──────────────────────── /authorize ──────────────────────── TestHTTP_Authorize_NoSession redirects to /api/auth/login when the request lacks the session cookie, carrying the original authorize request URI as return_to so the user lands back here after Google callback completes. Without that bounce
(t *testing.T)
| 215 | // callback completes. Without that bounce the user would land on |
| 216 | // /dashboard and have to re-trigger the flow from their MCP client. |
| 217 | func TestHTTP_Authorize_NoSession(t *testing.T) { |
| 218 | f := newConsentFixture(t) |
| 219 | _, challenge := newPKCE(t) |
| 220 | resp := f.authorizeRequest(t, authorizeParams(challenge, f.clientID, "s1s1s1s1s1s1s1s1"), false) |
| 221 | defer resp.Body.Close() |
| 222 | if resp.StatusCode != http.StatusFound { |
| 223 | t.Fatalf("status = %d, want 302", resp.StatusCode) |
| 224 | } |
| 225 | loc, err := url.Parse(resp.Header.Get("Location")) |
| 226 | if err != nil { |
| 227 | t.Fatalf("Location parse: %v", err) |
| 228 | } |
| 229 | if !strings.HasSuffix(loc.Path, "/api/auth/login") { |
| 230 | t.Errorf("Location path = %q, want /api/auth/login", loc.Path) |
| 231 | } |
| 232 | returnTo := loc.Query().Get("return_to") |
| 233 | if !strings.HasPrefix(returnTo, "/oauth2/authorize") { |
| 234 | t.Errorf("return_to should preserve the authorize request URI: got %q", returnTo) |
| 235 | } |
| 236 | if !strings.Contains(returnTo, "client_id=") || !strings.Contains(returnTo, "code_challenge=") { |
| 237 | t.Errorf("return_to should carry the original query string: got %q", returnTo) |
| 238 | } |
| 239 | } |
| 240 | |
| 241 | // TestHTTP_Authorize_WithSession redirects to {publicURL}/oauth/consent |
| 242 | // preserving every authorize parameter so the consent page can hidden- |
nothing calls this directly
no test coverage detected