QT/sure
1
0
Fork 0
mirror of https://github.com/we-promise/sure.git synced 2026-05-10 06:05:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Reject revoked OAuth tokens in API auth (#1711)

Browse Source
This commit is contained in:
Juan José Mata
2026-05-09 01:39:10 +02:00
committed by GitHub
parent 8abecf8a8d
commit b74014ab42
2 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
test/controllers/api/v1/base_controller_test.rb
View File

@@ -60,6 +60,23 @@ class Api::V1::BaseControllerTest < ActionDispatch::IntegrationTest
assert_equal @user.email, response_body["user"]
end
test "should reject revoked access token" do
access_token = Doorkeeper::AccessToken.create!(
application: @oauth_app,
resource_owner_id: @user.id,
scopes: "read"
)
access_token.revoke
get "/api/v1/test", params: {}, headers: {
"Authorization" => "Bearer #{access_token.token}"
}
assert_response :unauthorized
response_body = JSON.parse(response.body)
assert_equal "unauthorized", response_body["error"]
end
test "should reject invalid access token" do
get "/api/v1/test", params: {}, headers: {
"Authorization" => "Bearer invalid_token"