)).to be_truthy
-        end
-
-        it "does not show an application secret when application did already exist" do
-          application = FactoryBot.create(:application)
-          get :show, params: { id: application.id, format: :html }
-
-          expect(response.body).to have_selector("code#application_id", text: application.uid)
-          expect(response.body).to have_selector("code#secret", text: "")
-        end
-
-        it "returns the application details in a json response" do
-          expect do
-            post :create, params: {
-              doorkeeper_application: {
-                name: "Example",
-                redirect_uri: "https://example.com",
-              }, format: :json,
-            }
-          end.to(change { Doorkeeper::Application.count })
-
-          expect(response).to be_successful
-
-          expect(json_response).to include("id", "name", "uid", "secret", "redirect_uri", "scopes")
-
-          application = Application.last
-          secret_from_response = json_response["secret"]
-          expect(application.secret_matches?(secret_from_response)).to be_truthy
-
-          expect(json_response["name"]).to eq("Example")
-          expect(json_response["redirect_uri"]).to eq("https://example.com")
-        end
-      end
-
-      render_views
-
-      before do
-        allow(Doorkeeper.configuration).to receive(:authenticate_admin).and_return(->(*) { true })
-      end
-
-      it "sorts applications by created_at" do
-        first_application = FactoryBot.create(:application)
-        second_application = FactoryBot.create(:application)
-        expect(Doorkeeper::Application).to receive(:ordered_by).and_call_original
-
-        get :index
-
-        expect(response.body).to have_selector("tbody tr:first-child#application_#{first_application.id}")
-        expect(response.body).to have_selector("tbody tr:last-child#application_#{second_application.id}")
-      end
-
-      it "creates application" do
-        expect do
-          post :create, params: {
-            doorkeeper_application: {
-              name: "Example",
-              redirect_uri: "https://example.com",
-            },
-          }
-        end.to change { Doorkeeper::Application.count }.by(1)
-
-        expect(response).to be_redirect
-      end
-
-      it "shows application details" do
-        application = FactoryBot.create(:application)
-        get :show, params: { id: application.id, format: :html }
-
-        expect(response.body).to have_selector("code#application_id", text: application.uid)
-        expect(response.body).to have_selector("code#secret", text: application.plaintext_secret)
-      end
-
-      it "does not allow mass assignment of uid or secret" do
-        application = FactoryBot.create(:application)
-        put :update, params: {
-          id: application.id,
-          doorkeeper_application: {
-            uid: "1A2B3C4D",
-            secret: "1A2B3C4D",
-          },
-        }
-
-        expect(application.reload.uid).not_to eq "1A2B3C4D"
-      end
-
-      it "updates application" do
-        application = FactoryBot.create(:application)
-        put :update, params: {
-          id: application.id, doorkeeper_application: {
-            name: "Example",
-            redirect_uri: "https://example.com",
-          },
-        }
-
-        expect(application.reload.name).to eq "Example"
-      end
-    end
-  end
-end

data/spec/controllers/authorizations_controller_spec.rb

@@ -1,743 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
-  include AuthorizationRequestHelper
-
-  class ActionDispatch::TestResponse
-    def query_params
-      @query_params ||= begin
-        fragment = URI.parse(location).fragment
-        Rack::Utils.parse_query(fragment)
-      end
-    end
-  end
-
-  let(:client)        { FactoryBot.create :application }
-  let(:user)          { User.create!(name: "Joe", password: "sekret") }
-
-  let(:access_token) do
-    FactoryBot.build :access_token,
-                     resource_owner_id: user.id,
-                     resource_owner_type: user.class.name,
-                     application_id: client.id,
-                     scopes: "default"
-  end
-
-  before do
-    Doorkeeper.configure do
-      default_scopes :default
-
-      custom_access_token_expires_in(lambda do |context|
-        context.grant_type == Doorkeeper::OAuth::IMPLICIT ? 1234 : nil
-      end)
-    end
-
-    allow(Doorkeeper.config).to receive(:grant_flows).and_return(["implicit"])
-    allow(Doorkeeper.config).to receive(:authenticate_resource_owner).and_return(->(_) { authenticator_method })
-    allow(controller).to receive(:authenticator_method).and_return(user)
-    expect(controller).to receive(:authenticator_method).at_most(:once)
-  end
-
-  describe "POST #create" do
-    before do
-      post :create, params: { client_id: client.uid, response_type: "token", redirect_uri: client.redirect_uri }
-    end
-
-    it "redirects after authorization" do
-      expect(response).to be_redirect
-    end
-
-    it "redirects to client redirect uri" do
-      expect(response.location).to match(/^#{client.redirect_uri}/)
-    end
-
-    it "includes access token in fragment" do
-      expect(response.query_params["access_token"]).to eq(Doorkeeper::AccessToken.first.token)
-    end
-
-    it "includes token type in fragment" do
-      expect(response.query_params["token_type"]).to eq("Bearer")
-    end
-
-    it "includes token expiration in fragment" do
-      expect(response.query_params["expires_in"].to_i).to eq(1234)
-    end
-
-    it "issues the token for the current client" do
-      expect(Doorkeeper::AccessToken.first.application_id).to eq(client.id)
-    end
-
-    it "issues the token for the current resource owner" do
-      expect(Doorkeeper::AccessToken.first.resource_owner_id).to eq(user.id)
-    end
-  end
-
-  describe "POST #create in API mode" do
-    before do
-      allow(Doorkeeper.config).to receive(:api_only).and_return(true)
-      post :create, params: { client_id: client.uid, response_type: "token", redirect_uri: client.redirect_uri }
-    end
-
-    let(:response_json_body) { JSON.parse(response.body) }
-    let(:redirect_uri) { response_json_body["redirect_uri"] }
-
-    it "renders success after authorization" do
-      expect(response).to be_successful
-    end
-
-    it "renders correct redirect uri" do
-      expect(redirect_uri).to match(/^#{client.redirect_uri}/)
-    end
-
-    it "includes access token in fragment" do
-      expect(redirect_uri.match(/access_token=([a-zA-Z0-9\-_]+)&?/)[1]).to eq(Doorkeeper::AccessToken.first.token)
-    end
-
-    it "includes token type in fragment" do
-      expect(redirect_uri.match(/token_type=(\w+)&?/)[1]).to eq "Bearer"
-    end
-
-    it "includes token expiration in fragment" do
-      expect(redirect_uri.match(/expires_in=(\d+)&?/)[1].to_i).to eq 1234
-    end
-
-    it "issues the token for the current client" do
-      expect(Doorkeeper::AccessToken.first.application_id).to eq(client.id)
-    end
-
-    it "issues the token for the current resource owner" do
-      expect(Doorkeeper::AccessToken.first.resource_owner_id).to eq(user.id)
-    end
-  end
-
-  describe "POST #create with errors" do
-    context "when missing client_id" do
-      before do
-        post :create, params: {
-          client_id: "",
-          response_type: "token",
-          redirect_uri: client.redirect_uri,
-        }
-      end
-
-      let(:response_json_body) { JSON.parse(response.body) }
-
-      it "renders 400 error" do
-        expect(response.status).to eq 400
-      end
-
-      it "includes error name" do
-        expect(response_json_body["error"]).to eq("invalid_request")
-      end
-
-      it "includes error description" do
-        expect(response_json_body["error_description"]).to eq(
-          translated_invalid_request_error_message(:missing_param, :client_id),
-        )
-      end
-
-      it "does not issue any access token" do
-        expect(Doorkeeper::AccessToken.all).to be_empty
-      end
-    end
-
-    context "when user cannot access application" do
-      before do
-        allow(Doorkeeper.configuration).to receive(:authorize_resource_owner_for_client).and_return(->(*_) { false })
-        post :create, params: {
-          client_id: client.uid,
-          response_type: "token",
-          redirect_uri: client.redirect_uri,
-        }
-      end
-
-      let(:response_json_body) { JSON.parse(response.body) }
-
-      it "renders 400 error" do
-        expect(response.status).to eq 401
-      end
-
-      it "includes error name" do
-        expect(response_json_body["error"]).to eq("invalid_client")
-      end
-
-      it "includes error description" do
-        expect(response_json_body["error_description"]).to eq(
-          translated_error_message(:invalid_client),
-        )
-      end
-
-      it "does not issue any access token" do
-        expect(Doorkeeper::AccessToken.all).to be_empty
-      end
-    end
-
-    context "when other error happens" do
-      before do
-        default_scopes_exist :public
-
-        post :create, params: {
-          client_id: client.uid,
-          response_type: "token",
-          scope: "invalid",
-          redirect_uri: client.redirect_uri,
-        }
-      end
-
-      it "redirects after authorization" do
-        expect(response).to be_redirect
-      end
-
-      it "redirects to client redirect uri" do
-        expect(response.location).to match(/^#{client.redirect_uri}/)
-      end
-
-      it "does not include access token in fragment" do
-        expect(response.query_params["access_token"]).to be_nil
-      end
-
-      it "includes error in fragment" do
-        expect(response.query_params["error"]).to eq("invalid_scope")
-      end
-
-      it "includes error description in fragment" do
-        expect(response.query_params["error_description"]).to eq(translated_error_message(:invalid_scope))
-      end
-
-      it "does not issue any access token" do
-        expect(Doorkeeper::AccessToken.all).to be_empty
-      end
-    end
-  end
-
-  describe "POST #create in API mode with errors" do
-    context "when missing client_id" do
-      before do
-        allow(Doorkeeper.config).to receive(:api_only).and_return(true)
-
-        post :create, params: {
-          client_id: "",
-          response_type: "token",
-          redirect_uri: client.redirect_uri,
-        }
-      end
-
-      let(:response_json_body) { JSON.parse(response.body) }
-
-      it "renders 400 error" do
-        expect(response.status).to eq 400
-      end
-
-      it "includes error name" do
-        expect(response_json_body["error"]).to eq("invalid_request")
-      end
-
-      it "includes error description" do
-        expect(response_json_body["error_description"]).to eq(
-          translated_invalid_request_error_message(:missing_param, :client_id),
-        )
-      end
-
-      it "does not issue any access token" do
-        expect(Doorkeeper::AccessToken.all).to be_empty
-      end
-    end
-
-    context "when user cannot access application" do
-      before do
-        allow(Doorkeeper.configuration).to receive(:api_only).and_return(true)
-        allow(Doorkeeper.configuration).to receive(:authorize_resource_owner_for_client).and_return(->(*_) { false })
-
-        post :create, params: {
-          client_id: client.uid,
-          response_type: "token",
-          redirect_uri: client.redirect_uri,
-        }
-      end
-
-      let(:response_json_body) { JSON.parse(response.body) }
-
-      it "renders 400 error" do
-        expect(response.status).to eq 401
-      end
-
-      it "includes error name" do
-        expect(response_json_body["error"]).to eq("invalid_client")
-      end
-
-      it "includes error description" do
-        expect(response_json_body["error_description"]).to eq(
-          translated_error_message(:invalid_client),
-        )
-      end
-
-      it "does not issue any access token" do
-        expect(Doorkeeper::AccessToken.all).to be_empty
-      end
-    end
-
-    context "when other error happens" do
-      before do
-        allow(Doorkeeper.config).to receive(:api_only).and_return(true)
-        default_scopes_exist :public
-
-        post :create, params: {
-          client_id: client.uid,
-          response_type: "token",
-          scope: "invalid",
-          redirect_uri: client.redirect_uri,
-        }
-      end
-
-      let(:response_json_body) { JSON.parse(response.body) }
-      let(:redirect_uri) { response_json_body["redirect_uri"] }
-
-      it "renders 400 error" do
-        expect(response.status).to eq 400
-      end
-
-      it "includes correct redirect URI" do
-        expect(redirect_uri).to match(/^#{client.redirect_uri}/)
-      end
-
-      it "does not include access token in fragment" do
-        expect(redirect_uri.match(/access_token=([a-f0-9]+)&?/)).to be_nil
-      end
-
-      it "includes error in redirect uri" do
-        expect(redirect_uri.match(/error=([a-z_]+)&?/)[1]).to eq "invalid_scope"
-      end
-
-      it "includes error description in redirect uri" do
-        expect(redirect_uri.match(/error_description=(.+)&?/)[1]).to_not be_nil
-      end
-
-      it "does not issue any access token" do
-        expect(Doorkeeper::AccessToken.all).to be_empty
-      end
-    end
-  end
-
-  describe "POST #create with application already authorized" do
-    before do
-      allow(Doorkeeper.config).to receive(:reuse_access_token).and_return(true)
-
-      access_token.save!
-
-      post :create, params: {
-        client_id: client.uid,
-        response_type: "token",
-        redirect_uri: client.redirect_uri,
-      }
-    end
-
-    it "returns the existing access token in a fragment" do
-      expect(response.query_params["access_token"]).to eq(access_token.token)
-    end
-
-    it "does not creates a new access token" do
-      expect(Doorkeeper::AccessToken.count).to eq(1)
-    end
-  end
-
-  describe "POST #create with callbacks" do
-    after do
-      client.update_attribute :redirect_uri, "urn:ietf:wg:oauth:2.0:oob"
-    end
-
-    describe "when successful" do
-      after do
-        post :create, params: {
-          client_id: client.uid,
-          response_type: "token",
-          redirect_uri: client.redirect_uri,
-        }
-      end
-
-      it "should call :before_successful_authorization callback" do
-        expect(Doorkeeper.config)
-          .to receive_message_chain(:before_successful_authorization, :call)
-          .with(instance_of(described_class), instance_of(Doorkeeper::OAuth::Hooks::Context))
-      end
-
-      it "should call :after_successful_authorization callback" do
-        expect(Doorkeeper.config)
-          .to receive_message_chain(:after_successful_authorization, :call)
-          .with(instance_of(described_class), instance_of(Doorkeeper::OAuth::Hooks::Context))
-      end
-    end
-
-    describe "with errors" do
-      after do
-        post :create, params: { client_id: client.uid, response_type: "token", redirect_uri: "bad_uri" }
-      end
-
-      it "should not call :before_successful_authorization callback" do
-        expect(Doorkeeper.config).not_to receive(:before_successful_authorization)
-      end
-
-      it "should not call :after_successful_authorization callback" do
-        expect(Doorkeeper.config).not_to receive(:after_successful_authorization)
-      end
-    end
-  end
-
-  describe "GET #new token request with native url and skip_authorization true" do
-    before do
-      allow(Doorkeeper.config).to receive(:skip_authorization).and_return(proc do
-        true
-      end)
-
-      client.update_attribute :redirect_uri, "urn:ietf:wg:oauth:2.0:oob"
-
-      get :new, params: {
-        client_id: client.uid,
-        response_type: "token",
-        redirect_uri: client.redirect_uri,
-      }
-    end
-
-    it "should redirect immediately" do
-      expect(response).to be_redirect
-      expect(response.location).to match(%r{/oauth/token/info\?access_token=})
-    end
-
-    it "should not issue a grant" do
-      expect(Doorkeeper::AccessGrant.count).to be 0
-    end
-
-    it "should issue a token" do
-      expect(Doorkeeper::AccessToken.count).to be 1
-    end
-  end
-
-  describe "GET #new code request with native url and skip_authorization true" do
-    before do
-      allow(Doorkeeper.config).to receive(:grant_flows).and_return(%w[authorization_code])
-      allow(Doorkeeper.config).to receive(:skip_authorization).and_return(proc do
-        true
-      end)
-
-      client.update_attribute :redirect_uri, "urn:ietf:wg:oauth:2.0:oob"
-
-      get :new, params: {
-        client_id: client.uid,
-        response_type: "code",
-        redirect_uri: client.redirect_uri,
-      }
-    end
-
-    it "should redirect immediately" do
-      expect(response).to be_redirect
-      expect(response.location)
-        .to match(%r{/oauth/authorize/native\?code=#{Doorkeeper::AccessGrant.first.token}})
-    end
-
-    it "should issue a grant" do
-      expect(Doorkeeper::AccessGrant.count).to be 1
-    end
-
-    it "should not issue a token" do
-      expect(Doorkeeper::AccessToken.count).to be 0
-    end
-  end
-
-  describe "GET #new with skip_authorization true" do
-    before do
-      allow(Doorkeeper.config).to receive(:skip_authorization).and_return(proc do
-        true
-      end)
-
-      get :new, params: {
-        client_id: client.uid,
-        response_type: "token",
-        redirect_uri: client.redirect_uri,
-      }
-    end
-
-    it "should redirect immediately" do
-      expect(response).to be_redirect
-      expect(response.location).to match(/^#{client.redirect_uri}/)
-    end
-
-    it "should issue a token" do
-      expect(Doorkeeper::AccessToken.count).to be 1
-    end
-
-    it "includes token type in fragment" do
-      expect(response.query_params["token_type"]).to eq("Bearer")
-    end
-
-    it "includes token expiration in fragment" do
-      expect(response.query_params["expires_in"].to_i).to eq(1234)
-    end
-
-    it "issues the token for the current client" do
-      expect(Doorkeeper::AccessToken.first.application_id).to eq(client.id)
-    end
-
-    it "issues the token for the current resource owner" do
-      expect(Doorkeeper::AccessToken.first.resource_owner_id).to eq(user.id)
-    end
-  end
-
-  describe "GET #new in API mode" do
-    before do
-      allow(Doorkeeper.config).to receive(:api_only).and_return(true)
-
-      get :new, params: {
-        client_id: client.uid,
-        response_type: "token",
-        redirect_uri: client.redirect_uri,
-      }
-    end
-
-    it "should render success" do
-      expect(response).to be_successful
-    end
-
-    it "sets status to pre-authorization" do
-      expect(json_response["status"]).to eq(I18n.t("doorkeeper.pre_authorization.status"))
-    end
-
-    it "sets correct values" do
-      expect(json_response["client_id"]).to eq(client.uid)
-      expect(json_response["redirect_uri"]).to eq(client.redirect_uri)
-      expect(json_response["state"]).to be_nil
-      expect(json_response["response_type"]).to eq("token")
-      expect(json_response["scope"]).to eq("default")
-    end
-  end
-
-  describe "GET #new in API mode with skip_authorization true" do
-    before do
-      allow(Doorkeeper.configuration).to receive(:skip_authorization).and_return(proc { true })
-      allow(Doorkeeper.configuration).to receive(:api_only).and_return(true)
-
-      get :new, params: {
-        client_id: client.uid,
-        response_type: "token",
-        redirect_uri: client.redirect_uri,
-      }
-    end
-
-    it "should render success" do
-      expect(response).to be_successful
-    end
-
-    it "should issue a token" do
-      expect(Doorkeeper::AccessToken.count).to be 1
-    end
-
-    it "sets status to redirect" do
-      expect(JSON.parse(response.body)["status"]).to eq("redirect")
-    end
-
-    it "sets redirect_uri to correct value" do
-      redirect_uri = JSON.parse(response.body)["redirect_uri"]
-      expect(redirect_uri).to_not be_nil
-      expect(redirect_uri.match(/token_type=(\w+)&?/)[1]).to eq "Bearer"
-      expect(redirect_uri.match(/expires_in=(\d+)&?/)[1].to_i).to eq 1234
-      expect(
-        redirect_uri.match(/access_token=([a-zA-Z0-9\-_]+)&?/)[1],
-      ).to eq Doorkeeper::AccessToken.first.token
-    end
-
-    it "issues the token for the current client" do
-      expect(Doorkeeper::AccessToken.first.application_id).to eq(client.id)
-    end
-
-    it "issues the token for the current resource owner" do
-      expect(Doorkeeper::AccessToken.first.resource_owner_id).to eq(user.id)
-    end
-  end
-
-  describe "GET #new with errors" do
-    context "without valid params" do
-      before do
-        default_scopes_exist :public
-        get :new, params: { an_invalid: "request" }
-      end
-
-      it "does not redirect" do
-        expect(response).to_not be_redirect
-      end
-
-      it "does not issue any token" do
-        expect(Doorkeeper::AccessGrant.count).to eq 0
-        expect(Doorkeeper::AccessToken.count).to eq 0
-      end
-    end
-
-    context "when user cannot access application" do
-      before do
-        allow(Doorkeeper.configuration).to receive(:authorize_resource_owner_for_client).and_return(->(*_) { false })
-
-        get :new, params: {
-          client_id: client.uid,
-          response_type: "token",
-          redirect_uri: client.redirect_uri,
-        }
-      end
-
-      it "does not redirect" do
-        expect(response).to_not be_redirect
-      end
-
-      it "does not issue any token" do
-        expect(Doorkeeper::AccessGrant.count).to eq 0
-        expect(Doorkeeper::AccessToken.count).to eq 0
-      end
-    end
-  end
-
-  describe "GET #new in API mode with errors" do
-    before do
-      allow(Doorkeeper.configuration).to receive(:api_only).and_return(true)
-      default_scopes_exist :public
-    end
-
-    context "without valid params" do
-      before do
-        get :new, params: { an_invalid: "request" }
-      end
-
-      let(:response_json_body) { JSON.parse(response.body) }
-
-      it "should render bad request" do
-        expect(response).to have_http_status(:bad_request)
-      end
-
-      it "includes error in body" do
-        expect(response_json_body["error"]).to eq("invalid_request")
-      end
-
-      it "includes error description in body" do
-        expect(response_json_body["error_description"])
-          .to eq(translated_invalid_request_error_message(:missing_param, :client_id))
-      end
-
-      it "does not issue any token" do
-        expect(Doorkeeper::AccessGrant.count).to eq 0
-        expect(Doorkeeper::AccessToken.count).to eq 0
-      end
-    end
-
-    context "when user cannot access application" do
-      before do
-        allow(Doorkeeper.configuration).to receive(:authorize_resource_owner_for_client).and_return(->(*_) { false })
-
-        get :new, params: {
-          client_id: client.uid,
-          response_type: "token",
-          redirect_uri: client.redirect_uri,
-        }
-      end
-
-      let(:response_json_body) { JSON.parse(response.body) }
-
-      it "should render bad request" do
-        expect(response).to have_http_status(:bad_request)
-      end
-
-      it "includes error in body" do
-        expect(response_json_body["error"]).to eq("invalid_client")
-      end
-
-      it "includes error description in body" do
-        expect(response_json_body["error_description"])
-          .to eq(translated_error_message(:invalid_client))
-      end
-
-      it "does not issue any token" do
-        expect(Doorkeeper::AccessGrant.count).to eq 0
-        expect(Doorkeeper::AccessToken.count).to eq 0
-      end
-    end
-  end
-
-  describe "GET #new with callbacks" do
-    after do
-      client.update_attribute :redirect_uri, "urn:ietf:wg:oauth:2.0:oob"
-      get :new, params: { client_id: client.uid, response_type: "token", redirect_uri: client.redirect_uri }
-    end
-
-    describe "when authorizing" do
-      before do
-        allow(Doorkeeper.configuration).to receive(:skip_authorization).and_return(proc { true })
-      end
-
-      it "should call :before_successful_authorization callback" do
-        expect(Doorkeeper.configuration)
-          .to receive_message_chain(:before_successful_authorization, :call)
-          .with(instance_of(described_class), instance_of(Doorkeeper::OAuth::Hooks::Context))
-      end
-
-      it "should call :after_successful_authorization callback" do
-        expect(Doorkeeper.configuration)
-          .to receive_message_chain(:after_successful_authorization, :call)
-          .with(instance_of(described_class), instance_of(Doorkeeper::OAuth::Hooks::Context))
-      end
-    end
-
-    describe "when not authorizing" do
-      before do
-        allow(Doorkeeper.configuration).to receive(:skip_authorization).and_return(proc { false })
-      end
-
-      it "should not call :before_successful_authorization callback" do
-        expect(Doorkeeper.configuration).not_to receive(:before_successful_authorization)
-      end
-
-      it "should not call :after_successful_authorization callback" do
-        expect(Doorkeeper.configuration).not_to receive(:after_successful_authorization)
-      end
-    end
-
-    describe "when not authorizing in api mode" do
-      before do
-        allow(Doorkeeper.configuration).to receive(:skip_authorization).and_return(proc { false })
-        allow(Doorkeeper.configuration).to receive(:api_only).and_return(true)
-      end
-
-      it "should not call :before_successful_authorization callback" do
-        expect(Doorkeeper.configuration).not_to receive(:before_successful_authorization)
-      end
-
-      it "should not call :after_successful_authorization callback" do
-        expect(Doorkeeper.configuration).not_to receive(:after_successful_authorization)
-      end
-    end
-  end
-
-  describe "authorize response memoization" do
-    it "memoizes the result of the authorization" do
-      pre_auth = double(:pre_auth, authorizable?: true)
-      allow(controller).to receive(:pre_auth) { pre_auth }
-      strategy = double(:strategy, authorize: true)
-      expect(strategy).to receive(:authorize).once
-      allow(controller).to receive(:strategy) { strategy }
-      allow(controller).to receive(:create) do
-        2.times { controller.send :authorize_response }
-        controller.render json: {}, status: :ok
-      end
-
-      post :create
-    end
-  end
-
-  describe "strong parameters" do
-    it "ignores non-scalar scope parameter" do
-      get :new, params: {
-        client_id: client.uid,
-        response_type: "token",
-        redirect_uri: client.redirect_uri,
-        scope: { "0" => "profile" },
-      }
-
-      expect(response).to be_successful
-    end
-  end
-end