过滤链停止为：doorkeeper_authorize！ 渲染或重定向

我正在构建一个Rails API，目前正在使用门卫并设计使用ResourceOwnerFromCredentials流来validation用户。 一切正常，但我无法在Rspec中使用身份validation。

以下是如何在rspec中集成应用程序：

let(:app_country) { FactoryGirl.create(:app_country)} let(:valid_attributes) { FactoryGirl.attributes_for(:app_city, {:app_country_id => app_country.id}) } let(:valid_session) { {:format => :json} } let(:application) { Doorkeeper::Application.create!(:name => "App HQ dashboard", :redirect_uri => "https://localhost:3000/callback") } let(:hq_user) { app_country.hq_users.create!(FactoryGirl.attributes_for :hq_user) } let(:token) { Doorkeeper::AccessToken.create! :application_id => application.id, :resource_owner_id => hq_user.id } 

但每次我尝试测试受保护的操作时，测试都会失败，我从控制台获得以下输出：

 Filter chain halted as :doorkeeper_authorize! rendered or redirected Completed 403 Forbidden in 5ms (ActiveRecord: 1.2ms) 

这与之前版本的门卫一起工作正常。 当我升级门卫gem时，测试破了。 我究竟做错了什么？ 或者是否有一种测试门卫保护控制器的新方法？

UPDATE
以下是实际测试样本

  describe "POST create" do describe "with valid params" do it "creates a new AppCity" do expect { post :create, {:app_city => valid_attributes, :v => "HEAD", :payload_type => "NODE", :access_token => token.token}, valid_session }.to change(AppCity, :count).by(1) end it "persists the AppCity" do post :create, {:app_city => valid_attributes, :v => "HEAD", :access_token => token.token}, valid_session response_body = JSON.parse(response.body, symbolize_names: true) expect(response_body[:id]).to be_present end it "returns a 201 status" do post :create, {:app_city => valid_attributes, :v => "HEAD", :access_token => token.token}, valid_session response.status.should eq(201) end end describe "with invalid params" do it "returns validation error message" do post :create, {:app_city => { "name" => "" }, :v => "HEAD", :access_token => token.token}, valid_session response_body = JSON.parse(response.body, symbolize_names: true) expect(response_body[:name]).to include "can't be blank" end it "returns a 422 status" do post :create, {:app_city => { "name" => "" }, :v => "HEAD", :access_token => token.token}, valid_session response.status.should eq(422) end end end 

Answer 1

我终于找到了问题。 我得到了403 Forbidden因为我发送的请求范围不够。 我在doorkeeper.rb中定义了以下范围

 # Define access token scopes for your provider # For more information go to https://github.com/applicake/doorkeeper/wiki/Using-Scopes default_scopes :public optional_scopes :write, :update 

为了让我的规格再次通过，我必须指定哪些操作需要特定的访问令牌范围，例如：

 class Api::V1::ProductsController < Api::V1::ApiController before_action -> { doorkeeper_authorize! :public }, only: :index before_action only: [:create, :update, :destroy] do doorkeeper_authorize! :admin, :write end end 

我最初只有before_action :doorkeeper_authorize!, except: [:index, :show] 。 我需要做的是在:create ， :update和:destroy动作上定义:write和:update范围。 或者完全取消范围。

我也在使用CanCanCan所以我想在我的情况下范围应该是多余的。

进一步阅读这里