raucao
a373e577dc
CI / Test (pull_request) Failing after 48s
The code is redeemed by the client immediately in the OAuth callback, so a 60-second window is plenty (and matches common practice; RFC 6749 caps authorization codes at 10 minutes). Part of #254
66 lines
1.5 KiB
Ruby
66 lines
1.5 KiB
Ruby
require 'rails_helper'
|
|
|
|
RSpec.describe RsAuthorizationCode, type: :model do
|
|
let(:user) { create :user }
|
|
|
|
def build_code(**attrs)
|
|
RsAuthorizationCode.create!(
|
|
user: user,
|
|
client_id: "example.com",
|
|
redirect_uri: "https://example.com",
|
|
permissions: %w(documents:rw),
|
|
code_challenge: "challenge",
|
|
**attrs
|
|
)
|
|
end
|
|
|
|
describe "#create" do
|
|
it "generates a raw code and stores only its digest" do
|
|
code = build_code
|
|
|
|
expect(code.code).to be_present
|
|
expect(code.code_digest).to eq(Digest::SHA256.hexdigest(code.code))
|
|
end
|
|
|
|
it "sets a short expiry" do
|
|
code = build_code
|
|
|
|
expect(code.expires_at).to be_within(5.seconds).of(60.seconds.from_now)
|
|
end
|
|
end
|
|
|
|
describe ".find_by_code" do
|
|
it "finds a code by its raw value" do
|
|
code = build_code
|
|
|
|
expect(RsAuthorizationCode.find_by_code(code.code)).to eq(code)
|
|
end
|
|
|
|
it "returns nil for an unknown code" do
|
|
expect(RsAuthorizationCode.find_by_code("does-not-exist")).to be_nil
|
|
end
|
|
|
|
it "returns nil for a blank code" do
|
|
expect(RsAuthorizationCode.find_by_code(nil)).to be_nil
|
|
end
|
|
end
|
|
|
|
describe "#expired?" do
|
|
it "is false before the expiry" do
|
|
expect(build_code).not_to be_expired
|
|
end
|
|
|
|
it "is true after the expiry" do
|
|
expect(build_code(expires_at: 1.minute.ago)).to be_expired
|
|
end
|
|
end
|
|
|
|
describe "#consume!" do
|
|
it "destroys the record" do
|
|
code = build_code
|
|
|
|
expect { code.consume! }.to change(RsAuthorizationCode, :count).by(-1)
|
|
end
|
|
end
|
|
end
|