如何在RSpec中模拟基于oauth和quickbooks-ruby的OAuth2认证流程？

前置依赖 #

先确保Gemfile包含以下测试依赖：

group :test do
  gem 'rspec'
  gem 'webmock'
  gem 'rack-test' # 针对Sinatra/Rack应用模拟HTTP请求
end

在spec_helper.rb中配置WebMock，禁用真实网络请求：

require 'webmock/rspec'
WebMock.disable_net_connect!(allow_localhost: true)

测试/auth端点 #

这个端点核心是生成正确的QuickBooks授权URL并触发重定向，无需调用真实API，只需验证URL参数和重定向行为：

RSpec.describe 'Auth Endpoint' do
  include Rack::Test::Methods

  def app
    # 替换为你的Sinatra/Rack应用实例
    Sinatra::Application
  end

  it 'redirects to QuickBooks authorization URL with valid parameters' do
    mock_auth_url = 'https://appcenter.intuit.com/connect/oauth2?redirect_uri=http%3A%2F%2Flocalhost%3A4567%2Fcallback&response_type=code&state=abc123&scope=com.intuit.quickbooks.accounting'
    
    # 模拟qbo_client生成授权URL的行为
    allow_any_instance_of(OAuth2::Client).to receive(:authorize_url).with(
      redirect_uri: 'http://localhost:4567/callback',
      response_type: "code",
      state: kind_of(String), # 仅验证state是随机字符串，不匹配具体值
      scope: "com.intuit.quickbooks.accounting"
    ).and_return(mock_auth_url)

    get '/auth'

    expect(last_response).to be_redirect
    expect(last_response.location).to eq(mock_auth_url)
  end
end

测试/callback端点 #

需要模拟授权码换取令牌的过程，用WebMock拦截QuickBooks的令牌请求，返回预设响应：

1. 准备模拟令牌响应Fixture #

在spec/fixtures/quickbooks_token_response.json中创建模拟数据：

{
  "access_token": "mock_access_token_123",
  "refresh_token": "mock_refresh_token_456",
  "expires_in": 3600,
  "token_type": "Bearer"
}

2. 编写测试用例 #

RSpec.describe 'Callback Endpoint' do
  include Rack::Test::Methods

  def app
    Sinatra::Application
  end

  it 'exchanges auth code for token and redirects to root' do
    mock_code = 'mock_auth_code_789'
    token_endpoint = 'https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer'

    # 拦截令牌请求，返回模拟响应
    stub_request(:post, token_endpoint)
      .with(
        body: hash_including(
          code: mock_code,
          redirect_uri: 'http://localhost:4567/callback',
          grant_type: 'authorization_code'
        ),
        headers: { 'Content-Type' => 'application/x-www-form-urlencoded' }
      )
      .to_return(
        status: 200,
        body: File.read('spec/fixtures/quickbooks_token_response.json'),
        headers: { 'Content-Type' => 'application/json' }
      )

    # 模拟qbo_client的auth_code对象
    allow_any_instance_of(OAuth2::Client).to receive(:auth_code).and_return(double('AuthCode'))

    get '/callback', code: mock_code

    expect(last_response).to be_redirect
    expect(last_response.location).to eq('/')
    # 如果应用会将令牌存入session/数据库，可添加对应断言
    # expect(session[:quickbooks_access_token]).to eq('mock_access_token_123')
  end
end

关键注意事项 #

• 禁用真实网络请求：全程用WebMock拦截外部请求，避免测试依赖QuickBooks服务状态。
• 随机参数处理：对state这类随机生成的参数，只需验证类型而非具体值。
• qbo_client模拟：如果应用中qbo_client是全局实例，可通过allow_any_instance_of或依赖注入替换，提升测试可控性。
• 令牌存储验证：若应用会保存令牌到session、数据库等，需添加对应断言确保逻辑正确。

内容的提问来源于stack exchange，提问作者Will DeBernardi