added test for validateRedirectUri

Author: jorenvandeweyer

lib/handlers/authorize-handler.js

@@ -195,7 +195,7 @@ AuthorizeHandler.prototype.getClient = function(request) {
       }
 
       if (redirectUri && typeof self.model.validateRedirectUri === 'function') {
-        if (self.model.validateRedirectUri(redirectUri, client.redirectUris)) {
+        if (!self.model.validateRedirectUri(redirectUri, client.redirectUris)) {
           throw new InvalidClientError('Invalid client: `redirect_uri` does not match client value');
         }
       } else if (redirectUri && !client.redirectUris.includes(redirectUri)) {

test/unit/handlers/authorize-handler_test.js

@@ -99,4 +99,34 @@ describe('AuthorizeHandler', function() {
         .catch(should.fail);
     });
   });
+
+  describe('validateRedirectUri()', function() {
+    it('should call `model.validateRedirectUri()`', function() {
+      const client = { grants: ['authorization_code'], redirectUris: ['http://example.com/cb'] };
+      const redirect_uri = 'http://example.com/cb/2';
+      const model = {
+        getAccessToken: function() {},
+        getClient: sinon.stub().returns(client),
+        saveAuthorizationCode: function() {},
+        validateRedirectUri: sinon.stub().returns(true)
+      };
+      const handler = new AuthorizeHandler({ authorizationCodeLifetime: 120, model: model });
+      const request = new Request({ body: { client_id: 12345, client_secret: 'secret', redirect_uri }, headers: {}, method: {}, query: {} });
+
+      return handler.getClient(request)
+        .then(function() {
+          model.getClient.callCount.should.equal(1);
+          model.getClient.firstCall.args.should.have.length(2);
+          model.getClient.firstCall.args[0].should.equal(12345);
+          model.getClient.firstCall.thisValue.should.equal(model);
+
+          model.validateRedirectUri.callCount.should.equal(1);
+          model.validateRedirectUri.firstCall.args.should.have.length(2);
+          model.validateRedirectUri.firstCall.args[0].should.equal(redirect_uri);
+          model.validateRedirectUri.firstCall.args[1].should.equal(client.redirectUris);
+          model.validateRedirectUri.firstCall.thisValue.should.equal(model);
+        })
+        .catch(should.fail);
+    });
+  });
 });