Basic Setup scripts

.gitignore

@@ -8,3 +8,5 @@ erl_crash.dump
 /tmp
 .DS_Store
 /.elixir_ls
+.tool-versions
+/priv/pg_data

CONTRIBUTING.md

@@ -0,0 +1,43 @@
+
+# install deps
+
+mix deps.get
+mix deps.compile
+
+
+
+# setup postgresql 
+
+ Running postgresql via Docker can make setting up tests simple.
+
+ However because postgresql is run inside the docker host, any connections to it invoke
+ the access control file "pg_hba.conf"
+
+ A simple way to set docker postgresql up for tests is to use the below script
+ and then stop the script, modifiy the pg_hba.conf and then restart the script.
+
+ This is fine for development but no production machine should trust any user incoming.
+
+ 1) start postgres via script (will download and run image)
+    ```
+    dev/postgres.zsh
+    ```
+ 2) stop the script (CTRL-C)
+ 3) change last line of priv/pg_data/pg_hba.conf to "host all all all trust"
+ 4) restart postgres via script
+    ```
+    dev/postgres.zsh
+    ```
+
+# running tests
+
+
+```
+mix clean && mix test
+```
+
+
+UUID test needs clean compilation.
+```
+mix clean && UUID=1 mix tes
+```

README.md

@@ -293,6 +293,21 @@ You'll need to create the migration file and schema modules with the argument `-
 mix ex_oauth2_provider.install --binary-id
 ```
 
+## Development 
+
+Starting postgrest for test
+( one will need to modify the pg_hba.conf after booting postges for the first time)
+( notes are in the script below )
+```bash
+./postgres.zsh
+```
+
+Testing binary_id
+```bash
+mix clean && UUID=1 mix test
+```
+
+
 ## Acknowledgement
 
 This library was made thanks to [doorkeeper](https://github.com/doorkeeper-gem/doorkeeper), [guardian](https://github.com/ueberauth/guardian) and [authable](https://github.com/mustafaturan/authable), that gave the conceptual building blocks.

dev/postgres.zsh

@@ -0,0 +1,8 @@
+#!/usr/bin/env zsh
+SCRIPT_DIR=$0:a:h
+DATA_DIR=$SCRIPT_DIR/../priv/pg_data
+PG_NAME=postgres-oauth2-provider
+mkdir -p $DATA_DIR
+docker stop $PG_NAME
+docker run --rm  --name $PG_NAME -e POSTGRES_USER=$USER -e POSTGRES_PASSWORD=secret -p 5432:5432 -v $DATA_DIR:/var/lib/postgresql/data  postgres
+

test/ex_oauth2_provider/oauth2/authorization/strategy/code_test.exs

@@ -6,7 +6,7 @@ defmodule ExOauth2Provider.Authorization.CodeTest do
   alias Dummy.{OauthAccessGrants.OauthAccessGrant, Repo}
 
   @client_id                "Jf5rM8hQBc"
-  @valid_request            %{"client_id" => @client_id, "response_type" => "code", "scope" => "app:read app:write"}
+  @valid_request            %{"client_id" => @client_id, "response_type" => "code"}
   @invalid_request          %{error: :invalid_request,
                               error_description: "The request is missing a required parameter, includes an unsupported parameter value, or is otherwise malformed."
                             }
@@ -83,6 +83,12 @@ defmodule ExOauth2Provider.Authorization.CodeTest do
       %{resource_owner: resource_owner, application: application}
     end
 
+    test "with no scope", %{resource_owner: resource_owner, application: application} do
+      request = Map.delete(@valid_request, "scope")
+
+      assert Authorization.preauthorize(resource_owner, request, otp_app: :ex_oauth2_provider) == {:ok, application, []}
+    end
+
     test "with limited server scope", %{resource_owner: resource_owner, application: application} do
       request = Map.merge(@valid_request, %{"scope" => "read"})
 
@@ -134,12 +140,20 @@ defmodule ExOauth2Provider.Authorization.CodeTest do
       %{resource_owner: resource_owner, application: application}
     end
 
+    test "generates grant with no scope passed", %{resource_owner: resource_owner} do
+      request = Map.delete(@valid_request, "scope")
+      assert {:native_redirect, %{code: code}} = Authorization.authorize(resource_owner, request, otp_app: :ex_oauth2_provider)
+
+      access_grant = Repo.get_by(OauthAccessGrant, token: code)
+      assert access_grant.resource_owner_id == resource_owner.id
+    end
+
     test "error when invalid server scope", %{resource_owner: resource_owner} do
       request = Map.merge(@valid_request, %{"scope" => "public profile"})
       assert Authorization.authorize(resource_owner, request, otp_app: :ex_oauth2_provider) == {:error, @invalid_scope, :unprocessable_entity}
     end
 
-    test "generates grant", %{resource_owner: resource_owner} do
+    test "generates grant with public scope", %{resource_owner: resource_owner} do
       request = Map.merge(@valid_request, %{"scope" => "public"})
       assert {:native_redirect, %{code: code}} = Authorization.authorize(resource_owner, request, otp_app: :ex_oauth2_provider)
 
@@ -160,7 +174,7 @@ defmodule ExOauth2Provider.Authorization.CodeTest do
 
     assert access_grant.resource_owner_id == resource_owner.id
     assert access_grant.expires_in == Config.authorization_code_expires_in(otp_app: :ex_oauth2_provider)
-    assert access_grant.scopes == @valid_request["scope"]
+    assert access_grant.scopes == ""
   end
 
   test "#authorize/3 generates grant with redirect uri", %{resource_owner: resource_owner, application: application} do