test/controllers/oauth2_authorizations_controller_test.rb

   1 require "test_helper"
   2
   3 class Oauth2AuthorizationsControllerTest < ActionDispatch::IntegrationTest
   4   ##
   5   # test all routes which lead to this controller
   6   def test_routes
   7     assert_routing(
   8       { :path => "/oauth2/authorize", :method => :get },
   9       { :controller => "oauth2_authorizations", :action => "new" }
  10     )
  11     assert_routing(
  12       { :path => "/oauth2/authorize", :method => :post },
  13       { :controller => "oauth2_authorizations", :action => "create" }
  14     )
  15     assert_routing(
  16       { :path => "/oauth2/authorize", :method => :delete },
  17       { :controller => "oauth2_authorizations", :action => "destroy" }
  18     )
  19     assert_routing(
  20       { :path => "/oauth2/authorize/native", :method => :get },
  21       { :controller => "oauth2_authorizations", :action => "show" }
  22     )
  23   end
  24
  25   def test_new
  26     application = create(:oauth_application, :scopes => "write_api")
  27
  28     get oauth_authorization_path(:client_id => application.uid,
  29                                  :redirect_uri => application.redirect_uri,
  30                                  :response_type => "code",
  31                                  :scope => "write_api")
  32     assert_response :redirect
  33     assert_redirected_to login_path(:referer => oauth_authorization_path(:client_id => application.uid,
  34                                                                          :redirect_uri => application.redirect_uri,
  35                                                                          :response_type => "code",
  36                                                                          :scope => "write_api"))
  37
  38     session_for(create(:user))
  39
  40     get oauth_authorization_path(:client_id => application.uid,
  41                                  :redirect_uri => application.redirect_uri,
  42                                  :response_type => "code",
  43                                  :scope => "write_api")
  44     assert_response :success
  45     assert_template "oauth2_authorizations/new"
  46   end
  47
  48   def test_new_native
  49     application = create(:oauth_application, :scopes => "write_api", :redirect_uri => "urn:ietf:wg:oauth:2.0:oob")
  50
  51     get oauth_authorization_path(:client_id => application.uid,
  52                                  :redirect_uri => application.redirect_uri,
  53                                  :response_type => "code",
  54                                  :scope => "write_api")
  55     assert_response :redirect
  56     assert_redirected_to login_path(:referer => oauth_authorization_path(:client_id => application.uid,
  57                                                                          :redirect_uri => application.redirect_uri,
  58                                                                          :response_type => "code",
  59                                                                          :scope => "write_api"))
  60
  61     session_for(create(:user))
  62
  63     get oauth_authorization_path(:client_id => application.uid,
  64                                  :redirect_uri => application.redirect_uri,
  65                                  :response_type => "code",
  66                                  :scope => "write_api")
  67     assert_response :success
  68     assert_template "oauth2_authorizations/new"
  69   end
  70
  71   def test_new_bad_uri
  72     application = create(:oauth_application, :scopes => "write_api")
  73
  74     session_for(create(:user))
  75
  76     get oauth_authorization_path(:client_id => application.uid,
  77                                  :redirect_uri => "https://bad.example.com/",
  78                                  :response_type => "code",
  79                                  :scope => "write_api")
  80     assert_response :bad_request
  81     assert_template "oauth2_authorizations/error"
  82     assert_select "p", "The requested redirect uri is malformed or doesn't match client redirect URI."
  83   end
  84
  85   def test_new_bad_scope
  86     application = create(:oauth_application, :scopes => "write_api")
  87
  88     session_for(create(:user))
  89
  90     get oauth_authorization_path(:client_id => application.uid,
  91                                  :redirect_uri => application.redirect_uri,
  92                                  :response_type => "code",
  93                                  :scope => "bad_scope")
  94     assert_response :bad_request
  95     assert_template "oauth2_authorizations/error"
  96     assert_select "p", "The requested scope is invalid, unknown, or malformed."
  97
  98     get oauth_authorization_path(:client_id => application.uid,
  99                                  :redirect_uri => application.redirect_uri,
 100                                  :response_type => "code",
 101                                  :scope => "write_prefs")
 102     assert_response :bad_request
 103     assert_template "oauth2_authorizations/error"
 104     assert_select "p", "The requested scope is invalid, unknown, or malformed."
 105   end
 106
 107   def test_create
 108     application = create(:oauth_application, :scopes => "write_api")
 109
 110     post oauth_authorization_path(:client_id => application.uid,
 111                                   :redirect_uri => application.redirect_uri,
 112                                   :response_type => "code",
 113                                   :scope => "write_api")
 114     assert_response :forbidden
 115
 116     session_for(create(:user))
 117
 118     post oauth_authorization_path(:client_id => application.uid,
 119                                   :redirect_uri => application.redirect_uri,
 120                                   :response_type => "code",
 121                                   :scope => "write_api")
 122     assert_response :redirect
 123     assert_redirected_to(/^#{Regexp.escape(application.redirect_uri)}\?code=/)
 124   end
 125
 126   def test_create_native
 127     application = create(:oauth_application, :scopes => "write_api", :redirect_uri => "urn:ietf:wg:oauth:2.0:oob")
 128
 129     post oauth_authorization_path(:client_id => application.uid,
 130                                   :redirect_uri => application.redirect_uri,
 131                                   :response_type => "code",
 132                                   :scope => "write_api")
 133     assert_response :forbidden
 134
 135     session_for(create(:user))
 136
 137     post oauth_authorization_path(:client_id => application.uid,
 138                                   :redirect_uri => application.redirect_uri,
 139                                   :response_type => "code",
 140                                   :scope => "write_api")
 141     assert_response :redirect
 142     assert_equal native_oauth_authorization_path, URI.parse(response.location).path
 143     follow_redirect!
 144     assert_response :success
 145     assert_template "oauth2_authorizations/show"
 146   end
 147
 148   def test_destroy
 149     application = create(:oauth_application)
 150
 151     delete oauth_authorization_path(:client_id => application.uid,
 152                                     :redirect_uri => application.redirect_uri,
 153                                     :response_type => "code",
 154                                     :scope => "write_api")
 155     assert_response :forbidden
 156
 157     session_for(create(:user))
 158
 159     delete oauth_authorization_path(:client_id => application.uid,
 160                                     :redirect_uri => application.redirect_uri,
 161                                     :response_type => "code",
 162                                     :scope => "write_api")
 163     assert_response :redirect
 164     assert_redirected_to(/^#{Regexp.escape(application.redirect_uri)}\?error=access_denied/)
 165   end
 166
 167   def test_destroy_native
 168     application = create(:oauth_application, :redirect_uri => "urn:ietf:wg:oauth:2.0:oob")
 169
 170     delete oauth_authorization_path(:client_id => application.uid,
 171                                     :redirect_uri => application.redirect_uri,
 172                                     :response_type => "code",
 173                                     :scope => "write_api")
 174     assert_response :forbidden
 175
 176     session_for(create(:user))
 177
 178     delete oauth_authorization_path(:client_id => application.uid,
 179                                     :redirect_uri => application.redirect_uri,
 180                                     :response_type => "code",
 181                                     :scope => "write_api")
 182     assert_response :bad_request
 183   end
 184 end