kosmos/mastodon
kosmos/mastodon
8
0
Fork 0
Code Pull Requests Activity

Oauth system spec cleanup / helper method extraction (#32287)

Browse Source
This commit is contained in:
Matt Jankowski 2024-10-08 09:30:54 -04:00 committed by GitHub
parent 3cf2d35c49
commit f49161ab1d
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 56 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

96
spec/system/oauth_spec.rb
View File

@ -24,28 +24,28 @@ RSpec.describe 'Using OAuth from an external app' do
subject
# It presents the user with an authorization page
expect(page).to have_content(I18n.t('doorkeeper.authorizations.buttons.authorize'))
# Upon authorizing, it redirects to the apps' callback URL
click_on I18n.t('doorkeeper.authorizations.buttons.authorize')
expect(page).to have_current_path(/\A#{client_app.redirect_uri}/, url: true)
expect(page).to have_content(oauth_authorize_text)
# It grants the app access to the account
expect(Doorkeeper::AccessGrant.exists?(application: client_app, resource_owner_id: user.id)).to be true
expect { click_on oauth_authorize_text }
.to change { user_has_grant_with_client_app? }.to(true)
# Upon authorizing, it redirects to the apps' callback URL
expect(page).to redirect_to_callback_url
end
it 'when rejecting the authorization request' do
subject
# It presents the user with an authorization page
expect(page).to have_content(I18n.t('doorkeeper.authorizations.buttons.deny'))
# Upon denying, it redirects to the apps' callback URL
click_on I18n.t('doorkeeper.authorizations.buttons.deny')
expect(page).to have_current_path(/\A#{client_app.redirect_uri}/, url: true)
expect(page).to have_content(oauth_deny_text)
# It does not grant the app access to the account
expect(Doorkeeper::AccessGrant.exists?(application: client_app, resource_owner_id: user.id)).to be false
expect { click_on oauth_deny_text }
.to_not change { user_has_grant_with_client_app? }.from(false)
# Upon denying, it redirects to the apps' callback URL
expect(page).to redirect_to_callback_url
end
# The tests in this context ensures that requests without PKCE parameters
@ -133,7 +133,6 @@ RSpec.describe 'Using OAuth from an external app' do
end
it 'when accepting the authorization request' do
params = { client_id: client_app.uid, response_type: 'code', redirect_uri: client_app.redirect_uri, scope: 'read' }
visit "/oauth/authorize?#{params.to_query}"
# It presents the user with a log-in page
@ -145,18 +144,17 @@ RSpec.describe 'Using OAuth from an external app' do
# Logging in redirects to an authorization page
fill_in_auth_details(email, password)
expect(page).to have_content(I18n.t('doorkeeper.authorizations.buttons.authorize'))
# Upon authorizing, it redirects to the apps' callback URL
click_on I18n.t('doorkeeper.authorizations.buttons.authorize')
expect(page).to have_current_path(/\A#{client_app.redirect_uri}/, url: true)
expect(page).to have_content(oauth_authorize_text)
# It grants the app access to the account
expect(Doorkeeper::AccessGrant.exists?(application: client_app, resource_owner_id: user.id)).to be true
expect { click_on oauth_authorize_text }
.to change { user_has_grant_with_client_app? }.to(true)
# Upon authorizing, it redirects to the apps' callback URL
expect(page).to redirect_to_callback_url
end
it 'when rejecting the authorization request' do
params = { client_id: client_app.uid, response_type: 'code', redirect_uri: client_app.redirect_uri, scope: 'read' }
visit "/oauth/authorize?#{params.to_query}"
# It presents the user with a log-in page
@ -168,21 +166,20 @@ RSpec.describe 'Using OAuth from an external app' do
# Logging in redirects to an authorization page
fill_in_auth_details(email, password)
expect(page).to have_content(I18n.t('doorkeeper.authorizations.buttons.authorize'))
# Upon denying, it redirects to the apps' callback URL
click_on I18n.t('doorkeeper.authorizations.buttons.deny')
expect(page).to have_current_path(/\A#{client_app.redirect_uri}/, url: true)
expect(page).to have_content(oauth_authorize_text)
# It does not grant the app access to the account
expect(Doorkeeper::AccessGrant.exists?(application: client_app, resource_owner_id: user.id)).to be false
expect { click_on oauth_deny_text }
.to_not change { user_has_grant_with_client_app? }.from(false)
# Upon denying, it redirects to the apps' callback URL
expect(page).to redirect_to_callback_url
end
context 'when the user has set up TOTP' do
let(:user) { Fabricate(:user, email: email, password: password, otp_required_for_login: true, otp_secret: User.generate_otp_secret) }
it 'when accepting the authorization request' do
params = { client_id: client_app.uid, response_type: 'code', redirect_uri: client_app.redirect_uri, scope: 'read' }
visit "/oauth/authorize?#{params.to_query}"
# It presents the user with a log-in page
@ -202,18 +199,17 @@ RSpec.describe 'Using OAuth from an external app' do
# Filling in the correct TOTP code redirects to an app authorization page
fill_in_otp_details(user.current_otp)
expect(page).to have_content(I18n.t('doorkeeper.authorizations.buttons.authorize'))
# Upon authorizing, it redirects to the apps' callback URL
click_on I18n.t('doorkeeper.authorizations.buttons.authorize')
expect(page).to have_current_path(/\A#{client_app.redirect_uri}/, url: true)
expect(page).to have_content(oauth_authorize_text)
# It grants the app access to the account
expect(Doorkeeper::AccessGrant.exists?(application: client_app, resource_owner_id: user.id)).to be true
expect { click_on oauth_authorize_text }
.to change { user_has_grant_with_client_app? }.to(true)
# Upon authorizing, it redirects to the apps' callback URL
expect(page).to redirect_to_callback_url
end
it 'when rejecting the authorization request' do
params = { client_id: client_app.uid, response_type: 'code', redirect_uri: client_app.redirect_uri, scope: 'read' }
visit "/oauth/authorize?#{params.to_query}"
# It presents the user with a log-in page
@ -233,14 +229,14 @@ RSpec.describe 'Using OAuth from an external app' do
# Filling in the correct TOTP code redirects to an app authorization page
fill_in_otp_details(user.current_otp)
expect(page).to have_content(I18n.t('doorkeeper.authorizations.buttons.authorize'))
# Upon denying, it redirects to the apps' callback URL
click_on I18n.t('doorkeeper.authorizations.buttons.deny')
expect(page).to have_current_path(/\A#{client_app.redirect_uri}/, url: true)
expect(page).to have_content(oauth_authorize_text)
# It does not grant the app access to the account
expect(Doorkeeper::AccessGrant.exists?(application: client_app, resource_owner_id: user.id)).to be false
expect { click_on oauth_deny_text }
.to_not change { user_has_grant_with_client_app? }.from(false)
# Upon denying, it redirects to the apps' callback URL
expect(page).to redirect_to_callback_url
end
end
# TODO: external auth
@ -252,4 +248,24 @@ RSpec.describe 'Using OAuth from an external app' do
fill_in 'user_otp_attempt', with: value
click_on I18n.t('auth.login')
end
def oauth_authorize_text
I18n.t('doorkeeper.authorizations.buttons.authorize')
end
def oauth_deny_text
I18n.t('doorkeeper.authorizations.buttons.deny')
end
def redirect_to_callback_url
have_current_path(/\A#{client_app.redirect_uri}/, url: true)
end
def user_has_grant_with_client_app?
Doorkeeper::AccessGrant
.exists?(
application: client_app,
resource_owner_id: user.id
)
end
end