doorkeeper 5.4.0.rc1 → 5.5.0

data/spec/lib/oauth/invalid_token_response_spec.rb

@@ -1,53 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe Doorkeeper::OAuth::InvalidTokenResponse do
-  describe "#name" do
-    it { expect(subject.name).to eq(:invalid_token) }
-  end
-
-  describe "#status" do
-    it { expect(subject.status).to eq(:unauthorized) }
-  end
-
-  describe ".from_access_token" do
-    let(:response) { described_class.from_access_token(access_token) }
-
-    context "revoked" do
-      let(:access_token) { double(revoked?: true, expired?: true) }
-
-      it "sets a description" do
-        expect(response.description).to include("revoked")
-      end
-
-      it "sets the reason" do
-        expect(response.reason).to eq(:revoked)
-      end
-    end
-
-    context "expired" do
-      let(:access_token) { double(revoked?: false, expired?: true) }
-
-      it "sets a description" do
-        expect(response.description).to include("expired")
-      end
-
-      it "sets the reason" do
-        expect(response.reason).to eq(:expired)
-      end
-    end
-
-    context "unknown" do
-      let(:access_token) { double(revoked?: false, expired?: false) }
-
-      it "sets a description" do
-        expect(response.description).to include("invalid")
-      end
-
-      it "sets the reason" do
-        expect(response.reason).to eq(:unknown)
-      end
-    end
-  end
-end

data/spec/lib/oauth/password_access_token_request_spec.rb

@@ -1,201 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe Doorkeeper::OAuth::PasswordAccessTokenRequest do
-  let(:server) do
-    double(
-      :server,
-      default_scopes: Doorkeeper::OAuth::Scopes.new,
-      access_token_expires_in: 2.hours,
-      refresh_token_enabled?: false,
-      custom_access_token_expires_in: lambda { |context|
-        context.grant_type == Doorkeeper::OAuth::PASSWORD ? 1234 : nil
-      },
-    )
-  end
-  let(:client) { FactoryBot.create(:application) }
-  let(:owner)  { FactoryBot.create(:resource_owner) }
-
-  before do
-    allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
-  end
-
-  subject do
-    described_class.new(server, client, owner)
-  end
-
-  it "issues a new token for the client" do
-    expect do
-      subject.authorize
-    end.to change { client.reload.access_tokens.count }.by(1)
-
-    expect(client.reload.access_tokens.max_by(&:created_at).expires_in).to eq(1234)
-  end
-
-  it "issues a new token without a client" do
-    subject = described_class.new(server, nil, owner)
-    expect(subject).to be_valid
-
-    expect do
-      subject.authorize
-    end.to change { Doorkeeper::AccessToken.count }.by(1)
-  end
-
-  it "does not issue a new token with an invalid client" do
-    subject = described_class.new(server, nil, owner, { client_id: "bad_id" })
-    expect do
-      subject.authorize
-    end.not_to(change { Doorkeeper::AccessToken.count })
-
-    expect(subject.error).to eq(:invalid_client)
-  end
-
-  it "requires the owner" do
-    subject = described_class.new(server, client, nil)
-    subject.validate
-    expect(subject.error).to eq(:invalid_grant)
-  end
-
-  it "creates token even when there is already one (default)" do
-    FactoryBot.create(
-      :access_token,
-      application_id: client.id,
-      resource_owner_id: owner.id,
-      resource_owner_type: owner.class.name,
-    )
-
-    expect do
-      subject.authorize
-    end.to change { Doorkeeper::AccessToken.count }.by(1)
-  end
-
-  it "skips token creation if there is already one reusable" do
-    allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-    FactoryBot.create(
-      :access_token,
-      application_id: client.id,
-      resource_owner_id: owner.id,
-      resource_owner_type: owner.class.name,
-    )
-
-    expect do
-      subject.authorize
-    end.not_to(change { Doorkeeper::AccessToken.count })
-  end
-
-  it "creates token when there is already one but non reusable" do
-    allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-    FactoryBot.create(
-      :access_token,
-      application_id: client.id,
-      resource_owner_id: owner.id,
-      resource_owner_type: owner.class.name,
-    )
-    allow_any_instance_of(Doorkeeper::AccessToken).to receive(:reusable?).and_return(false)
-
-    expect do
-      subject.authorize
-    end.to change { Doorkeeper::AccessToken.count }.by(1)
-  end
-
-  it "calls configured request callback methods" do
-    expect(Doorkeeper.configuration.before_successful_strategy_response)
-      .to receive(:call).with(subject).once
-
-    expect(Doorkeeper.configuration.after_successful_strategy_response)
-      .to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
-
-    subject.authorize
-  end
-
-  describe "with scopes" do
-    subject do
-      described_class.new(server, client, owner, scope: "public")
-    end
-
-    context "when scopes_by_grant_type is not configured for grant_type" do
-      it "returns error when scopes are invalid" do
-        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("another"))
-        subject.validate
-        expect(subject.error).to eq(:invalid_scope)
-      end
-
-      it "creates the token with scopes if scopes are valid" do
-        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
-        expect do
-          subject.authorize
-        end.to change { Doorkeeper::AccessToken.count }.by(1)
-
-        expect(Doorkeeper::AccessToken.last.scopes).to include("public")
-      end
-    end
-
-    context "when scopes_by_grant_type is configured for grant_type" do
-      it "returns error when scopes are valid but not permitted for grant_type" do
-        allow(server)
-          .to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
-        allow(Doorkeeper.configuration)
-          .to receive(:scopes_by_grant_type).and_return(password: "another")
-        subject.validate
-        expect(subject.error).to eq(:invalid_scope)
-      end
-
-      it "creates the token with scopes if scopes are valid and permitted for grant_type" do
-        allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
-        allow(Doorkeeper.configuration)
-          .to receive(:scopes_by_grant_type).and_return(password: [:public])
-
-        expect do
-          subject.authorize
-        end.to change { Doorkeeper::AccessToken.count }.by(1)
-
-        expect(Doorkeeper::AccessToken.last.scopes).to include("public")
-      end
-    end
-  end
-
-  describe "with custom expiry" do
-    let(:server) do
-      double(
-        :server,
-        default_scopes: Doorkeeper::OAuth::Scopes.new,
-        access_token_expires_in: 2.hours,
-        refresh_token_enabled?: false,
-        custom_access_token_expires_in: lambda { |context|
-          if context.scopes.exists?("public")
-            222
-          elsif context.scopes.exists?("magic")
-            Float::INFINITY
-          end
-        },
-      )
-    end
-
-    before do
-      allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
-    end
-
-    it "checks scopes" do
-      subject = described_class.new(server, client, owner, scope: "public")
-      allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public"))
-
-      expect do
-        subject.authorize
-      end.to change { Doorkeeper::AccessToken.count }.by(1)
-
-      expect(Doorkeeper::AccessToken.last.expires_in).to eq(222)
-    end
-
-    it "falls back to the default otherwise" do
-      subject = described_class.new(server, client, owner, scope: "private")
-      allow(server).to receive(:scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("private"))
-
-      expect do
-        subject.authorize
-      end.to change { Doorkeeper::AccessToken.count }.by(1)
-
-      expect(Doorkeeper::AccessToken.last.expires_in).to eq(2.hours)
-    end
-  end
-end

data/spec/lib/oauth/pre_authorization_spec.rb

@@ -1,218 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe Doorkeeper::OAuth::PreAuthorization do
-  let(:server) do
-    server = Doorkeeper.configuration
-    allow(server).to receive(:default_scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("default"))
-    allow(server).to receive(:optional_scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("public profile"))
-    server
-  end
-
-  let(:application) { FactoryBot.create(:application, redirect_uri: "https://app.com/callback") }
-  let(:client) { Doorkeeper::OAuth::Client.find(application.uid) }
-
-  let :attributes do
-    {
-      client_id: client.uid,
-      response_type: "code",
-      redirect_uri: "https://app.com/callback",
-      state: "save-this",
-      current_resource_owner: Object.new,
-    }
-  end
-
-  subject do
-    described_class.new(server, attributes)
-  end
-
-  it "is authorizable when request is valid" do
-    expect(subject).to be_authorizable
-  end
-
-  it "accepts code as response type" do
-    attributes[:response_type] = "code"
-    expect(subject).to be_authorizable
-  end
-
-  it "accepts token as response type" do
-    allow(server).to receive(:grant_flows).and_return(["implicit"])
-    attributes[:response_type] = "token"
-    expect(subject).to be_authorizable
-  end
-
-  context "when using default grant flows" do
-    it 'accepts "code" as response type' do
-      attributes[:response_type] = "code"
-      expect(subject).to be_authorizable
-    end
-
-    it 'accepts "token" as response type' do
-      allow(server).to receive(:grant_flows).and_return(["implicit"])
-      attributes[:response_type] = "token"
-      expect(subject).to be_authorizable
-    end
-  end
-
-  context "when authorization code grant flow is disabled" do
-    before do
-      allow(server).to receive(:grant_flows).and_return(["implicit"])
-    end
-
-    it 'does not accept "code" as response type' do
-      attributes[:response_type] = "code"
-      expect(subject).not_to be_authorizable
-    end
-  end
-
-  context "when implicit grant flow is disabled" do
-    before do
-      allow(server).to receive(:grant_flows).and_return(["authorization_code"])
-    end
-
-    it 'does not accept "token" as response type' do
-      attributes[:response_type] = "token"
-      expect(subject).not_to be_authorizable
-    end
-  end
-
-  context "client application does not restrict valid scopes" do
-    it "accepts valid scopes" do
-      attributes[:scope] = "public"
-      expect(subject).to be_authorizable
-    end
-
-    it "rejects (globally) non-valid scopes" do
-      attributes[:scope] = "invalid"
-      expect(subject).not_to be_authorizable
-    end
-
-    it "accepts scopes which are permitted for grant_type" do
-      allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:public])
-      attributes[:scope] = "public"
-      expect(subject).to be_authorizable
-    end
-
-    it "rejects scopes which are not permitted for grant_type" do
-      allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:profile])
-      attributes[:scope] = "public"
-      expect(subject).not_to be_authorizable
-    end
-  end
-
-  context "client application restricts valid scopes" do
-    let(:application) do
-      FactoryBot.create(:application, scopes: Doorkeeper::OAuth::Scopes.from_string("public nonsense"))
-    end
-
-    it "accepts valid scopes" do
-      attributes[:scope] = "public"
-      expect(subject).to be_authorizable
-    end
-
-    it "rejects (globally) non-valid scopes" do
-      attributes[:scope] = "invalid"
-      expect(subject).not_to be_authorizable
-    end
-
-    it "rejects (application level) non-valid scopes" do
-      attributes[:scope] = "profile"
-      expect(subject).to_not be_authorizable
-    end
-
-    it "accepts scopes which are permitted for grant_type" do
-      allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:public])
-      attributes[:scope] = "public"
-      expect(subject).to be_authorizable
-    end
-
-    it "rejects scopes which are not permitted for grant_type" do
-      allow(server).to receive(:scopes_by_grant_type).and_return(authorization_code: [:profile])
-      attributes[:scope] = "public"
-      expect(subject).not_to be_authorizable
-    end
-  end
-
-  context "when scope is not provided to pre_authorization" do
-    before { attributes[:scope] = nil }
-
-    context "when default scopes is provided" do
-      it "uses default scopes" do
-        allow(server).to receive(:default_scopes).and_return(Doorkeeper::OAuth::Scopes.from_string("default_scope"))
-        expect(subject).to be_authorizable
-        expect(subject.scope).to eq("default_scope")
-        expect(subject.scopes).to eq(Doorkeeper::OAuth::Scopes.from_string("default_scope"))
-      end
-    end
-
-    context "when default scopes is none" do
-      it "not be authorizable when none default scope" do
-        allow(server).to receive(:default_scopes).and_return(Doorkeeper::OAuth::Scopes.new)
-        expect(subject).not_to be_authorizable
-      end
-    end
-  end
-
-  it "matches the redirect uri against client's one" do
-    attributes[:redirect_uri] = "http://nothesame.com"
-    expect(subject).not_to be_authorizable
-  end
-
-  it "stores the state" do
-    expect(subject.state).to eq("save-this")
-  end
-
-  it "rejects if response type is not allowed" do
-    attributes[:response_type] = "whops"
-    expect(subject).not_to be_authorizable
-  end
-
-  it "requires an existing client" do
-    attributes[:client_id] = nil
-    expect(subject).not_to be_authorizable
-  end
-
-  it "requires a redirect uri" do
-    attributes[:redirect_uri] = nil
-    expect(subject).not_to be_authorizable
-  end
-
-  context "when resource_owner cannot access client application" do
-    before { allow(Doorkeeper.configuration).to receive(:authorize_resource_owner_for_client).and_return(->(*_) { false }) }
-
-    it "is not authorizable" do
-      expect(subject).not_to be_authorizable
-    end
-  end
-
-  describe "as_json" do
-    before { subject.authorizable? }
-
-    it { is_expected.to respond_to :as_json }
-
-    shared_examples "returns the pre authorization" do
-      it "returns the pre authorization" do
-        expect(json[:client_id]).to eq client.uid
-        expect(json[:redirect_uri]).to eq subject.redirect_uri
-        expect(json[:state]).to eq subject.state
-        expect(json[:response_type]).to eq subject.response_type
-        expect(json[:scope]).to eq subject.scope
-        expect(json[:client_name]).to eq client.name
-        expect(json[:status]).to eq I18n.t("doorkeeper.pre_authorization.status")
-      end
-    end
-
-    context "when called without params" do
-      let(:json) { subject.as_json }
-
-      include_examples "returns the pre authorization"
-    end
-
-    context "when called with params" do
-      let(:json) { subject.as_json(foo: "bar") }
-
-      include_examples "returns the pre authorization"
-    end
-  end
-end