From d730f6b0c5cfb18894d1a9e34d0aa2556dda3c62 Mon Sep 17 00:00:00 2001
From: Emelia Smith <ThisIsMissEm@users.noreply.github.com>
Date: Thu, 11 Dec 2025 17:40:22 +0100
Subject: [PATCH] Add spec for client_credentials being used with
 /api/v1/apps/verify_credentials (#37195)

---
 spec/requests/api/v1/apps/credentials_spec.rb | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/spec/requests/api/v1/apps/credentials_spec.rb b/spec/requests/api/v1/apps/credentials_spec.rb
index 8c0292d8c3..09363362d6 100644
--- a/spec/requests/api/v1/apps/credentials_spec.rb
+++ b/spec/requests/api/v1/apps/credentials_spec.rb
@@ -75,6 +75,33 @@ RSpec.describe 'Credentials' do
       end
     end
 
+    context 'with client credentials' do
+      let(:application) { Fabricate(:application, scopes: 'read admin:write') }
+      let(:token) { Fabricate(:client_credentials_token, application: application, scopes: 'read admin:write') }
+      let(:headers) { { 'Authorization' => "Bearer #{token.token}" } }
+
+      it 'returns http success and returns app information' do
+        subject
+
+        expect(response).to have_http_status(200)
+        expect(response.content_type)
+          .to start_with('application/json')
+
+        expect(response.parsed_body).to match(
+          a_hash_including(
+            id: token.application.id.to_s,
+            name: token.application.name,
+            website: token.application.website,
+            scopes: token.application.scopes.map(&:to_s),
+            redirect_uris: token.application.redirect_uris,
+            # Deprecated properties as of 4.3:
+            redirect_uri: token.application.redirect_uri.split.first,
+            vapid_key: Rails.configuration.x.vapid.public_key
+          )
+        )
+      end
+    end
+
     context 'without an oauth token' do
       let(:headers) { {} }