test/controllers/oauth2_authorizations_controller_test.rb

   1 # frozen_string_literal: true
   2
   3 require "test_helper"
   4
   5 class Oauth2AuthorizationsControllerTest < ActionDispatch::IntegrationTest
   6   ##
   7   # test all routes which lead to this controller
   8   def test_routes
   9     assert_routing(
  10       { :path => "/oauth2/authorize", :method => :get },
  11       { :controller => "oauth2_authorizations", :action => "new" }
  12     )
  13     assert_routing(
  14       { :path => "/oauth2/authorize", :method => :post },
  15       { :controller => "oauth2_authorizations", :action => "create" }
  16     )
  17     assert_routing(
  18       { :path => "/oauth2/authorize", :method => :delete },
  19       { :controller => "oauth2_authorizations", :action => "destroy" }
  20     )
  21     assert_routing(
  22       { :path => "/oauth2/authorize/native", :method => :get },
  23       { :controller => "oauth2_authorizations", :action => "show" }
  24     )
  25   end
  26
  27   def test_new
  28     application = create(:oauth_application, :scopes => "write_api")
  29
  30     get oauth_authorization_path(:client_id => application.uid,
  31                                  :redirect_uri => application.redirect_uri,
  32                                  :response_type => "code",
  33                                  :scope => "write_api")
  34     assert_redirected_to login_path(:referer => oauth_authorization_path(:client_id => application.uid,
  35                                                                          :redirect_uri => application.redirect_uri,
  36                                                                          :response_type => "code",
  37                                                                          :scope => "write_api"))
  38
  39     session_for(create(:user))
  40
  41     get oauth_authorization_path(:client_id => application.uid,
  42                                  :redirect_uri => application.redirect_uri,
  43                                  :response_type => "code",
  44                                  :scope => "write_api")
  45     assert_response :success
  46     assert_template "oauth2_authorizations/new"
  47   end
  48
  49   def test_new_native
  50     application = create(:oauth_application, :scopes => "write_api", :redirect_uri => "urn:ietf:wg:oauth:2.0:oob")
  51
  52     get oauth_authorization_path(:client_id => application.uid,
  53                                  :redirect_uri => application.redirect_uri,
  54                                  :response_type => "code",
  55                                  :scope => "write_api")
  56     assert_redirected_to login_path(:referer => oauth_authorization_path(:client_id => application.uid,
  57                                                                          :redirect_uri => application.redirect_uri,
  58                                                                          :response_type => "code",
  59                                                                          :scope => "write_api"))
  60
  61     session_for(create(:user))
  62
  63     get oauth_authorization_path(:client_id => application.uid,
  64                                  :redirect_uri => application.redirect_uri,
  65                                  :response_type => "code",
  66                                  :scope => "write_api")
  67     assert_response :success
  68     assert_template "oauth2_authorizations/new"
  69   end
  70
  71   def test_new_bad_uri
  72     application = create(:oauth_application, :scopes => "write_api")
  73
  74     session_for(create(:user))
  75
  76     get oauth_authorization_path(:client_id => application.uid,
  77                                  :redirect_uri => "https://bad.example.com/",
  78                                  :response_type => "code",
  79                                  :scope => "write_api")
  80     assert_response :bad_request
  81     assert_template "oauth2_authorizations/error"
  82     assert_select "p", "The requested redirect uri is malformed or doesn't match client redirect URI."
  83   end
  84
  85   def test_new_bad_scope
  86     application = create(:oauth_application, :scopes => "write_api")
  87
  88     session_for(create(:user))
  89
  90     get oauth_authorization_path(:client_id => application.uid,
  91                                  :redirect_uri => application.redirect_uri,
  92                                  :response_type => "code",
  93                                  :scope => "bad_scope")
  94     assert_response :bad_request
  95     assert_template "oauth2_authorizations/error"
  96     assert_select "p", "The requested scope is invalid, unknown, or malformed."
  97
  98     get oauth_authorization_path(:client_id => application.uid,
  99                                  :redirect_uri => application.redirect_uri,
 100                                  :response_type => "code",
 101                                  :scope => "write_prefs")
 102     assert_response :bad_request
 103     assert_template "oauth2_authorizations/error"
 104     assert_select "p", "The requested scope is invalid, unknown, or malformed."
 105   end
 106
 107   def test_new_db_readonly
 108     application = create(:oauth_application, :scopes => "write_api")
 109
 110     session_for(create(:user))
 111
 112     with_settings(:status => "database_readonly") do
 113       get oauth_authorization_path(:client_id => application.uid,
 114                                    :redirect_uri => application.redirect_uri,
 115                                    :response_type => "code",
 116                                    :scope => "write_api")
 117       assert_redirected_to offline_path
 118     end
 119   end
 120
 121   def test_create
 122     application = create(:oauth_application, :scopes => "write_api")
 123
 124     post oauth_authorization_path(:client_id => application.uid,
 125                                   :redirect_uri => application.redirect_uri,
 126                                   :response_type => "code",
 127                                   :scope => "write_api")
 128     assert_response :forbidden
 129
 130     session_for(create(:user))
 131
 132     post oauth_authorization_path(:client_id => application.uid,
 133                                   :redirect_uri => application.redirect_uri,
 134                                   :response_type => "code",
 135                                   :scope => "write_api")
 136     assert_redirected_to(/^#{Regexp.escape(application.redirect_uri)}\?code=/)
 137   end
 138
 139   def test_create_native
 140     application = create(:oauth_application, :scopes => "write_api", :redirect_uri => "urn:ietf:wg:oauth:2.0:oob")
 141
 142     post oauth_authorization_path(:client_id => application.uid,
 143                                   :redirect_uri => application.redirect_uri,
 144                                   :response_type => "code",
 145                                   :scope => "write_api")
 146     assert_response :forbidden
 147
 148     session_for(create(:user))
 149
 150     post oauth_authorization_path(:client_id => application.uid,
 151                                   :redirect_uri => application.redirect_uri,
 152                                   :response_type => "code",
 153                                   :scope => "write_api")
 154     assert_response :redirect
 155     assert_equal native_oauth_authorization_path, URI.parse(response.location).path
 156     follow_redirect!
 157     assert_response :success
 158     assert_template "oauth2_authorizations/show"
 159   end
 160
 161   def test_destroy
 162     application = create(:oauth_application)
 163
 164     delete oauth_authorization_path(:client_id => application.uid,
 165                                     :redirect_uri => application.redirect_uri,
 166                                     :response_type => "code",
 167                                     :scope => "write_api")
 168     assert_response :forbidden
 169
 170     session_for(create(:user))
 171
 172     delete oauth_authorization_path(:client_id => application.uid,
 173                                     :redirect_uri => application.redirect_uri,
 174                                     :response_type => "code",
 175                                     :scope => "write_api")
 176     assert_redirected_to(/^#{Regexp.escape(application.redirect_uri)}\?error=access_denied/)
 177   end
 178
 179   def test_destroy_native
 180     application = create(:oauth_application, :redirect_uri => "urn:ietf:wg:oauth:2.0:oob")
 181
 182     delete oauth_authorization_path(:client_id => application.uid,
 183                                     :redirect_uri => application.redirect_uri,
 184                                     :response_type => "code",
 185                                     :scope => "write_api")
 186     assert_response :forbidden
 187
 188     session_for(create(:user))
 189
 190     delete oauth_authorization_path(:client_id => application.uid,
 191                                     :redirect_uri => application.redirect_uri,
 192                                     :response_type => "code",
 193                                     :scope => "write_api")
 194     assert_response :bad_request
 195   end
 196 end