omniauth--omniauth/spec/omniauth/strategy_spec.rb

require 'helper'

def make_env(path = '/auth/test', props = {})
  {
    'REQUEST_METHOD' => 'GET',
    'PATH_INFO' => path,
    'rack.session' => {},
    'rack.input' => StringIO.new('test=true')
  }.merge(props)
end

describe OmniAuth::Strategy do
  let(:app){ lambda{|env| [404, {}, ['Awesome']]}}
  let(:fresh_strategy){ c = Class.new; c.send :include, OmniAuth::Strategy; c}

  describe ".default_options" do
    it "is inherited from a parent class" do
      superklass = Class.new
      superklass.send :include, OmniAuth::Strategy
      superklass.configure do |c|
        c.foo = 'bar'
      end

      klass = Class.new(superklass)
      expect(klass.default_options.foo).to eq('bar')
    end
  end

  describe ".configure" do
    subject { klass = Class.new; klass.send :include, OmniAuth::Strategy; klass }
    context "when block is passed" do
      it "allows for default options setting" do
        subject.configure do |c|
          c.wakka = 'doo'
        end
        expect(subject.default_options["wakka"]).to eq("doo")
      end

      it "works when block doesn't evaluate to true" do
        environment_variable = nil
        subject.configure do |c|
          c.abc = '123'
          c.hgi = environment_variable
        end
        expect(subject.default_options["abc"]).to eq("123")
      end
    end

    it "takes a hash and deep merge it" do
      subject.configure :abc => {:def => 123}
      subject.configure :abc => {:hgi => 456}
      expect(subject.default_options['abc']).to eq({'def' => 123, 'hgi' => 456})
    end
  end

  describe "#skip_info?" do
    it "is true if options.skip_info is true" do
      expect(ExampleStrategy.new(app, :skip_info => true)).to be_skip_info
    end

    it "is false if options.skip_info is false" do
      expect(ExampleStrategy.new(app, :skip_info => false)).not_to be_skip_info
    end

    it "is false by default" do
      expect(ExampleStrategy.new(app)).not_to be_skip_info
    end

    it "is true if options.skip_info is a callable that evaluates to truthy" do
      instance = ExampleStrategy.new(app, :skip_info => lambda{|uid| uid})
      instance.should_receive(:uid).and_return(true)
      expect(instance).to be_skip_info
    end
  end

  describe ".option" do
    subject { klass = Class.new; klass.send :include, OmniAuth::Strategy; klass }
    it "sets a default value" do
      subject.option :abc, 123
      expect(subject.default_options.abc).to eq(123)
    end

    it "sets the default value to nil if none is provided" do
      subject.option :abc
      expect(subject.default_options.abc).to be_nil
    end
  end

  describe ".args" do
    subject{ c = Class.new; c.send :include, OmniAuth::Strategy; c }
    it "sets args to the specified argument if there is one" do
      subject.args [:abc, :def]
      expect(subject.args).to eq([:abc, :def])
    end

    it "is inheritable" do
      subject.args [:abc, :def]
      c = Class.new(subject)
      expect(c.args).to eq([:abc, :def])
    end
  end

  context "fetcher procs" do
    subject{ fresh_strategy }
    %w(uid info credentials extra).each do |fetcher|
      describe ".#{fetcher}" do
        it "sets and retrieve a proc" do
          proc = lambda{ "Hello" }
          subject.send(fetcher, &proc)
          expect(subject.send(fetcher)).to eq(proc)
        end
      end
    end
  end

  context "fetcher stacks" do
    subject{ fresh_strategy }
    %w(uid info credentials extra).each do |fetcher|
      describe ".#{fetcher}_stack" do
        it "is an array of called ancestral procs" do
          fetchy = Proc.new{ "Hello" }
          subject.send(fetcher, &fetchy)
          expect(subject.send("#{fetcher}_stack", subject.new(app))).to eq(["Hello"])
        end
      end
    end
  end

  %w(request_phase).each do |abstract_method|
    context "#{abstract_method}" do
      it "raises a NotImplementedError" do
        strat = Class.new
        strat.send :include, OmniAuth::Strategy
        expect{strat.new(app).send(abstract_method) }.to raise_error(NotImplementedError)
      end
    end
  end

  describe "#auth_hash" do
    subject do
      klass = Class.new
      klass.send :include, OmniAuth::Strategy
      klass.option :name, 'auth_hasher'
      klass
    end
    let(:instance){ subject.new(app) }

    it "calls through to uid and info" do
      instance.should_receive :uid
      instance.should_receive :info
      instance.auth_hash
    end

    it "returns an AuthHash" do
      instance.stub!(:uid).and_return('123')
      instance.stub!(:info).and_return(:name => 'Hal Awesome')
      hash = instance.auth_hash
      expect(hash).to be_kind_of(OmniAuth::AuthHash)
      expect(hash.uid).to eq('123')
      expect(hash.info.name).to eq('Hal Awesome')
    end
  end

  describe "#initialize" do
    context "options extraction" do
      it "is the last argument if the last argument is a Hash" do
        expect(ExampleStrategy.new(app, :abc => 123).options[:abc]).to eq(123)
      end

      it "is the default options if any are provided" do
        ExampleStrategy.stub!(:default_options).and_return(OmniAuth::Strategy::Options.new(:abc => 123))
        expect(ExampleStrategy.new(app).options.abc).to eq(123)
      end
    end

    context "custom args" do
      subject{ c = Class.new; c.send :include, OmniAuth::Strategy; c }
      it "sets options based on the arguments if they are supplied" do
        subject.args [:abc, :def]
        s = subject.new app, 123, 456
        expect(s.options[:abc]).to eq(123)
        expect(s.options[:def]).to eq(456)
      end
    end
  end

  describe "#call" do
    it "duplicates and calls" do
      klass = Class.new
      klass.send :include, OmniAuth::Strategy
      instance = klass.new(app)
      instance.should_receive(:dup).and_return(instance)
      instance.call({'rack.session' => {}})
    end
  end

  describe "#inspect" do
    it "returns the class name" do
      expect(ExampleStrategy.new(app).inspect).to eq('#<ExampleStrategy>')
    end
  end

  describe "#redirect" do
    it "uses javascript if :iframe is true" do
      response = ExampleStrategy.new(app, :iframe => true).redirect("http://abc.com")
      expect(response.last.body.first).to be_include("top.location.href")
    end
  end

  describe "#callback_phase" do
    subject{ k = Class.new; k.send :include, OmniAuth::Strategy; k.new(app) }

    it "sets the auth hash" do
      env = make_env
      subject.stub!(:env).and_return(env)
      subject.stub!(:auth_hash).and_return("AUTH HASH")
      subject.callback_phase
      expect(env['omniauth.auth']).to eq("AUTH HASH")
    end
  end

  describe "#full_host" do
    let(:strategy){ ExampleStrategy.new(app, {}) }
    it "remains calm when there is a pipe in the URL" do
      strategy.call!(make_env('/whatever', 'rack.url_scheme' => 'http', 'SERVER_NAME' => 'facebook.lame', 'QUERY_STRING' => 'code=asofibasf|asoidnasd', 'SCRIPT_NAME' => '', 'SERVER_PORT' => 80))
      expect{strategy.full_host }.not_to raise_error
    end
  end

  describe "#uid" do
    subject{ fresh_strategy }
    it "is the current class's uid if one exists" do
      subject.uid{ "Hi" }
      expect(subject.new(app).uid).to eq("Hi")
    end

    it "inherits if it can" do
      subject.uid{ "Hi" }
      c = Class.new(subject)
      expect(c.new(app).uid).to eq("Hi")
    end
  end

  %w(info credentials extra).each do |fetcher|
    subject{ fresh_strategy }
    it "is the current class's proc call if one exists" do
      subject.send(fetcher){ {:abc => 123} }
      expect(subject.new(app).send(fetcher)).to eq({:abc => 123})
    end

    it "inherits by merging with preference for the latest class" do
      subject.send(fetcher){ {:abc => 123, :def => 456} }
      c = Class.new(subject)
      c.send(fetcher){ {:abc => 789} }
      expect(c.new(app).send(fetcher)).to eq({:abc => 789, :def => 456})
    end
  end

  describe "#call" do
    before(:all) do
      @options = nil
    end

    let(:strategy){ ExampleStrategy.new(app, @options || {}) }

    context "omniauth.origin" do
      it "is set on the request phase" do
        expect{strategy.call(make_env('/auth/test', 'HTTP_REFERER' => 'http://example.com/origin')) }.to raise_error("Request Phase")
        expect(strategy.last_env['rack.session']['omniauth.origin']).to eq('http://example.com/origin')
      end

      it "is turned into an env variable on the callback phase" do
        expect{strategy.call(make_env('/auth/test/callback', 'rack.session' => {'omniauth.origin' => 'http://example.com/origin'})) }.to raise_error("Callback Phase")
        expect(strategy.last_env['omniauth.origin']).to eq('http://example.com/origin')
      end

      it "sets from the params if provided" do
        expect{strategy.call(make_env('/auth/test', 'QUERY_STRING' => 'origin=/foo')) }.to raise_error('Request Phase')
        expect(strategy.last_env['rack.session']['omniauth.origin']).to eq('/foo')
      end

      it "is set on the failure env" do
        OmniAuth.config.should_receive(:on_failure).and_return(lambda{|env| env})
        @options = {:failure => :forced_fail}
        strategy.call(make_env('/auth/test/callback', 'rack.session' => {'omniauth.origin' => '/awesome'}))
      end

      context "with script_name" do
        it "is set on the request phase, containing full path" do
          env = {'HTTP_REFERER' => 'http://example.com/sub_uri/origin', 'SCRIPT_NAME' => '/sub_uri' }
          expect{strategy.call(make_env('/auth/test', env)) }.to raise_error("Request Phase")
          expect(strategy.last_env['rack.session']['omniauth.origin']).to eq('http://example.com/sub_uri/origin')
        end

        it "is turned into an env variable on the callback phase, containing full path" do
          env = {
            'rack.session' => {'omniauth.origin' => 'http://example.com/sub_uri/origin'},
            'SCRIPT_NAME' => '/sub_uri'
          }

          expect{strategy.call(make_env('/auth/test/callback', env)) }.to raise_error("Callback Phase")
          expect(strategy.last_env['omniauth.origin']).to eq('http://example.com/sub_uri/origin')
        end

      end
    end

    context "default paths" do
      it "uses the default request path" do
        expect{strategy.call(make_env) }.to raise_error("Request Phase")
      end

      it "is case insensitive on request path" do
        expect{strategy.call(make_env('/AUTH/Test'))}.to raise_error("Request Phase")
      end

      it "is case insensitive on callback path" do
        expect{strategy.call(make_env('/AUTH/TeSt/CaLlBAck'))}.to raise_error("Callback Phase")
      end

      it "uses the default callback path" do
        expect{strategy.call(make_env('/auth/test/callback')) }.to raise_error("Callback Phase")
      end

      it "strips trailing spaces on request" do
        expect{strategy.call(make_env('/auth/test/')) }.to raise_error("Request Phase")
      end

      it "strips trailing spaces on callback" do
        expect{strategy.call(make_env('/auth/test/callback/')) }.to raise_error("Callback Phase")
      end

      context "callback_url" do
        it "uses the default callback_path" do
          strategy.should_receive(:full_host).and_return('http://example.com')

          expect{strategy.call(make_env) }.to raise_error("Request Phase")

          expect(strategy.callback_url).to eq('http://example.com/auth/test/callback')
        end

        it "preserves the query parameters" do
          strategy.stub(:full_host).and_return('http://example.com')
          begin
            strategy.call(make_env('/auth/test', 'QUERY_STRING' => 'id=5'))
          rescue RuntimeError; end
          expect(strategy.callback_url).to eq('http://example.com/auth/test/callback?id=5')
        end

        it "consider script name" do
          strategy.stub(:full_host).and_return('http://example.com')
          begin
            strategy.call(make_env('/auth/test', 'SCRIPT_NAME' => '/sub_uri'))
          rescue RuntimeError; end
          expect(strategy.callback_url).to eq('http://example.com/sub_uri/auth/test/callback')
        end
      end
    end

    context ":form option" do
      it "calls through to the supplied form option if one exists" do
        strategy.options.form = lambda{|env| "Called me!"}
        expect(strategy.call(make_env('/auth/test'))).to eq("Called me!")
      end

      it "calls through to the app if :form => true is set as an option" do
        strategy.options.form = true
        expect(strategy.call(make_env('/auth/test'))).to eq(app.call(make_env('/auth/test')))
      end
    end

    context "dynamic paths" do
      it "runs the request phase if the custom request path evaluator is truthy" do
        @options = {:request_path => lambda{|env| true}}
        expect{strategy.call(make_env('/asoufibasfi')) }.to raise_error("Request Phase")
      end

      it "runs the callback phase if the custom callback path evaluator is truthy" do
        @options = {:callback_path => lambda{|env| true}}
        expect{strategy.call(make_env('/asoufiasod')) }.to raise_error("Callback Phase")
      end

      it "provides a custom callback path if request_path evals to a string" do
        strategy_instance = fresh_strategy.new(nil, :request_path => lambda{|env| "/auth/boo/callback/22" })
        expect(strategy_instance.callback_path).to eq('/auth/boo/callback/22')
      end

      it "correctly reports the callback path when the custom callback path evaluator is truthy" do
        strategy_instance = ExampleStrategy.new(app,
          :callback_path => lambda{|env| env['PATH_INFO'] == "/auth/bish/bosh/callback"}
        )

        expect{strategy_instance.call(make_env('/auth/bish/bosh/callback')) }.to raise_error("Callback Phase")
        expect(strategy_instance.callback_path).to eq('/auth/bish/bosh/callback')
      end
    end

    context "custom paths" do
      it "uses a custom request_path if one is provided" do
        @options = {:request_path => '/awesome'}
        expect{strategy.call(make_env('/awesome')) }.to raise_error("Request Phase")
      end

      it "uses a custom callback_path if one is provided" do
        @options = {:callback_path => '/radical'}
        expect{strategy.call(make_env('/radical')) }.to raise_error("Callback Phase")
      end

      context "callback_url" do
        it "uses a custom callback_path if one is provided" do
          @options = {:callback_path => '/radical'}
          strategy.should_receive(:full_host).and_return('http://example.com')

          expect{strategy.call(make_env('/radical')) }.to raise_error("Callback Phase")

          expect(strategy.callback_url).to eq('http://example.com/radical')
        end

        it "preserves the query parameters" do
          @options = {:callback_path => '/radical'}
          strategy.stub(:full_host).and_return('http://example.com')
          begin
            strategy.call(make_env('/auth/test', 'QUERY_STRING' => 'id=5'))
          rescue RuntimeError; end
          expect(strategy.callback_url).to eq('http://example.com/radical?id=5')
        end
      end
    end

    context "custom prefix" do
      before do
        @options = {:path_prefix => '/wowzers'}
      end

      it "uses a custom prefix for request" do
        expect{strategy.call(make_env('/wowzers/test')) }.to raise_error("Request Phase")
      end

      it "uses a custom prefix for callback" do
        expect{strategy.call(make_env('/wowzers/test/callback')) }.to raise_error("Callback Phase")
      end

      context "callback_url" do
        it "uses a custom prefix" do
          strategy.should_receive(:full_host).and_return('http://example.com')

          expect{strategy.call(make_env('/wowzers/test')) }.to raise_error("Request Phase")

          expect(strategy.callback_url).to eq('http://example.com/wowzers/test/callback')
        end

        it "preserves the query parameters" do
          strategy.stub(:full_host).and_return('http://example.com')
          begin
            strategy.call(make_env('/auth/test', 'QUERY_STRING' => 'id=5'))
          rescue RuntimeError; end
          expect(strategy.callback_url).to eq('http://example.com/wowzers/test/callback?id=5')
        end
      end
    end

    context "request method restriction" do
      before do
        OmniAuth.config.allowed_request_methods = [:post]
      end

      it "does not allow a request method of the wrong type" do
        expect{strategy.call(make_env)}.not_to raise_error
      end

      it "allows a request method of the correct type" do
        expect{strategy.call(make_env('/auth/test', 'REQUEST_METHOD' => 'POST'))}.to raise_error("Request Phase")
      end

      after do
        OmniAuth.config.allowed_request_methods = [:get, :post]
      end
    end

    context "receiving an OPTIONS request" do
      shared_examples_for "an OPTIONS request" do
        it "responds with 200" do
          expect(response[0]).to eq(200)
        end

        it "sets the Allow header properly" do
          expect(response[1]['Allow']).to eq("GET, POST")
        end
      end

      context "to the request path" do
        let(:response) { strategy.call(make_env('/auth/test', 'REQUEST_METHOD' => 'OPTIONS')) }
        it_behaves_like "an OPTIONS request"
      end

      context "to the request path" do
        let(:response) { strategy.call(make_env('/auth/test/callback', 'REQUEST_METHOD' => 'OPTIONS')) }
        it_behaves_like "an OPTIONS request"
      end

      context "to some other path" do
        it "does not short-circuit the request" do
          env = make_env('/other', 'REQUEST_METHOD' => 'OPTIONS')
          expect(strategy.call(env)).to eq(app.call(env))
        end
      end
    end

    context "test mode" do
      let(:app) do
        # In test mode, the underlying app shouldn't be called on request phase.
        lambda { |env| [404, {"Content-Type" => "text/html"}, []] }
      end

      before do
        OmniAuth.config.test_mode = true
      end

      it "short circuits the request phase entirely" do
        response = strategy.call(make_env)
        expect(response[0]).to eq(302)
        expect(response[1]['Location']).to eq('/auth/test/callback')
      end

      it "is case insensitive on request path" do
        expect(strategy.call(make_env('/AUTH/Test'))[0]).to eq(302)
      end

      it "respects SCRIPT_NAME (a.k.a. BaseURI)" do
        response = strategy.call(make_env('/auth/test', 'SCRIPT_NAME' => '/sub_uri'))
        expect(response[1]['Location']).to eq('/sub_uri/auth/test/callback')
      end

      it "redirects on failure" do
        response = OmniAuth.config.on_failure.call(make_env('/auth/test', 'omniauth.error.type' => 'error'))
        expect(response[0]).to eq(302)
        expect(response[1]['Location']).to eq('/auth/failure?message=error')
      end

      it "respects SCRIPT_NAME (a.k.a. BaseURI) on failure" do
        response = OmniAuth.config.on_failure.call(make_env('/auth/test', 'SCRIPT_NAME' => '/sub_uri', 'omniauth.error.type' => 'error'))
        expect(response[0]).to eq(302)
        expect(response[1]['Location']).to eq('/sub_uri/auth/failure?message=error')
      end

      it "is case insensitive on callback path" do
        expect(strategy.call(make_env('/AUTH/TeSt/CaLlBAck')).first).to eq(strategy.call(make_env('/auth/test/callback')).first)
      end

      it "maintains query string parameters" do
        response = strategy.call(make_env('/auth/test', 'QUERY_STRING' => 'cheese=stilton'))
        expect(response[1]['Location']).to eq('/auth/test/callback?cheese=stilton')
      end

      it "does not short circuit requests outside of authentication" do
        expect(strategy.call(make_env('/'))).to eq(app.call(make_env('/')))
      end

      it "responds with the default hash if none is set" do
        OmniAuth.config.mock_auth[:test] = nil

        strategy.call make_env('/auth/test/callback')
        expect(strategy.env['omniauth.auth']['uid']).to eq('1234')
      end

      it "responds with a provider-specific hash if one is set" do
        OmniAuth.config.mock_auth[:test] = {
          'uid' => 'abc'
        }

        strategy.call make_env('/auth/test/callback')
        expect(strategy.env['omniauth.auth']['uid']).to eq('abc')
      end

      it "simulates login failure if mocked data is set as a symbol" do
        OmniAuth.config.mock_auth[:test] = :invalid_credentials

        strategy.call make_env('/auth/test/callback')
        expect(strategy.env['omniauth.error.type']).to eq(:invalid_credentials)
      end

      it "sets omniauth.origin on the request phase" do
        strategy.call(make_env('/auth/test', 'HTTP_REFERER' => 'http://example.com/origin'))
        expect(strategy.env['rack.session']['omniauth.origin']).to eq('http://example.com/origin')
      end

      it "sets omniauth.origin from the params if provided" do
        strategy.call(make_env('/auth/test', 'QUERY_STRING' => 'origin=/foo'))
        expect(strategy.env['rack.session']['omniauth.origin']).to eq('/foo')
      end

      it "turns omniauth.origin into an env variable on the callback phase" do
        OmniAuth.config.mock_auth[:test] = {}

        strategy.call(make_env('/auth/test/callback', 'rack.session' => {'omniauth.origin' => 'http://example.com/origin'}))
        expect(strategy.env['omniauth.origin']).to eq('http://example.com/origin')
      end

      it "sets omniauth.params on the request phase" do
        OmniAuth.config.mock_auth[:test] = {}

        strategy.call(make_env('/auth/test', 'QUERY_STRING' => 'foo=bar'))
        expect(strategy.env['rack.session']['omniauth.params']).to eq({'foo' => 'bar'})
      end

      it "turns omniauth.params into an env variable on the callback phase" do
        OmniAuth.config.mock_auth[:test] = {}

        strategy.call(make_env('/auth/test/callback', 'rack.session' => {'omniauth.params' => {'foo' => 'bar'}}))
        expect(strategy.env['omniauth.params']).to eq({'foo' => 'bar'})
      end

      after do
        OmniAuth.config.test_mode = false
      end
    end

    context "custom full_host" do
      before do
        OmniAuth.config.test_mode = true
      end

      it "is the string when a string is there" do
        OmniAuth.config.full_host = 'my.host.com'
        expect(strategy.full_host).to eq('my.host.com')
      end

      it "runs the proc with the env when it is a proc" do
        OmniAuth.config.full_host = Proc.new{|env| env['HOST']}
        strategy.call(make_env('/auth/test', 'HOST' => 'my.host.net'))
        expect(strategy.full_host).to eq('my.host.net')
      end

      it "is based on the request if it's not a string nor a proc" do
        OmniAuth.config.full_host = nil
        strategy.call(make_env('/whatever', 'rack.url_scheme' => 'http', 'SERVER_NAME' => 'my.host.net', 'SERVER_PORT' => 80))
        expect(strategy.full_host).to eq('http://my.host.net')
      end

      it "should honor HTTP_X_FORWARDED_PROTO if present" do
        OmniAuth.config.full_host = nil
        strategy.call(make_env('/whatever', 'HTTP_X_FORWARDED_PROTO' => 'https','rack.url_scheme' => 'http', 'SERVER_NAME' => 'my.host.net', 'SERVER_PORT' => 443))
        expect(strategy.full_host).to eq('https://my.host.net')
      end

      after do
        OmniAuth.config.test_mode = false
      end
    end
  end

  context "setup phase" do
    before do
      OmniAuth.config.test_mode = true
    end

    context "when options[:setup] = true" do
      let(:strategy){ ExampleStrategy.new(app, :setup => true) }
      let(:app){lambda{|env| env['omniauth.strategy'].options[:awesome] = 'sauce' if env['PATH_INFO'] == '/auth/test/setup'; [404, {}, 'Awesome'] }}

      it "calls through to /auth/:provider/setup" do
        strategy.call(make_env('/auth/test'))
        expect(strategy.options[:awesome]).to eq('sauce')
      end

      it "does not call through on a non-omniauth endpoint" do
        strategy.call(make_env('/somewhere/else'))
        expect(strategy.options[:awesome]).not_to eq('sauce')
      end
    end

    context "when options[:setup] is an app" do
      let(:setup_proc) do
        Proc.new do |env|
          env['omniauth.strategy'].options[:awesome] = 'sauce'
        end
      end

      let(:strategy){ ExampleStrategy.new(app, :setup => setup_proc) }

      it "does not call the app on a non-omniauth endpoint" do
        strategy.call(make_env('/somehwere/else'))
        expect(strategy.options[:awesome]).not_to eq('sauce')
      end

      it "calls the rack app" do
        strategy.call(make_env('/auth/test'))
        expect(strategy.options[:awesome]).to eq('sauce')
      end
    end

    after do
      OmniAuth.config.test_mode = false
    end
  end
end