Oauth system spec cleanup / helper method extraction (#32287)
This commit is contained in:
parent
3cf2d35c49
commit
f49161ab1d
@ -24,28 +24,28 @@ RSpec.describe 'Using OAuth from an external app' do
|
||||
subject
|
||||
|
||||
# It presents the user with an authorization page
|
||||
expect(page).to have_content(I18n.t('doorkeeper.authorizations.buttons.authorize'))
|
||||
|
||||
# Upon authorizing, it redirects to the apps' callback URL
|
||||
click_on I18n.t('doorkeeper.authorizations.buttons.authorize')
|
||||
expect(page).to have_current_path(/\A#{client_app.redirect_uri}/, url: true)
|
||||
expect(page).to have_content(oauth_authorize_text)
|
||||
|
||||
# It grants the app access to the account
|
||||
expect(Doorkeeper::AccessGrant.exists?(application: client_app, resource_owner_id: user.id)).to be true
|
||||
expect { click_on oauth_authorize_text }
|
||||
.to change { user_has_grant_with_client_app? }.to(true)
|
||||
|
||||
# Upon authorizing, it redirects to the apps' callback URL
|
||||
expect(page).to redirect_to_callback_url
|
||||
end
|
||||
|
||||
it 'when rejecting the authorization request' do
|
||||
subject
|
||||
|
||||
# It presents the user with an authorization page
|
||||
expect(page).to have_content(I18n.t('doorkeeper.authorizations.buttons.deny'))
|
||||
|
||||
# Upon denying, it redirects to the apps' callback URL
|
||||
click_on I18n.t('doorkeeper.authorizations.buttons.deny')
|
||||
expect(page).to have_current_path(/\A#{client_app.redirect_uri}/, url: true)
|
||||
expect(page).to have_content(oauth_deny_text)
|
||||
|
||||
# It does not grant the app access to the account
|
||||
expect(Doorkeeper::AccessGrant.exists?(application: client_app, resource_owner_id: user.id)).to be false
|
||||
expect { click_on oauth_deny_text }
|
||||
.to_not change { user_has_grant_with_client_app? }.from(false)
|
||||
|
||||
# Upon denying, it redirects to the apps' callback URL
|
||||
expect(page).to redirect_to_callback_url
|
||||
end
|
||||
|
||||
# The tests in this context ensures that requests without PKCE parameters
|
||||
@ -133,7 +133,6 @@ RSpec.describe 'Using OAuth from an external app' do
|
||||
end
|
||||
|
||||
it 'when accepting the authorization request' do
|
||||
params = { client_id: client_app.uid, response_type: 'code', redirect_uri: client_app.redirect_uri, scope: 'read' }
|
||||
visit "/oauth/authorize?#{params.to_query}"
|
||||
|
||||
# It presents the user with a log-in page
|
||||
@ -145,18 +144,17 @@ RSpec.describe 'Using OAuth from an external app' do
|
||||
|
||||
# Logging in redirects to an authorization page
|
||||
fill_in_auth_details(email, password)
|
||||
expect(page).to have_content(I18n.t('doorkeeper.authorizations.buttons.authorize'))
|
||||
|
||||
# Upon authorizing, it redirects to the apps' callback URL
|
||||
click_on I18n.t('doorkeeper.authorizations.buttons.authorize')
|
||||
expect(page).to have_current_path(/\A#{client_app.redirect_uri}/, url: true)
|
||||
expect(page).to have_content(oauth_authorize_text)
|
||||
|
||||
# It grants the app access to the account
|
||||
expect(Doorkeeper::AccessGrant.exists?(application: client_app, resource_owner_id: user.id)).to be true
|
||||
expect { click_on oauth_authorize_text }
|
||||
.to change { user_has_grant_with_client_app? }.to(true)
|
||||
|
||||
# Upon authorizing, it redirects to the apps' callback URL
|
||||
expect(page).to redirect_to_callback_url
|
||||
end
|
||||
|
||||
it 'when rejecting the authorization request' do
|
||||
params = { client_id: client_app.uid, response_type: 'code', redirect_uri: client_app.redirect_uri, scope: 'read' }
|
||||
visit "/oauth/authorize?#{params.to_query}"
|
||||
|
||||
# It presents the user with a log-in page
|
||||
@ -168,21 +166,20 @@ RSpec.describe 'Using OAuth from an external app' do
|
||||
|
||||
# Logging in redirects to an authorization page
|
||||
fill_in_auth_details(email, password)
|
||||
expect(page).to have_content(I18n.t('doorkeeper.authorizations.buttons.authorize'))
|
||||
|
||||
# Upon denying, it redirects to the apps' callback URL
|
||||
click_on I18n.t('doorkeeper.authorizations.buttons.deny')
|
||||
expect(page).to have_current_path(/\A#{client_app.redirect_uri}/, url: true)
|
||||
expect(page).to have_content(oauth_authorize_text)
|
||||
|
||||
# It does not grant the app access to the account
|
||||
expect(Doorkeeper::AccessGrant.exists?(application: client_app, resource_owner_id: user.id)).to be false
|
||||
expect { click_on oauth_deny_text }
|
||||
.to_not change { user_has_grant_with_client_app? }.from(false)
|
||||
|
||||
# Upon denying, it redirects to the apps' callback URL
|
||||
expect(page).to redirect_to_callback_url
|
||||
end
|
||||
|
||||
context 'when the user has set up TOTP' do
|
||||
let(:user) { Fabricate(:user, email: email, password: password, otp_required_for_login: true, otp_secret: User.generate_otp_secret) }
|
||||
|
||||
it 'when accepting the authorization request' do
|
||||
params = { client_id: client_app.uid, response_type: 'code', redirect_uri: client_app.redirect_uri, scope: 'read' }
|
||||
visit "/oauth/authorize?#{params.to_query}"
|
||||
|
||||
# It presents the user with a log-in page
|
||||
@ -202,18 +199,17 @@ RSpec.describe 'Using OAuth from an external app' do
|
||||
|
||||
# Filling in the correct TOTP code redirects to an app authorization page
|
||||
fill_in_otp_details(user.current_otp)
|
||||
expect(page).to have_content(I18n.t('doorkeeper.authorizations.buttons.authorize'))
|
||||
|
||||
# Upon authorizing, it redirects to the apps' callback URL
|
||||
click_on I18n.t('doorkeeper.authorizations.buttons.authorize')
|
||||
expect(page).to have_current_path(/\A#{client_app.redirect_uri}/, url: true)
|
||||
expect(page).to have_content(oauth_authorize_text)
|
||||
|
||||
# It grants the app access to the account
|
||||
expect(Doorkeeper::AccessGrant.exists?(application: client_app, resource_owner_id: user.id)).to be true
|
||||
expect { click_on oauth_authorize_text }
|
||||
.to change { user_has_grant_with_client_app? }.to(true)
|
||||
|
||||
# Upon authorizing, it redirects to the apps' callback URL
|
||||
expect(page).to redirect_to_callback_url
|
||||
end
|
||||
|
||||
it 'when rejecting the authorization request' do
|
||||
params = { client_id: client_app.uid, response_type: 'code', redirect_uri: client_app.redirect_uri, scope: 'read' }
|
||||
visit "/oauth/authorize?#{params.to_query}"
|
||||
|
||||
# It presents the user with a log-in page
|
||||
@ -233,14 +229,14 @@ RSpec.describe 'Using OAuth from an external app' do
|
||||
|
||||
# Filling in the correct TOTP code redirects to an app authorization page
|
||||
fill_in_otp_details(user.current_otp)
|
||||
expect(page).to have_content(I18n.t('doorkeeper.authorizations.buttons.authorize'))
|
||||
|
||||
# Upon denying, it redirects to the apps' callback URL
|
||||
click_on I18n.t('doorkeeper.authorizations.buttons.deny')
|
||||
expect(page).to have_current_path(/\A#{client_app.redirect_uri}/, url: true)
|
||||
expect(page).to have_content(oauth_authorize_text)
|
||||
|
||||
# It does not grant the app access to the account
|
||||
expect(Doorkeeper::AccessGrant.exists?(application: client_app, resource_owner_id: user.id)).to be false
|
||||
expect { click_on oauth_deny_text }
|
||||
.to_not change { user_has_grant_with_client_app? }.from(false)
|
||||
|
||||
# Upon denying, it redirects to the apps' callback URL
|
||||
expect(page).to redirect_to_callback_url
|
||||
end
|
||||
end
|
||||
# TODO: external auth
|
||||
@ -252,4 +248,24 @@ RSpec.describe 'Using OAuth from an external app' do
|
||||
fill_in 'user_otp_attempt', with: value
|
||||
click_on I18n.t('auth.login')
|
||||
end
|
||||
|
||||
def oauth_authorize_text
|
||||
I18n.t('doorkeeper.authorizations.buttons.authorize')
|
||||
end
|
||||
|
||||
def oauth_deny_text
|
||||
I18n.t('doorkeeper.authorizations.buttons.deny')
|
||||
end
|
||||
|
||||
def redirect_to_callback_url
|
||||
have_current_path(/\A#{client_app.redirect_uri}/, url: true)
|
||||
end
|
||||
|
||||
def user_has_grant_with_client_app?
|
||||
Doorkeeper::AccessGrant
|
||||
.exists?(
|
||||
application: client_app,
|
||||
resource_owner_id: user.id
|
||||
)
|
||||
end
|
||||
end
|
||||
|
Loading…
Reference in New Issue
Block a user