cst1/openstreetmap-website
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Logout while testing OAuth 1 token usage

Browse source 
This ensures we're not accidentally inheriting any session permissions.
This commit is contained in:
Tom Hughes 2023-08-25 09:44:25 +01:00
parent b9f9c0f3cc
commit 477f700cfa
1 changed files with 20 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

40
test/integration/oauth_test.rb
View file

@ -7,11 +7,7 @@ class OAuthTest < ActionDispatch::IntegrationTest
client = create(:client_application, :callback_url => "http://some.web.app.example.org/callback", :allow_read_prefs => true, :allow_write_api => true, :allow_read_gpx => true) client = create(:client_application, :callback_url => "http://some.web.app.example.org/callback", :allow_read_prefs => true, :allow_write_api => true, :allow_read_gpx => true)
user = create(:user) user = create(:user)
get "/login" session_for(user)
follow_redirect!
post "/login", :params => { :username => user.email, :password => "test" }
follow_redirect!
assert_response :success
oauth10_without_callback(client) oauth10_without_callback(client)
oauth10_with_callback(client, "http://another.web.app.example.org/callback") oauth10_with_callback(client, "http://another.web.app.example.org/callback")
@ -22,11 +18,7 @@ class OAuthTest < ActionDispatch::IntegrationTest
client = create(:client_application, :allow_read_prefs => true, :allow_write_api => true, :allow_read_gpx => true) client = create(:client_application, :allow_read_prefs => true, :allow_write_api => true, :allow_read_gpx => true)
user = create(:user) user = create(:user)
get "/login" session_for(user)
follow_redirect!
post "/login", :params => { :username => user.email, :password => "test" }
follow_redirect!
assert_response :success
oauth10_without_callback(client) oauth10_without_callback(client)
oauth10_refused(client) oauth10_refused(client)
@ -36,11 +28,7 @@ class OAuthTest < ActionDispatch::IntegrationTest
client = create(:client_application, :callback_url => "http://some.web.app.example.org/callback", :allow_read_prefs => true, :allow_write_api => true, :allow_read_gpx => true) client = create(:client_application, :callback_url => "http://some.web.app.example.org/callback", :allow_read_prefs => true, :allow_write_api => true, :allow_read_gpx => true)
user = create(:user) user = create(:user)
get "/login" session_for(user)
follow_redirect!
post "/login", :params => { :username => user.email, :password => "test" }
follow_redirect!
assert_response :success
oauth10a_without_callback(client) oauth10a_without_callback(client)
oauth10a_with_callback(client, "http://another.web.app.example.org/callback") oauth10a_with_callback(client, "http://another.web.app.example.org/callback")
@ -51,11 +39,7 @@ class OAuthTest < ActionDispatch::IntegrationTest
client = create(:client_application, :allow_read_prefs => true, :allow_write_api => true, :allow_read_gpx => true) client = create(:client_application, :allow_read_prefs => true, :allow_write_api => true, :allow_read_gpx => true)
user = create(:user) user = create(:user)
get "/login" session_for(user)
follow_redirect!
post "/login", :params => { :username => user.email, :password => "test" }
follow_redirect!
assert_response :success
oauth10a_without_callback(client) oauth10a_without_callback(client)
oauth10a_refused(client) oauth10a_refused(client)
@ -99,12 +83,16 @@ class OAuthTest < ActionDispatch::IntegrationTest
assert_nil token.invalidated_at assert_nil token.invalidated_at
assert_allowed token, [:allow_read_prefs] assert_allowed token, [:allow_read_prefs]
post logout_path
signed_get "/api/0.6/user/preferences", :oauth => { :token => token } signed_get "/api/0.6/user/preferences", :oauth => { :token => token }
assert_response :success assert_response :success
signed_get "/api/0.6/gpx/2", :oauth => { :token => token } signed_get "/api/0.6/gpx/2", :oauth => { :token => token }
assert_response :forbidden assert_response :forbidden
session_for(token.user)
post "/oauth/revoke", :params => { :token => token.token } post "/oauth/revoke", :params => { :token => token.token }
assert_redirected_to oauth_clients_url(token.user.display_name) assert_redirected_to oauth_clients_url(token.user.display_name)
token = OauthToken.find_by(:token => token.token) token = OauthToken.find_by(:token => token.token)
@ -177,6 +165,8 @@ class OAuthTest < ActionDispatch::IntegrationTest
assert_nil token.invalidated_at assert_nil token.invalidated_at
assert_allowed token, [:allow_write_api, :allow_read_gpx] assert_allowed token, [:allow_write_api, :allow_read_gpx]
post logout_path
trace = create(:trace, :user => token.user) trace = create(:trace, :user => token.user)
signed_get "/api/0.6/gpx/#{trace.id}", :oauth => { :token => token } signed_get "/api/0.6/gpx/#{trace.id}", :oauth => { :token => token }
assert_response :success assert_response :success
@ -184,6 +174,8 @@ class OAuthTest < ActionDispatch::IntegrationTest
signed_get "/api/0.6/user/details", :oauth => { :token => token } signed_get "/api/0.6/user/details", :oauth => { :token => token }
assert_response :forbidden assert_response :forbidden
session_for(token.user)
post "/oauth/revoke", :params => { :token => token.token } post "/oauth/revoke", :params => { :token => token.token }
assert_redirected_to oauth_clients_url(token.user.display_name) assert_redirected_to oauth_clients_url(token.user.display_name)
token = OauthToken.find_by(:token => token.token) token = OauthToken.find_by(:token => token.token)
@ -236,6 +228,8 @@ class OAuthTest < ActionDispatch::IntegrationTest
assert_nil token.invalidated_at assert_nil token.invalidated_at
assert_allowed token, [:allow_read_prefs] assert_allowed token, [:allow_read_prefs]
post logout_path
signed_get "/api/0.6/user/preferences", :oauth => { :token => token } signed_get "/api/0.6/user/preferences", :oauth => { :token => token }
assert_response :success assert_response :success
@ -243,6 +237,8 @@ class OAuthTest < ActionDispatch::IntegrationTest
signed_get "/api/0.6/gpx/#{trace.id}", :oauth => { :token => token } signed_get "/api/0.6/gpx/#{trace.id}", :oauth => { :token => token }
assert_response :forbidden assert_response :forbidden
session_for(token.user)
post "/oauth/revoke", :params => { :token => token.token } post "/oauth/revoke", :params => { :token => token.token }
assert_redirected_to oauth_clients_url(token.user.display_name) assert_redirected_to oauth_clients_url(token.user.display_name)
token = OauthToken.find_by(:token => token.token) token = OauthToken.find_by(:token => token.token)
@ -287,6 +283,8 @@ class OAuthTest < ActionDispatch::IntegrationTest
assert_nil token.invalidated_at assert_nil token.invalidated_at
assert_allowed token, [:allow_write_api, :allow_read_gpx] assert_allowed token, [:allow_write_api, :allow_read_gpx]
post logout_path
trace = create(:trace, :user => token.user) trace = create(:trace, :user => token.user)
signed_get "/api/0.6/gpx/#{trace.id}", :oauth => { :token => token } signed_get "/api/0.6/gpx/#{trace.id}", :oauth => { :token => token }
assert_response :success assert_response :success
@ -294,6 +292,8 @@ class OAuthTest < ActionDispatch::IntegrationTest
signed_get "/api/0.6/user/details", :oauth => { :token => token } signed_get "/api/0.6/user/details", :oauth => { :token => token }
assert_response :forbidden assert_response :forbidden
session_for(token.user)
post "/oauth/revoke", :params => { :token => token.token } post "/oauth/revoke", :params => { :token => token.token }
assert_redirected_to oauth_clients_url(token.user.display_name) assert_redirected_to oauth_clients_url(token.user.display_name)
token = OauthToken.find_by(:token => token.token) token = OauthToken.find_by(:token => token.token)