applicake/doorkeeper — Issue #15: Wrong status code for invalid scope
Author: felipeelias
Created: 2011-12-08 22:13:50+00:00
State: open
Labels: bug

When access token scope **does not** include the required scope for certain action, the response status should be 401 instead of 200.

The patch below simulates the error:

```diff
diff --git spec/dummy/app/controllers/full_protected_resources_controller.rb spec/dummy/app/controllers/full_protected_resources_controller.rb
index b3325fa..91e9099 100644
--- spec/dummy/app/controllers/full_protected_resources_controller.rb
+++ spec/dummy/app/controllers/full_protected_resources_controller.rb
@@ -1,5 +1,6 @@
class FullProtectedResourcesController < ApplicationController
- doorkeeper_for :all
+ doorkeeper_for :index
+ doorkeeper_for :show, :scopes => [:admin]

def index
render :text => "index"
diff --git spec/requests/protected_resources/private_api_spec.rb spec/requests/protected_resources/private_api_spec.rb
index 2bc2cad..4d2369b 100644
--- spec/requests/protected_resources/private_api_spec.rb
+++ spec/requests/protected_resources/private_api_spec.rb
@@ -25,4 +25,11 @@ feature 'Private API' do
visit '/full_protected_resources'
response_status_should_be 401
end
+
+ scenario 'client attempts to request protected resource with invalid scope' do
+ @token.update_attribute :scopes, nil
+ with_access_token_header @token.token
+ visit '/full_protected_resources'
+ response_status_should_be 401
+ end
end
```