Fix revocation tests (#748)

oauthlib 3.1 comes with a few changes that break certain non-standard behavior,
in particular, passing token to revocation endpoint in query instead of body.
This fixes the tests so they are not relying on this non-standard behavior.

Author: IvanAnishchuk

tests/test_token_revocation.py

@@ -52,13 +52,13 @@ def test_revoke_access_token(self):
             expires=timezone.now() + datetime.timedelta(days=1),
             scope="read write"
         )
-        query_string = urlencode({
+        data = {
             "client_id": self.application.client_id,
             "client_secret": self.application.client_secret,
             "token": tok.token,
-        })
-        url = "{url}?{qs}".format(url=reverse("oauth2_provider:revoke-token"), qs=query_string)
-        response = self.client.post(url)
+        }
+        url = reverse("oauth2_provider:revoke-token")
+        response = self.client.post(url, data=data)
         self.assertEqual(response.status_code, 200)
         self.assertEqual(response.content, b"")
         self.assertFalse(AccessToken.objects.filter(id=tok.id).exists())
@@ -79,13 +79,13 @@ def test_revoke_access_token_public(self):
             scope="read write"
         )
 
-        query_string = urlencode({
+        data = {
             "client_id": public_app.client_id,
             "token": tok.token,
-        })
+        }
 
-        url = "{url}?{qs}".format(url=reverse("oauth2_provider:revoke-token"), qs=query_string)
-        response = self.client.post(url)
+        url = reverse("oauth2_provider:revoke-token")
+        response = self.client.post(url, data=data)
         self.assertEqual(response.status_code, 200)
 
     def test_revoke_access_token_with_hint(self):
@@ -98,14 +98,14 @@ def test_revoke_access_token_with_hint(self):
             expires=timezone.now() + datetime.timedelta(days=1),
             scope="read write"
         )
-        query_string = urlencode({
+        data = {
             "client_id": self.application.client_id,
             "client_secret": self.application.client_secret,
             "token": tok.token,
             "token_type_hint": "access_token"
-        })
-        url = "{url}?{qs}".format(url=reverse("oauth2_provider:revoke-token"), qs=query_string)
-        response = self.client.post(url)
+        }
+        url = reverse("oauth2_provider:revoke-token")
+        response = self.client.post(url, data=data)
         self.assertEqual(response.status_code, 200)
         self.assertFalse(AccessToken.objects.filter(id=tok.id).exists())
 
@@ -117,14 +117,14 @@ def test_revoke_access_token_with_invalid_hint(self):
             scope="read write"
         )
         # invalid hint should have no effect
-        query_string = urlencode({
+        data = {
             "client_id": self.application.client_id,
             "client_secret": self.application.client_secret,
             "token": tok.token,
             "token_type_hint": "bad_hint"
-        })
-        url = "{url}?{qs}".format(url=reverse("oauth2_provider:revoke-token"), qs=query_string)
-        response = self.client.post(url)
+        }
+        url = reverse("oauth2_provider:revoke-token")
+        response = self.client.post(url, data=data)
         self.assertEqual(response.status_code, 200)
         self.assertFalse(AccessToken.objects.filter(id=tok.id).exists())
 
@@ -139,13 +139,13 @@ def test_revoke_refresh_token(self):
             user=self.test_user, token="999999999",
             application=self.application, access_token=tok
         )
-        query_string = urlencode({
+        data = {
             "client_id": self.application.client_id,
             "client_secret": self.application.client_secret,
             "token": rtok.token,
-        })
-        url = "{url}?{qs}".format(url=reverse("oauth2_provider:revoke-token"), qs=query_string)
-        response = self.client.post(url)
+        }
+        url = reverse("oauth2_provider:revoke-token")
+        response = self.client.post(url, data=data)
         self.assertEqual(response.status_code, 200)
         refresh_token = RefreshToken.objects.filter(id=rtok.id).first()
         self.assertIsNotNone(refresh_token.revoked)
@@ -163,13 +163,13 @@ def test_revoke_refresh_token_with_revoked_access_token(self):
             application=self.application, access_token=tok
         )
         for token in (tok.token, rtok.token):
-            query_string = urlencode({
+            data = {
                 "client_id": self.application.client_id,
                 "client_secret": self.application.client_secret,
                 "token": token,
-            })
-            url = "{url}?{qs}".format(url=reverse("oauth2_provider:revoke-token"), qs=query_string)
-            response = self.client.post(url)
+            }
+            url = reverse("oauth2_provider:revoke-token")
+            response = self.client.post(url, data=data)
             self.assertEqual(response.status_code, 200)
 
         self.assertFalse(AccessToken.objects.filter(id=tok.id).exists())
@@ -191,13 +191,13 @@ def test_revoke_token_with_wrong_hint(self):
             scope="read write"
         )
 
-        query_string = urlencode({
+        data = {
             "client_id": self.application.client_id,
             "client_secret": self.application.client_secret,
             "token": tok.token,
             "token_type_hint": "refresh_token"
-        })
-        url = "{url}?{qs}".format(url=reverse("oauth2_provider:revoke-token"), qs=query_string)
-        response = self.client.post(url)
+        }
+        url = reverse("oauth2_provider:revoke-token")
+        response = self.client.post(url, data=data)
         self.assertEqual(response.status_code, 200)
         self.assertFalse(AccessToken.objects.filter(id=tok.id).exists())