Test OAuth token scope verification in the `API::Users` endpoint

spec/requests/api/helpers_spec.rb

@@ -14,7 +14,9 @@ describe API::Helpers do
   let(:request) { Rack::Request.new(env) }
   let(:header) { }
 
-  before { allow_any_instance_of(self.class).to receive(:options).and_return({}) }
+  before do
+    allow_any_instance_of(self.class).to receive(:options).and_return({})
+  end
 
   def set_env(user_or_token, identifier)
     clear_env

spec/support/api/scopes/read_user_shared_examples.rb

 shared_examples_for 'allows the "read_user" scope' do
-  describe 'when the requesting token has the "read_user" scope' do
+  context 'for personal access tokens' do
+    context 'when the requesting token has the "api" scope' do
+      let(:token) { create(:personal_access_token, scopes: ['api'], user: user) }
+
+      it 'returns a "200" response' do
+        get api_call.call(path, user, personal_access_token: token)
+
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    context 'when the requesting token has the "read_user" scope' do
       let(:token) { create(:personal_access_token, scopes: ['read_user'], user: user) }
 
       it 'returns a "200" response' do
@@ -9,7 +20,7 @@ shared_examples_for 'allows the "read_user" scope' do
       end
     end
 
-  describe 'when the requesting token does not have any required scope' do
+    context 'when the requesting token does not have any required scope' do
       let(:token) { create(:personal_access_token, scopes: ['read_registry'], user: user) }
 
       it 'returns a "401" response' do
@@ -18,6 +29,42 @@ shared_examples_for 'allows the "read_user" scope' do
         expect(response).to have_http_status(401)
       end
     end
+  end
+
+  context 'for doorkeeper (OAuth) tokens' do
+    let!(:user) {create(:user)}
+    let!(:application) { Doorkeeper::Application.create!(name: "MyApp", redirect_uri: "https://app.com", owner: user) }
+
+    context 'when the requesting token has the "api" scope' do
+      let!(:token) { Doorkeeper::AccessToken.create! application_id: application.id, resource_owner_id: user.id, scopes: "api" }
+
+      it 'returns a "200" response' do
+        get api_call.call(path, user, oauth_access_token: token)
+
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    context 'when the requesting token has the "read_user" scope' do
+      let!(:token) { Doorkeeper::AccessToken.create! application_id: application.id, resource_owner_id: user.id, scopes: "read_user" }
+
+      it 'returns a "200" response' do
+        get api_call.call(path, user, oauth_access_token: token)
+
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    context 'when the requesting token does not have any required scope' do
+      let!(:token) { Doorkeeper::AccessToken.create! application_id: application.id, resource_owner_id: user.id, scopes: "invalid" }
+
+      it 'returns a "403" response' do
+        get api_call.call(path, user, oauth_access_token: token)
+
+        expect(response).to have_http_status(403)
+      end
+    end
+  end
 end
 
 shared_examples_for 'does not allow the "read_user" scope' do

spec/support/api_helpers.rb

@@ -17,7 +17,7 @@ module ApiHelpers
   #   => "/api/v2/issues?foo=bar&private_token=..."
   #
   # Returns the relative path to the requested API resource
-  def api(path, user = nil, version: API::API.version, personal_access_token: nil)
+  def api(path, user = nil, version: API::API.version, personal_access_token: nil, oauth_access_token: nil)
     "/api/#{version}#{path}" +
 
       # Normalize query string
@@ -25,6 +25,8 @@ module ApiHelpers
 
       if personal_access_token.present?
         "&private_token=#{personal_access_token.token}"
+      elsif oauth_access_token.present?
+        "&access_token=#{oauth_access_token.token}"
       # Append private_token if given a User object
       elsif user.respond_to?(:private_token)
         "&private_token=#{user.private_token}"
@@ -34,8 +36,14 @@ module ApiHelpers
   end
 
   # Temporary helper method for simplifying V3 exclusive API specs
-  def v3_api(path, user = nil, personal_access_token: nil)
-    api(path, user, version: 'v3', personal_access_token: personal_access_token)
+  def v3_api(path, user = nil, personal_access_token: nil, oauth_access_token: nil)
+    api(
+      path,
+      user,
+      version: 'v3',
+      personal_access_token: personal_access_token,
+      oauth_access_token: oauth_access_token
+    )
   end
 
   def ci_api(path, user = nil)