Function TestHTTP_Token_AuthCode

internal/agent/oauth_token_test.go:157–209

TestHTTP_Token_AuthCode covers the happy path: POST /oauth2/token with an auth_code grant + PKCE verifier yields an access+refresh token JSON envelope with the right fields and the no-store header.

(t *testing.T)

// with an auth_code grant + PKCE verifier yields an access+refresh
// token JSON envelope with the right fields and the no-store header.
func TestHTTP_Token_AuthCode(t *testing.T) {
	server, provider, _, clientID, userID := setupOAuthAPI(t)
	redirectURI := "http://localhost:8765/callback"
	verifier, challenge := newPKCE(t)
	code := mintAuthCode(t, provider, clientID, userID, redirectURI, challenge)

	form := url.Values{}
	form.Set("grant_type", "authorization_code")
	form.Set("code", code)
	form.Set("client_id", clientID)
	form.Set("redirect_uri", redirectURI)
	form.Set("code_verifier", verifier)

	resp, err := http.Post(server.URL+"/oauth2/token",
		"application/x-www-form-urlencoded", strings.NewReader(form.Encode()))
	if err != nil {
		t.Fatal(err)
	}
	defer resp.Body.Close()
	if resp.StatusCode != http.StatusOK {
		t.Fatalf("status = %d, want 200", resp.StatusCode)
	}
	// RFC 6749 §5.1: token response MUST include Cache-Control: no-store.
	if cc := resp.Header.Get("Cache-Control"); !strings.Contains(cc, "no-store") {
		t.Errorf("Cache-Control = %q, want no-store", cc)
	}
	if ct := resp.Header.Get("Content-Type"); !strings.HasPrefix(ct, "application/json") {
		t.Errorf("Content-Type = %q, want application/json", ct)
	}

	var body struct {
		AccessToken  string `json:"access_token"`
		TokenType    string `json:"token_type"`
		ExpiresIn    int    `json:"expires_in"`
		RefreshToken string `json:"refresh_token"`
		Scope        string `json:"scope"`
	}
	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
		t.Fatal(err)
	}
	if !strings.HasPrefix(body.AccessToken, oauth.AccessTokenPrefix) {
		t.Errorf("access_token missing %q prefix: %q", oauth.AccessTokenPrefix, body.AccessToken)
	}
	if !strings.HasPrefix(body.RefreshToken, oauth.RefreshTokenPrefix) {
		t.Errorf("refresh_token missing %q prefix: %q", oauth.RefreshTokenPrefix, body.RefreshToken)
	}
	if body.TokenType != "bearer" {
		t.Errorf("token_type = %q, want bearer", body.TokenType)
	}
	if body.ExpiresIn <= 0 {
		t.Errorf("expires_in = %d, want > 0", body.ExpiresIn)
	}
}

// TestHTTP_Token_RefreshGrant: exchange auth_code, then exchange the
// refresh token for a new pair. Verifies refresh rotation works through