doorkeeper 5.4.0.rc1 → 5.5.0

data/spec/lib/secret_storing/plain_spec.rb

@@ -1,44 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe ::Doorkeeper::SecretStoring::Plain do
-  subject { described_class }
-  let(:instance) { double("instance", token: "foo") }
-
-  describe "#transform_secret" do
-    it "raises" do
-      expect(subject.transform_secret("foo")).to eq "foo"
-    end
-  end
-
-  describe "#restore_secret" do
-    it "raises" do
-      expect(subject.restore_secret(instance, :token)).to eq "foo"
-    end
-  end
-
-  describe "#allows_restoring_secrets?" do
-    it "does allow it" do
-      expect(subject.allows_restoring_secrets?).to eq true
-    end
-  end
-
-  describe "validate_for" do
-    it "allows for valid model" do
-      expect(subject.validate_for(:application)).to eq true
-      expect(subject.validate_for(:token)).to eq true
-    end
-
-    it "raises for invalid model" do
-      expect { subject.validate_for(:wat) }.to raise_error(ArgumentError, /can not be used for wat/)
-    end
-  end
-
-  describe "secret_matches?" do
-    it "compares input with #transform_secret" do
-      expect(subject.secret_matches?("input", "input")).to eq true
-      expect(subject.secret_matches?("a", "b")).to eq false
-    end
-  end
-end

data/spec/lib/secret_storing/sha256_hash_spec.rb

@@ -1,48 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe ::Doorkeeper::SecretStoring::Sha256Hash do
-  subject { described_class }
-  let(:instance) { double("instance") }
-
-  let(:hash_function) do
-    ->(input) { ::Digest::SHA256.hexdigest(input) }
-  end
-
-  describe "#transform_secret" do
-    it "raises" do
-      expect(subject.transform_secret("foo")).to eq hash_function.call("foo")
-    end
-  end
-
-  describe "#restore_secret" do
-    it "raises" do
-      expect { subject.restore_secret(instance, :token) }.to raise_error(NotImplementedError)
-    end
-  end
-
-  describe "#allows_restoring_secrets?" do
-    it "does not allow it" do
-      expect(subject.allows_restoring_secrets?).to eq false
-    end
-  end
-
-  describe "validate_for" do
-    it "allows for valid model" do
-      expect(subject.validate_for(:application)).to eq true
-      expect(subject.validate_for(:token)).to eq true
-    end
-
-    it "raises for invalid model" do
-      expect { subject.validate_for(:wat) }.to raise_error(ArgumentError, /can not be used for wat/)
-    end
-  end
-
-  describe "secret_matches?" do
-    it "compares input with #transform_secret" do
-      expect(subject.secret_matches?("input", "input")).to eq false
-      expect(subject.secret_matches?("a", hash_function.call("a"))).to eq true
-    end
-  end
-end

data/spec/lib/server_spec.rb

@@ -1,49 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe Doorkeeper::Server do
-  let(:fake_class) { double :fake_class }
-
-  subject do
-    described_class.new
-  end
-
-  describe ".authorization_request" do
-    it "raises error when strategy does not match phase" do
-      expect do
-        subject.token_request(:code)
-      end.to raise_error(Doorkeeper::Errors::InvalidTokenStrategy)
-    end
-
-    context "when only Authorization Code strategy is enabled" do
-      before do
-        allow(Doorkeeper.configuration)
-          .to receive(:grant_flows)
-          .and_return(["authorization_code"])
-      end
-
-      it "raises error when using the disabled Client Credentials strategy" do
-        expect do
-          subject.token_request(:client_credentials)
-        end.to raise_error(Doorkeeper::Errors::InvalidTokenStrategy)
-      end
-    end
-
-    it "builds the request with selected strategy" do
-      stub_const "Doorkeeper::Request::Code", fake_class
-      expect(fake_class).to receive(:new).with(subject)
-      subject.authorization_request :code
-    end
-
-    it "builds the request with composite strategy name" do
-      allow(Doorkeeper.configuration)
-        .to receive(:authorization_response_types)
-        .and_return(["id_token token"])
-
-      stub_const "Doorkeeper::Request::IdTokenToken", fake_class
-      expect(fake_class).to receive(:new).with(subject)
-      subject.authorization_request "id_token token"
-    end
-  end
-end

data/spec/lib/stale_records_cleaner_spec.rb

@@ -1,102 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe Doorkeeper::StaleRecordsCleaner do
-  let(:cleaner) { described_class.new(model) }
-  let(:models_by_name) do
-    {
-      access_token: Doorkeeper::AccessToken,
-      access_grant: Doorkeeper::AccessGrant,
-    }
-  end
-  let(:resource_owner) { FactoryBot.create(:resource_owner) }
-
-  context "when ORM has no cleaner class" do
-    it "raises an error" do
-      allow_any_instance_of(Doorkeeper::Config).to receive(:orm).and_return("hibernate")
-
-      expect do
-        described_class.for(Doorkeeper::AccessToken)
-      end.to raise_error(Doorkeeper::Errors::NoOrmCleaner, /has no cleaner/)
-    end
-  end
-
-  %i[access_token access_grant].each do |model_name|
-    context "(#{model_name})" do
-      let(:model) { models_by_name.fetch(model_name) }
-
-      describe "#clean_revoked" do
-        subject { cleaner.clean_revoked }
-
-        context "with revoked record" do
-          before do
-            FactoryBot.create model_name,
-                              revoked_at: Time.current - 1.minute,
-                              resource_owner_id: resource_owner.id,
-                              resource_owner_type: resource_owner.class.name
-          end
-
-          it "removes the record" do
-            expect { subject }.to change { model.count }.to(0)
-          end
-        end
-
-        context "with record revoked in the future" do
-          before do
-            FactoryBot.create model_name, revoked_at: Time.current + 1.minute,
-                                          resource_owner_id: resource_owner.id,
-                                          resource_owner_type: resource_owner.class.name
-          end
-
-          it "keeps the record" do
-            expect { subject }.not_to(change { model.count })
-          end
-        end
-
-        context "with unrevoked record" do
-          before do
-            FactoryBot.create model_name, revoked_at: nil,
-                                          resource_owner_id: resource_owner.id,
-                                          resource_owner_type: resource_owner.class.name
-          end
-
-          it "keeps the record" do
-            expect { subject }.not_to(change { model.count })
-          end
-        end
-      end
-
-      describe "#clean_expired" do
-        subject { cleaner.clean_expired(ttl) }
-        let(:ttl) { 500 }
-        let(:expiry_border) { ttl.seconds.ago }
-
-        context "with record that is expired" do
-          before do
-            FactoryBot.create model_name,
-                              created_at: expiry_border - 1.minute,
-                              resource_owner_id: resource_owner.id,
-                              resource_owner_type: resource_owner.class.name
-          end
-
-          it "removes the record" do
-            expect { subject }.to change { model.count }.to(0)
-          end
-        end
-
-        context "with record that is not expired" do
-          before do
-            FactoryBot.create model_name, created_at: expiry_border + 1.minute,
-                                          resource_owner_id: resource_owner.id,
-                                          resource_owner_type: resource_owner.class.name
-          end
-
-          it "keeps the record" do
-            expect { subject }.not_to(change { model.count })
-          end
-        end
-      end
-    end
-  end
-end

data/spec/models/doorkeeper/access_grant_spec.rb

@@ -1,175 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-describe Doorkeeper::AccessGrant do
-  let(:resource_owner) { FactoryBot.create(:resource_owner) }
-  let(:client) { FactoryBot.build_stubbed(:application) }
-  let(:clazz) { Doorkeeper::AccessGrant }
-
-  subject do
-    FactoryBot.build(
-      :access_grant,
-      application: client,
-      resource_owner_id: resource_owner.id,
-      resource_owner_type: resource_owner.class.name,
-    )
-  end
-
-  it { expect(subject).to be_valid }
-
-  it_behaves_like "an accessible token"
-  it_behaves_like "a revocable token"
-  it_behaves_like "a unique token" do
-    let(:factory_name) { :access_grant }
-  end
-
-  context "with hashing enabled" do
-    let(:resource_owner) { FactoryBot.create(:resource_owner) }
-    let(:grant) do
-      FactoryBot.create :access_grant,
-                        resource_owner_id: resource_owner.id,
-                        resource_owner_type: resource_owner.class.name
-    end
-    include_context "with token hashing enabled"
-
-    it "holds a volatile plaintext token when created" do
-      expect(grant.plaintext_token).to be_a(String)
-      expect(grant.token)
-        .to eq(hashed_or_plain_token_func.call(grant.plaintext_token))
-
-      # Finder method only finds the hashed token
-      loaded = clazz.find_by(token: grant.token)
-      expect(loaded).to eq(grant)
-      expect(loaded.plaintext_token).to be_nil
-      expect(loaded.token).to eq(grant.token)
-    end
-
-    it "does not find_by plain text tokens" do
-      expect(clazz.find_by(token: grant.plaintext_token)).to be_nil
-    end
-
-    describe "with having a plain text token" do
-      let(:plain_text_token) { "plain text token" }
-
-      before do
-        # Assume we have a plain text token from before activating the option
-        grant.update_column(:token, plain_text_token)
-      end
-
-      context "without fallback lookup" do
-        it "does not provide lookups with either through by_token" do
-          expect(clazz.by_token(plain_text_token)).to eq(nil)
-          expect(clazz.by_token(grant.token)).to eq(nil)
-
-          # And it does not touch the token
-          grant.reload
-          expect(grant.token).to eq(plain_text_token)
-        end
-      end
-
-      context "with fallback lookup" do
-        include_context "with token hashing and fallback lookup enabled"
-
-        it "upgrades a plain token when falling back to it" do
-          # Side-effect: This will automatically upgrade the token
-          expect(clazz).to receive(:upgrade_fallback_value).and_call_original
-          expect(clazz.by_token(plain_text_token))
-            .to have_attributes(
-              resource_owner_id: grant.resource_owner_id,
-              application_id: grant.application_id,
-              redirect_uri: grant.redirect_uri,
-              expires_in: grant.expires_in,
-              scopes: grant.scopes,
-            )
-
-          # Will find subsequently by hashing the token
-          expect(clazz.by_token(plain_text_token))
-            .to have_attributes(
-              resource_owner_id: grant.resource_owner_id,
-              application_id: grant.application_id,
-              redirect_uri: grant.redirect_uri,
-              expires_in: grant.expires_in,
-              scopes: grant.scopes,
-            )
-
-          # Not all the ORM support :id PK
-          expect(clazz.by_token(plain_text_token).id).to eq(grant.id) if grant.respond_to?(:id)
-
-          # And it modifies the token value
-          grant.reload
-          expect(grant.token).not_to eq(plain_text_token)
-          expect(clazz.find_by(token: plain_text_token)).to eq(nil)
-          expect(clazz.find_by(token: grant.token)).not_to be_nil
-        end
-      end
-    end
-  end
-
-  describe "validations" do
-    it "is invalid without resource_owner_id" do
-      subject.resource_owner_id = nil
-      expect(subject).not_to be_valid
-    end
-
-    it "is invalid without application_id" do
-      subject.application_id = nil
-      expect(subject).not_to be_valid
-    end
-
-    it "is invalid without token" do
-      subject.save
-      subject.token = nil
-      expect(subject).not_to be_valid
-    end
-
-    it "is invalid without expires_in" do
-      subject.expires_in = nil
-      expect(subject).not_to be_valid
-    end
-  end
-
-  describe ".revoke_all_for" do
-    let(:application) { FactoryBot.create :application }
-    let(:default_attributes) do
-      {
-        application: application,
-        resource_owner_id: resource_owner.id,
-        resource_owner_type: resource_owner.class.name,
-      }
-    end
-
-    it "revokes all tokens for given application and resource owner" do
-      FactoryBot.create :access_grant, default_attributes
-
-      described_class.revoke_all_for(application.id, resource_owner)
-
-      described_class.all.each do |token|
-        expect(token).to be_revoked
-      end
-    end
-
-    it "matches application" do
-      access_grant_for_different_app = FactoryBot.create(
-        :access_grant,
-        default_attributes.merge(application: FactoryBot.create(:application)),
-      )
-
-      described_class.revoke_all_for(application.id, resource_owner)
-
-      expect(access_grant_for_different_app.reload).not_to be_revoked
-    end
-
-    it "matches resource owner" do
-      other_resource_owner = FactoryBot.create(:resource_owner)
-      access_grant_for_different_owner = FactoryBot.create(
-        :access_grant,
-        default_attributes.merge(resource_owner_id: other_resource_owner.id),
-      )
-
-      described_class.revoke_all_for application.id, resource_owner
-
-      expect(access_grant_for_different_owner.reload).not_to be_revoked
-    end
-  end
-end

data/spec/models/doorkeeper/access_token_spec.rb

@@ -1,650 +0,0 @@
-# frozen_string_literal: true
-
-require "spec_helper"
-
-RSpec.describe Doorkeeper::AccessToken do
-  subject { FactoryBot.build(:access_token) }
-
-  it { expect(subject).to be_valid }
-
-  it_behaves_like "an accessible token"
-  it_behaves_like "a revocable token"
-  it_behaves_like "a unique token" do
-    let(:factory_name) { :access_token }
-  end
-
-  module CustomGeneratorArgs
-    def self.generate; end
-  end
-
-  describe "#generate_token" do
-    it "generates a token using the default method" do
-      FactoryBot.create :access_token
-
-      token = FactoryBot.create :access_token
-      expect(token.token).to be_a(String)
-    end
-
-    context "with hashing enabled" do
-      let(:token) { FactoryBot.create :access_token }
-      include_context "with token hashing enabled"
-
-      it "holds a volatile plaintext token when created" do
-        expect(token.plaintext_token).to be_a(String)
-        expect(token.token)
-          .to eq(hashed_or_plain_token_func.call(token.plaintext_token))
-
-        # Finder method only finds the hashed token
-        loaded = described_class.find_by(token: token.token)
-        expect(loaded).to eq(token)
-        expect(loaded.plaintext_token).to be_nil
-        expect(loaded.token).to eq(token.token)
-      end
-
-      it "does not find_by plain text tokens" do
-        expect(described_class.find_by(token: token.plaintext_token)).to be_nil
-      end
-
-      describe "with having a plain text token" do
-        let(:plain_text_token) { "plain text token" }
-        let(:access_token) { FactoryBot.create :access_token }
-
-        before do
-          # Assume we have a plain text token from before activating the option
-          access_token.update_column(:token, plain_text_token)
-        end
-
-        context "without fallback lookup" do
-          it "does not provide lookups with either through by_token" do
-            expect(described_class.by_token(plain_text_token)).to eq(nil)
-            expect(described_class.by_token(access_token.token)).to eq(nil)
-
-            # And it does not touch the token
-            access_token.reload
-            expect(access_token.token).to eq(plain_text_token)
-          end
-        end
-
-        context "with fallback lookup" do
-          include_context "with token hashing and fallback lookup enabled"
-
-          it "upgrades a plain token when falling back to it" do
-            # Side-effect: This will automatically upgrade the token
-            expect(described_class).to receive(:upgrade_fallback_value).and_call_original
-            expect(described_class.by_token(plain_text_token))
-              .to have_attributes(
-                resource_owner_id: access_token.resource_owner_id,
-                application_id: access_token.application_id,
-                scopes: access_token.scopes,
-              )
-
-            # Will find subsequently by hashing the token
-            expect(described_class.by_token(plain_text_token))
-              .to have_attributes(
-                resource_owner_id: access_token.resource_owner_id,
-                application_id: access_token.application_id,
-                scopes: access_token.scopes,
-              )
-
-            # Not all the ORM support :id PK
-            if access_token.respond_to?(:id)
-              expect(described_class.by_token(plain_text_token).id).to eq(access_token.id)
-            end
-
-            # And it modifies the token value
-            access_token.reload
-            expect(access_token.token).not_to eq(plain_text_token)
-            expect(described_class.find_by(token: plain_text_token)).to eq(nil)
-            expect(described_class.find_by(token: access_token.token)).not_to be_nil
-          end
-        end
-      end
-    end
-
-    it "generates a token using a custom object" do
-      eigenclass = class << CustomGeneratorArgs; self; end
-      eigenclass.class_eval do
-        remove_method :generate
-      end
-      module CustomGeneratorArgs
-        def self.generate(opts = {})
-          id = opts[:resource_owner_id] || opts[:resource_owner]&.id
-          "custom_generator_token_#{id}"
-        end
-      end
-
-      Doorkeeper.configure do
-        orm DOORKEEPER_ORM
-        access_token_generator "CustomGeneratorArgs"
-      end
-
-      owner = FactoryBot.create :resource_owner
-      token = FactoryBot.create :access_token,
-                                resource_owner_id: owner.id,
-                                resource_owner_type: owner.class.name
-
-      expect(token.token).to match(/custom_generator_token_\d+/)
-    end
-
-    it "allows the custom generator to access the application details" do
-      eigenclass = class << CustomGeneratorArgs; self; end
-      eigenclass.class_eval do
-        remove_method :generate
-      end
-
-      module CustomGeneratorArgs
-        def self.generate(opts = {})
-          "custom_generator_token_#{opts[:application].name}"
-        end
-      end
-
-      Doorkeeper.configure do
-        orm DOORKEEPER_ORM
-        access_token_generator "CustomGeneratorArgs"
-      end
-
-      token = FactoryBot.create :access_token
-      expect(token.token).to match(/custom_generator_token_Application \d+/)
-    end
-
-    it "allows the custom generator to access the scopes" do
-      eigenclass = class << CustomGeneratorArgs; self; end
-      eigenclass.class_eval do
-        remove_method :generate
-      end
-      module CustomGeneratorArgs
-        def self.generate(opts = {})
-          "custom_generator_token_#{opts[:scopes].count}_#{opts[:scopes]}"
-        end
-      end
-
-      Doorkeeper.configure do
-        orm DOORKEEPER_ORM
-        access_token_generator "CustomGeneratorArgs"
-      end
-
-      token = FactoryBot.create :access_token, scopes: "public write"
-
-      expect(token.token).to eq "custom_generator_token_2_public write"
-    end
-
-    it "allows the custom generator to access the expiry length" do
-      eigenclass = class << CustomGeneratorArgs; self; end
-      eigenclass.class_eval do
-        remove_method :generate
-      end
-      module CustomGeneratorArgs
-        def self.generate(opts = {})
-          "custom_generator_token_#{opts[:expires_in]}"
-        end
-      end
-
-      Doorkeeper.configure do
-        orm DOORKEEPER_ORM
-        access_token_generator "CustomGeneratorArgs"
-      end
-
-      token = FactoryBot.create :access_token
-      expect(token.token).to eq "custom_generator_token_7200"
-    end
-
-    it "allows the custom generator to access the created time" do
-      module CustomGeneratorArgs
-        def self.generate(opts = {})
-          "custom_generator_token_#{opts[:created_at].to_i}"
-        end
-      end
-
-      Doorkeeper.configure do
-        orm DOORKEEPER_ORM
-        access_token_generator "CustomGeneratorArgs"
-      end
-
-      token = FactoryBot.create :access_token
-      created_at = token.created_at
-      expect(token.token).to eq "custom_generator_token_#{created_at.to_i}"
-    end
-
-    it "raises an error if the custom object does not support generate" do
-      module NoGenerate
-      end
-
-      Doorkeeper.configure do
-        orm DOORKEEPER_ORM
-        access_token_generator "NoGenerate"
-      end
-
-      expect { FactoryBot.create :access_token }.to(
-        raise_error(Doorkeeper::Errors::UnableToGenerateToken),
-      )
-    end
-
-    it "raises original error if something went wrong in custom generator" do
-      eigenclass = class << CustomGeneratorArgs; self; end
-      eigenclass.class_eval do
-        remove_method :generate
-      end
-
-      module CustomGeneratorArgs
-        def self.generate(_opts = {})
-          raise LoadError, "custom behaviour"
-        end
-      end
-
-      Doorkeeper.configure do
-        orm DOORKEEPER_ORM
-        access_token_generator "CustomGeneratorArgs"
-      end
-
-      expect { FactoryBot.create :access_token }.to(
-        raise_error(LoadError),
-      )
-    end
-
-    it "raises an error if the custom object does not exist" do
-      Doorkeeper.configure do
-        orm DOORKEEPER_ORM
-        access_token_generator "Doorkeeper::NotReal"
-      end
-
-      expect { FactoryBot.create :access_token }.to(
-        raise_error(Doorkeeper::Errors::TokenGeneratorNotFound, /NotReal/),
-      )
-    end
-  end
-
-  describe "refresh_token" do
-    it "has empty refresh token if it was not required" do
-      token = FactoryBot.create :access_token
-      expect(token.refresh_token).to be_nil
-    end
-
-    it "generates a refresh token if it was requested" do
-      token = FactoryBot.create :access_token, use_refresh_token: true
-      expect(token.refresh_token).not_to be_nil
-    end
-
-    it "is not valid if token exists" do
-      token1 = FactoryBot.create :access_token, use_refresh_token: true
-      token2 = FactoryBot.create :access_token, use_refresh_token: true
-      token2.refresh_token = token1.refresh_token
-      expect(token2).not_to be_valid
-    end
-
-    it "expects database to raise an error if refresh tokens are the same" do
-      token1 = FactoryBot.create :access_token, use_refresh_token: true
-      token2 = FactoryBot.create :access_token, use_refresh_token: true
-      expect do
-        token2.refresh_token = token1.refresh_token
-        token2.save(validate: false)
-      end.to raise_error(uniqueness_error)
-    end
-
-    context "with hashing enabled" do
-      include_context "with token hashing enabled"
-      let(:token) { FactoryBot.create :access_token, use_refresh_token: true }
-
-      it "holds a volatile refresh token when created" do
-        expect(token.plaintext_refresh_token).to be_a(String)
-        expect(token.refresh_token)
-          .to eq(hashed_or_plain_token_func.call(token.plaintext_refresh_token))
-
-        # Finder method only finds the hashed token
-        loaded = described_class.find_by(refresh_token: token.refresh_token)
-        expect(loaded).to eq(token)
-        expect(loaded.plaintext_refresh_token).to be_nil
-        expect(loaded.refresh_token).to eq(token.refresh_token)
-      end
-
-      it "does not find_by plain text refresh tokens" do
-        expect(described_class.find_by(refresh_token: token.plaintext_refresh_token)).to be_nil
-      end
-
-      describe "with having a plain text token" do
-        let(:plain_refresh_token) { "plain refresh token" }
-        let(:access_token) { FactoryBot.create :access_token }
-
-        before do
-          # Assume we have a plain text token from before activating the option
-          access_token.update_column(:refresh_token, plain_refresh_token)
-        end
-
-        context "without fallback lookup" do
-          it "does not provide lookups with either through by_token" do
-            expect(described_class.by_refresh_token(plain_refresh_token)).to eq(nil)
-            expect(described_class.by_refresh_token(access_token.refresh_token)).to eq(nil)
-
-            # And it does not touch the token
-            access_token.reload
-            expect(access_token.refresh_token).to eq(plain_refresh_token)
-          end
-        end
-
-        context "with fallback lookup" do
-          include_context "with token hashing and fallback lookup enabled"
-
-          it "upgrades a plain token when falling back to it" do
-            # Side-effect: This will automatically upgrade the token
-            expect(described_class).to receive(:upgrade_fallback_value).and_call_original
-            expect(described_class.by_refresh_token(plain_refresh_token))
-              .to have_attributes(
-                token: access_token.token,
-                resource_owner_id: access_token.resource_owner_id,
-                application_id: access_token.application_id,
-              )
-
-            # Will find subsequently by hashing the token
-            expect(described_class.by_refresh_token(plain_refresh_token))
-              .to have_attributes(
-                token: access_token.token,
-                resource_owner_id: access_token.resource_owner_id,
-                application_id: access_token.application_id,
-              )
-
-            # Not all the ORM support :id PK
-            if access_token.respond_to?(:id)
-              expect(described_class.by_refresh_token(plain_refresh_token).id).to eq(access_token.id)
-            end
-
-            # And it modifies the token value
-            access_token.reload
-            expect(access_token.refresh_token).not_to eq(plain_refresh_token)
-            expect(described_class.find_by(refresh_token: plain_refresh_token)).to eq(nil)
-            expect(described_class.find_by(refresh_token: access_token.refresh_token)).not_to be_nil
-          end
-        end
-      end
-    end
-  end
-
-  describe "validations" do
-    it "is valid without resource_owner_id" do
-      # For client credentials flow
-      subject.resource_owner_id = nil
-      expect(subject).to be_valid
-    end
-
-    it "is valid without application_id" do
-      # For resource owner credentials flow
-      subject.application_id = nil
-      expect(subject).to be_valid
-    end
-  end
-
-  describe "#same_credential?" do
-    context "with default parameters" do
-      let(:resource_owner) { FactoryBot.create(:resource_owner) }
-      let(:resource_owner_id) { resource_owner.id }
-      let(:application) { FactoryBot.create :application }
-      let(:default_attributes) do
-        {
-          application: application,
-          resource_owner_id: resource_owner_id,
-          resource_owner_type: resource_owner.class.name,
-        }
-      end
-      let(:access_token1) { FactoryBot.create :access_token, default_attributes }
-
-      context "the second token has the same owner and same app" do
-        let(:access_token2) { FactoryBot.create :access_token, default_attributes }
-        it "success" do
-          expect(access_token1.same_credential?(access_token2)).to be_truthy
-        end
-      end
-
-      context "the second token has same owner and different app" do
-        let(:other_application) { FactoryBot.create :application }
-        let(:access_token2) do
-          FactoryBot.create :access_token,
-                            application: other_application,
-                            resource_owner_id: resource_owner_id,
-                            resource_owner_type: resource_owner.class.name
-        end
-
-        it "fail" do
-          expect(access_token1.same_credential?(access_token2)).to be_falsey
-        end
-      end
-
-      context "the second token has different owner and different app" do
-        let(:other_application) { FactoryBot.create :application }
-        let(:access_token2) do
-          FactoryBot.create :access_token,
-                            application: other_application,
-                            resource_owner_id: resource_owner.id + 1
-        end
-
-        it "fail" do
-          expect(access_token1.same_credential?(access_token2)).to be_falsey
-        end
-      end
-
-      context "the second token has different owner and same app" do
-        let(:access_token2) do
-          FactoryBot.create :access_token,
-                            application: application,
-                            resource_owner_id: resource_owner.id + 1
-        end
-
-        it "fail" do
-          expect(access_token1.same_credential?(access_token2)).to be_falsey
-        end
-      end
-    end
-  end
-
-  describe "#acceptable?" do
-    context "a token that is not accessible" do
-      let(:token) { FactoryBot.create(:access_token, created_at: 6.hours.ago) }
-
-      it "should return false" do
-        expect(token.acceptable?(nil)).to be false
-      end
-    end
-
-    context "a token that has the incorrect scopes" do
-      let(:token) { FactoryBot.create(:access_token) }
-
-      it "should return false" do
-        expect(token.acceptable?(["public"])).to be false
-      end
-    end
-
-    context "a token is acceptable with the correct scopes" do
-      let(:token) do
-        token = FactoryBot.create(:access_token)
-        token[:scopes] = "public"
-        token
-      end
-
-      it "should return true" do
-        expect(token.acceptable?(["public"])).to be true
-      end
-    end
-  end
-
-  describe ".revoke_all_for" do
-    let(:resource_owner) { FactoryBot.create :resource_owner }
-    let(:application)    { FactoryBot.create :application }
-    let(:default_attributes) do
-      {
-        application: application,
-        resource_owner_id: resource_owner.id,
-        resource_owner_type: resource_owner.class.name,
-      }
-    end
-
-    it "revokes all tokens for given application and resource owner" do
-      FactoryBot.create :access_token, default_attributes
-      described_class.revoke_all_for application.id, resource_owner
-      described_class.all.each do |token|
-        expect(token).to be_revoked
-      end
-    end
-
-    it "matches application" do
-      access_token_for_different_app = FactoryBot.create(
-        :access_token,
-        default_attributes.merge(application: FactoryBot.create(:application)),
-      )
-
-      described_class.revoke_all_for application.id, resource_owner
-
-      expect(access_token_for_different_app.reload).not_to be_revoked
-    end
-
-    it "matches resource owner" do
-      access_token_for_different_owner = FactoryBot.create(
-        :access_token,
-        default_attributes.merge(resource_owner_id: resource_owner.id + 1),
-      )
-
-      described_class.revoke_all_for application.id, resource_owner
-
-      expect(access_token_for_different_owner.reload).not_to be_revoked
-    end
-  end
-
-  describe ".matching_token_for" do
-    let(:resource_owner)    { FactoryBot.create :resource_owner }
-    let(:resource_owner_id) { resource_owner.id }
-    let(:application)       { FactoryBot.create :application }
-    let(:scopes) { Doorkeeper::OAuth::Scopes.from_string("public write") }
-    let(:default_attributes) do
-      {
-        application: application,
-        resource_owner_id: resource_owner_id,
-        resource_owner_type: resource_owner.class.name,
-        scopes: scopes.to_s,
-      }
-    end
-
-    before do
-      default_scopes_exist(*scopes.all)
-    end
-
-    it "returns only one token" do
-      token = FactoryBot.create :access_token, default_attributes
-      last_token = described_class.matching_token_for(application, resource_owner, scopes)
-      expect(last_token).to eq(token)
-    end
-
-    it "accepts resource owner as object" do
-      token = FactoryBot.create :access_token, default_attributes
-      last_token = described_class.matching_token_for(application, resource_owner, scopes)
-      expect(last_token).to eq(token)
-    end
-
-    it "accepts nil as resource owner" do
-      token = FactoryBot.create :access_token,
-                                default_attributes.merge(resource_owner_id: nil, resource_owner_type: nil)
-      last_token = described_class.matching_token_for(application, nil, scopes)
-      expect(last_token).to eq(token)
-    end
-
-    it "excludes revoked tokens" do
-      FactoryBot.create :access_token, default_attributes.merge(revoked_at: 1.day.ago)
-      last_token = described_class.matching_token_for(application, resource_owner_id, scopes)
-      expect(last_token).to be_nil
-    end
-
-    it "excludes tokens with a different application" do
-      FactoryBot.create :access_token, default_attributes.merge(application: FactoryBot.create(:application))
-      last_token = described_class.matching_token_for(application, resource_owner_id, scopes)
-      expect(last_token).to be_nil
-    end
-
-    it "excludes tokens with a different resource owner" do
-      FactoryBot.create :access_token, default_attributes.merge(resource_owner_id: resource_owner.id + 1)
-      last_token = described_class.matching_token_for(application, resource_owner_id, scopes)
-      expect(last_token).to be_nil
-    end
-
-    it "excludes tokens with fewer scopes" do
-      FactoryBot.create :access_token, default_attributes.merge(scopes: "public")
-      last_token = described_class.matching_token_for(application, resource_owner_id, scopes)
-      expect(last_token).to be_nil
-    end
-
-    it "excludes tokens with different scopes" do
-      FactoryBot.create :access_token, default_attributes.merge(scopes: "public email")
-      last_token = described_class.matching_token_for(application, resource_owner, scopes)
-      expect(last_token).to be_nil
-    end
-
-    it "excludes tokens with additional scopes" do
-      FactoryBot.create :access_token, default_attributes.merge(scopes: "public write email")
-      last_token = described_class.matching_token_for(application, resource_owner, scopes)
-      expect(last_token).to be_nil
-    end
-
-    it "excludes tokens with scopes that are not present in server scopes" do
-      FactoryBot.create :access_token, default_attributes.merge(
-        application: application, scopes: "public read",
-      )
-      last_token = described_class.matching_token_for(application, resource_owner, scopes)
-      expect(last_token).to be_nil
-    end
-
-    it "excludes tokens with scopes that are not present in application scopes" do
-      application = FactoryBot.create :application, scopes: "private read"
-      FactoryBot.create :access_token, default_attributes.merge(
-        application: application,
-      )
-      last_token = described_class.matching_token_for(application, resource_owner, scopes)
-      expect(last_token).to be_nil
-    end
-
-    it "does not match token if empty scope requested and token/app scopes present" do
-      application = FactoryBot.create :application, scopes: "sample:scope"
-      app_params = {
-        application_id: application.id, scopes: "sample:scope",
-        resource_owner_id: resource_owner.id,
-        resource_owner_type: resource_owner.class.name,
-      }
-      FactoryBot.create :access_token, app_params
-      empty_scopes = Doorkeeper::OAuth::Scopes.from_string("")
-      last_token = described_class.matching_token_for(application, resource_owner.id, empty_scopes)
-      expect(last_token).to be_nil
-    end
-
-    it "matches token if empty scope requested and no token scopes present" do
-      empty_scopes = Doorkeeper::OAuth::Scopes.from_string("")
-      token = FactoryBot.create :access_token, default_attributes.merge(scopes: empty_scopes)
-      last_token = described_class.matching_token_for(application, resource_owner.id, empty_scopes)
-      expect(last_token).to eq(token)
-    end
-
-    it "returns the last matching token" do
-      FactoryBot.create :access_token, default_attributes.merge(created_at: 1.day.ago)
-      matching_token = FactoryBot.create :access_token, default_attributes
-      FactoryBot.create :access_token, default_attributes.merge(scopes: "public")
-
-      last_token = described_class.matching_token_for(application, resource_owner_id, scopes)
-      expect(last_token).to eq(matching_token)
-    end
-  end
-
-  describe "#as_json" do
-    let(:token) { FactoryBot.create(:access_token) }
-    let(:token_hash) do
-      {
-        resource_owner_id: token.resource_owner_id,
-        scope: token.scopes,
-        expires_in: token.expires_in_seconds,
-        application: { uid: token.application.uid },
-        created_at: token.created_at.to_i,
-      }
-    end
-
-    it "returns as_json hash" do
-      hash = token_hash
-
-      if Doorkeeper.configuration.polymorphic_resource_owner?
-        hash[:resource_owner_type] = token.resource_owner_type
-      end
-
-      expect(token.as_json).to match(hash)
-    end
-  end
-end