Only use API scopes for personal access tokens

1 files changed, 16 insertions, 0 deletions

diff --git a/spec/models/personal_access_token_spec.rb b/spec/models/personal_access_token_spec.rb
index 46eb71cef14..4cc9cf02e6d 100644
--- a/spec/models/personal_access_token_spec.rb
+++ b/spec/models/personal_access_token_spec.rb
@@ -12,4 +12,20 @@ describe PersonalAccessToken, models: true do
       expect(personal_access_token).not_to be_persisted
     end
   end
+
+  describe 'validate_scopes' do
+    it "allows creating a token with API scopes" do
+      personal_access_token = build(:personal_access_token)
+      personal_access_token.scopes = [:api, :read_user]
+
+      expect(personal_access_token).to be_valid
+    end
+
+    it "rejects creating a token with non-API scopes" do
+      personal_access_token = build(:personal_access_token)
+      personal_access_token.scopes = [:openid, :api]
+
+      expect(personal_access_token).not_to be_valid
+    end
+  end
 end