<commit_before># frozen_string_literal: true

require 'rails_helper'

describe Doorkeeper::AuthorizationsController, type: :controller do
  let(:user) { create :user }
  let(:application) { create :application, scopes: default_scopes }
  let(:default_scopes) { 'openid profile' }
  let(:token_attributes) { { application_id: application.id, resource_owner_id: user.id, scopes: default_scopes } }

  def authorize!(params = {})
    get :new, params: {
      response_type: 'code',
      current_user: user.id,
      client_id: application.uid,
      scope: default_scopes,
      redirect_uri: application.redirect_uri,
    }.merge(params)
  end

  def build_redirect_uri(params = {})
    Doorkeeper::OAuth::Authorization::URIBuilder.uri_with_query(application.redirect_uri, params)
  end

  def expect_authorization_form!
    expect(response).to be_successful
    expect(response).to render_template('doorkeeper/authorizations/new')
  end

  def expect_successful_callback!
    expect(response).to be_redirect
    expect(response.location).to match(/^#{Regexp.quote application.redirect_uri}\?code=[-\w]+$/)
  end

  describe '#authenticate_resource_owner!' do
    it 'redirects to login form when not logged in' do
      authorize! current_user: nil

      expect(response).to redirect_to '/login'
    end

    context 'with OIDC requests' do
      before do
        expect(controller).to receive(:handle_oidc_prompt_param!)
        expect(controller).to receive(:handle_oidc_max_age_param!)
      end

      it 'renders the authorization form if logged in' do
        authorize!

        expect_authorization_form!
      end
    end

    context 'with non-OIDC requests' do
      before do
        expect(controller).not_to receive(:handle_oidc_prompt_param!)
        expect(controller).not_to receive(:handle_oidc_max_age_param!)
      end

      it 'when action is not :new' do
        get :show, params: {
          response_type: 'code',
          current_user: user.id,
          client_id: application.uid,
          scope: default_scopes,
          redirect_uri: application.redirect_uri,
        }

        expect(response).to render_template('doorkeeper/authorizations/show')
      end

      context 'when pre_authorization is invalid' do
        it 'render error when client_id is missing' do
          authorize!(client_id: nil)

          expect(response).to be_successful
          expect(response).to render_template('doorkeeper/authorizations/error')
        end

        it 'render error when response_type is missing' do
          authorize!(response_type: nil)

          expect(response).to be_successful
          expect(response).to render_template('doorkeeper/authorizations/error')
        end
      end

      it 'when openid scope is not present' do
        authorize!(scope: 'profile')

        expect_authorization_form!
      end
    end
  end

  describe '#handle_oidc_prompt_param!' do
    it 'is ignored when the openid scope is not present' do
      authorize! scope: 'profile', prompt: 'invalid'

      expect_authorization_form!
    end

    context 'with a prompt=none parameter' do
      context 'and a matching token' do
        before do
          create :access_token, token_attributes
        end

        it 'redirects to the callback if logged in' do
          authorize! prompt: 'none'

          expect_successful_callback!
        end

        it 'returns an invalid_request error if another prompt value is present' do
          authorize! prompt: 'none login'

          error_params = {
            'error' => 'invalid_request',
            'error_description' => 'The request is missing a required parameter, includes an unsupported parameter value, or is otherwise malformed.',
          }

          expect(response.status).to redirect_to build_redirect_uri(error_params)
          expect(JSON.parse(response.body)).to eq(error_params)
        end

        context 'when not logged in' do
          let(:error_params) do
            {
              'error' => 'login_required',
              'error_description' => 'The authorization server requires end-user authentication',
              'state' => 'somestate',
            }
          end

          it 'returns a login_required error' do
            authorize! prompt: 'none', current_user: nil, state: 'somestate'

            expect(response).to redirect_to build_redirect_uri(error_params)
            expect(JSON.parse(response.body)).to eq(error_params)
          end
        end
      end

      context 'and no matching token' do
        it 'redirects to the callback if skip_authorization is set to true' do
          allow(controller).to receive(:skip_authorization?).and_return(true)

          authorize! prompt: 'none'
          expect_successful_callback!
        end

        it 'returns a consent_required error when logged in' do
          authorize! prompt: 'none'

          error_params = {
            'error' => 'consent_required',
            'error_description' => 'The authorization server requires end-user consent',
          }

          expect(response).to redirect_to build_redirect_uri(error_params)
          expect(JSON.parse(response.body)).to eq(error_params)
        end
      end
    end

    context 'with a prompt=login parameter' do
      it 'redirects to the sign in form if not logged in' do
        authorize! prompt: 'login', current_user: nil

        expect(response).to redirect_to('/login')
      end

      it 'reauthenticates the user if logged in' do
        authorize! prompt: 'login'

        expect(response).to redirect_to('/reauthenticate')
      end
    end

    context 'with a prompt=consent parameter' do<commit_msg>Failing test for implicit_flow error uri<commit_after># frozen_string_literal: true

require 'rails_helper'

describe Doorkeeper::AuthorizationsController, type: :controller do
  let(:user) { create :user }
  let(:application) { create :application, scopes: default_scopes }
  let(:default_scopes) { 'openid profile' }
  let(:token_attributes) { { application_id: application.id, resource_owner_id: user.id, scopes: default_scopes } }

  def authorize!(params = {})
    get :new, params: {
      response_type: 'code',
      current_user: user.id,
      client_id: application.uid,
      scope: default_scopes,
      redirect_uri: application.redirect_uri,
    }.merge(params)
  end

  def build_redirect_uri(params = {}, type: 'query')
    case type
    when 'query'
      Doorkeeper::OAuth::Authorization::URIBuilder.uri_with_query(application.redirect_uri, params)
    when 'fragment'
      Doorkeeper::OAuth::Authorization::URIBuilder.uri_with_fragment(application.redirect_uri, params)
    else
      raise ArgumentError, "Unsupported uri type #{type}"
    end
  end

  def expect_authorization_form!
    expect(response).to be_successful
    expect(response).to render_template('doorkeeper/authorizations/new')
  end

  def expect_successful_callback!
    expect(response).to be_redirect
    expect(response.location).to match(/^#{Regexp.quote application.redirect_uri}\?code=[-\w]+$/)
  end

  describe '#authenticate_resource_owner!' do
    it 'redirects to login form when not logged in' do
      authorize! current_user: nil

      expect(response).to redirect_to '/login'
    end

    context 'with OIDC requests' do
      before do
        expect(controller).to receive(:handle_oidc_prompt_param!)
        expect(controller).to receive(:handle_oidc_max_age_param!)
      end

      it 'renders the authorization form if logged in' do
        authorize!

        expect_authorization_form!
      end
    end

    context 'with non-OIDC requests' do
      before do
        expect(controller).not_to receive(:handle_oidc_prompt_param!)
        expect(controller).not_to receive(:handle_oidc_max_age_param!)
      end

      it 'when action is not :new' do
        get :show, params: {
          response_type: 'code',
          current_user: user.id,
          client_id: application.uid,
          scope: default_scopes,
          redirect_uri: application.redirect_uri,
        }

        expect(response).to render_template('doorkeeper/authorizations/show')
      end

      context 'when pre_authorization is invalid' do
        it 'render error when client_id is missing' do
          authorize!(client_id: nil)

          expect(response).to be_successful
          expect(response).to render_template('doorkeeper/authorizations/error')
        end

        it 'render error when response_type is missing' do
          authorize!(response_type: nil)

          expect(response).to be_successful
          expect(response).to render_template('doorkeeper/authorizations/error')
        end
      end

      it 'when openid scope is not present' do
        authorize!(scope: 'profile')

        expect_authorization_form!
      end
    end
  end

  describe '#handle_oidc_prompt_param!' do
    it 'is ignored when the openid scope is not present' do
      authorize! scope: 'profile', prompt: 'invalid'

      expect_authorization_form!
    end

    context 'with a prompt=none parameter' do
      context 'and a matching token' do
        before do
          create :access_token, token_attributes
        end

        it 'redirects to the callback if logged in' do
          authorize! prompt: 'none'

          expect_successful_callback!
        end

        it 'returns an invalid_request error if another prompt value is present' do
          authorize! prompt: 'none login'

          error_params = {
            'error' => 'invalid_request',
            'error_description' => 'The request is missing a required parameter, includes an unsupported parameter value, or is otherwise malformed.',
          }

          expect(response.status).to redirect_to build_redirect_uri(error_params)
          expect(JSON.parse(response.body)).to eq(error_params)
        end

        context 'when not logged in' do
          let(:error_params) do
            {
              'error' => 'login_required',
              'error_description' => 'The authorization server requires end-user authentication',
              'state' => 'somestate',
            }
          end

          it 'returns a login_required error' do
            authorize! prompt: 'none', current_user: nil, state: 'somestate'

            expect(response).to redirect_to build_redirect_uri(error_params)
            expect(JSON.parse(response.body)).to eq(error_params)
          end
        end
      end

      context 'and no matching token' do
        it 'redirects to the callback if skip_authorization is set to true' do
          allow(controller).to receive(:skip_authorization?).and_return(true)

          authorize! prompt: 'none'
          expect_successful_callback!
        end

        context 'when not logged in' do
          it 'returns the login_required error when not logged in' do
            error_params = {
              'error' => 'login_required',
              'error_description' => 'The authorization server requires end-user authentication',
              'state' => 'somestate',
            }

            authorize! prompt: 'none', current_user: nil, state: 'somestate'

            expect(response).to redirect_to build_redirect_uri(error_params)
            expect(JSON.parse(response.body)).to eq(error_params)
          end

          it 'uses the fragment style uris when redirecting an error for implicit flow request' do
            allow(Doorkeeper.configuration).to receive(:grant_flows).and_return(['implicit_oidc'])

            error_params = {
              'error' => 'login_required',
              'error_description' => 'The authorization server requires end-user authentication',
              'state' => 'somestate',
            }

            authorize! response_type: 'id_token token', prompt: 'none', current_user: nil, state: 'somestate'

            expect(response).to redirect_to build_redirect_uri(error_params, type: 'fragment')
            expect(JSON.parse(response.body)).to eq(error_params)
          end
        end

        it 'returns a consent_required error when logged in' do
          authorize! prompt: 'none'

          error_params = {
            'error' => 'consent_required',
            'error_description' => 'The authorization server requires end-user consent',
          }

          expect(response).to redirect_to build_redirect_uri(error_params)
          expect(JSON.parse(response.body)).to eq(error_params)
        end
      end
    end

    context 'with a prompt=login parameter' do
      it 'redirects to the sign in form if not logged in' do
        authorize! prompt: 'login', current_user: nil

        expect(response).to redirect_to('/login')
      end

      it 'reauthenticates the user if logged in' do
        authorize! prompt: 'login'

        expect(response).to redirect_to('/reauthenticate')
      end
    end

    context 'with a prompt=consent parameter' do
{'fraction_non_alphanumeric': 0.08594414790748046, 'fraction_numerical': 0.0, 'mean_word_length': 2.612182173791562, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 23, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5147096', 'n_tokens_mistral': 3550, 'n_tokens_neox': 3463, 'n_words': 979}