Merge branch 'connorshea/gitlab-ce-revoke-authorized-application' into 'master'

Fix revoking of authorized OAuth applications

Users were not able to revoke access to authorized OAuth applications. Clicking the "Revoke" button would result in a 404 page, and the application would still be authorized.

Added a spec and also found that the `gon` variables were not being set for this view.

Closes #14370

See merge request !3690

4 files changed, 71 insertions, 1 deletions

diff --git a/spec/factories/oauth_access_tokens.rb b/spec/factories/oauth_access_tokens.rb
new file mode 100644
index 00000000000..7700b15d538
--- /dev/null
+++ b/spec/factories/oauth_access_tokens.rb
@@ -0,0 +1,22 @@
+# == Schema Information
+#
+# Table name: oauth_access_tokens
+#
+#  id                :integer          not null, primary key
+#  resource_owner_id :integer
+#  application_id    :integer
+#  token             :string           not null
+#  refresh_token     :string
+#  expires_in        :integer
+#  revoked_at        :datetime
+#  created_at        :datetime         not null
+#  scopes            :string
+#
+
+FactoryGirl.define do
+  factory :oauth_access_token do
+    resource_owner
+    application
+    token '123456'
+  end
+end
diff --git a/spec/factories/oauth_applications.rb b/spec/factories/oauth_applications.rb
new file mode 100644
index 00000000000..d116a573830
--- /dev/null
+++ b/spec/factories/oauth_applications.rb
@@ -0,0 +1,9 @@
+FactoryGirl.define do
+  factory :oauth_application, class: 'Doorkeeper::Application', aliases: [:application] do
+    name { FFaker::Name.name }
+    uid { FFaker::Name.name }
+    redirect_uri { FFaker::Internet.uri('http') }
+    owner
+    owner_type 'User'
+  end
+end
diff --git a/spec/factories/users.rb b/spec/factories/users.rb
index a5c60c51c5b..a9b2148bd2a 100644
--- a/spec/factories/users.rb
+++ b/spec/factories/users.rb
@@ -1,7 +1,7 @@
 FactoryGirl.define do
   sequence(:name) { FFaker::Name.name }
 
-  factory :user, aliases: [:author, :assignee, :recipient, :owner, :creator] do
+  factory :user, aliases: [:author, :assignee, :recipient, :owner, :creator, :resource_owner] do
     email { FFaker::Internet.email }
     name
     sequence(:username) { |n| "#{FFaker::Internet.user_name}#{n}" }
diff --git a/spec/features/profiles/oauth_applications_spec.rb b/spec/features/profiles/oauth_applications_spec.rb
new file mode 100644
index 00000000000..1a5a9059dbd
--- /dev/null
+++ b/spec/features/profiles/oauth_applications_spec.rb
@@ -0,0 +1,39 @@
+require 'spec_helper'
+
+describe 'Profile > Applications', feature: true do
+  let(:user) { create(:user) }
+
+  before do
+    login_as(user)
+  end
+
+  describe 'User manages applications', js: true do
+    it 'deletes an application' do
+      create(:oauth_application, owner: user)
+      visit oauth_applications_path
+
+      page.within('.oauth-applications') do
+        expect(page).to have_content('Your applications (1)')
+        click_button 'Destroy'
+      end
+
+      expect(page).to have_content('The application was deleted successfully')
+      expect(page).to have_content('Your applications (0)')
+      expect(page).to have_content('Authorized applications (0)')
+    end
+
+    it 'deletes an authorized application' do
+      create(:oauth_access_token, resource_owner: user)
+      visit oauth_applications_path
+
+      page.within('.oauth-authorized-applications') do
+        expect(page).to have_content('Authorized applications (1)')
+        click_button 'Revoke'
+      end
+
+      expect(page).to have_content('The application was revoked access.')
+      expect(page).to have_content('Your applications (0)')
+      expect(page).to have_content('Authorized applications (0)')
+    end
+  end
+end