raucao
7c4bad860a
- Add user_agent to remote_storage_authorizations and rs_authorization_codes - Capture the browser's user agent at consent, carry it on the authorization code, and store it on the authorization when the code is exchanged - Store it directly for the implicit flow too With the reuse shortcut gone, each authorization is already a distinct per-device token; this adds the metadata needed to label and display them. Part of #254
32 lines
1008 B
Ruby
32 lines
1008 B
Ruby
require 'rails_helper'
|
|
|
|
RSpec.describe RsOauthManager::IssueCode do
|
|
let(:user) { create :user }
|
|
|
|
subject do
|
|
described_class.call(
|
|
user: user,
|
|
client_id: "example.com",
|
|
redirect_uri: "https://example.com",
|
|
permissions: %w(documents:rw),
|
|
code_challenge: "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
|
|
code_challenge_method: "S256",
|
|
expire_at: 1.month.from_now,
|
|
user_agent: "RSpec Device"
|
|
)
|
|
end
|
|
|
|
it "creates a short-lived authorization code" do
|
|
expect { subject }.to change(RsAuthorizationCode, :count).by(1)
|
|
expect(subject.code).to be_present
|
|
expect(subject.client_id).to eq("example.com")
|
|
expect(subject.permissions).to eq(%w(documents:rw))
|
|
expect(subject.code_challenge).to eq("E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM")
|
|
expect(subject.user_agent).to eq("RSpec Device")
|
|
end
|
|
|
|
it "does not create a remote storage authorization" do
|
|
expect { subject }.not_to change(RemoteStorageAuthorization, :count)
|
|
end
|
|
end
|