Function TestHTTP_Token_CodeReplay

internal/agent/oauth_token_test.go:304–375

TestHTTP_Token_CodeReplay drives the code-reuse path: exchange once (success), then re-present the same code (rejection + the originally issued tokens get revoked per RFC 6749 §10.5).

(t *testing.T)

// once (success), then re-present the same code (rejection + the
// originally issued tokens get revoked per RFC 6749 §10.5).
func TestHTTP_Token_CodeReplay(t *testing.T) {
	server, provider, pool, clientID, userID := setupOAuthAPI(t)
	redirectURI := "http://localhost:8765/callback"
	verifier, challenge := newPKCE(t)
	code := mintAuthCode(t, provider, clientID, userID, redirectURI, challenge)

	form := url.Values{}
	form.Set("grant_type", "authorization_code")
	form.Set("code", code)
	form.Set("client_id", clientID)
	form.Set("redirect_uri", redirectURI)
	form.Set("code_verifier", verifier)

	// First exchange wins.
	resp, err := http.Post(server.URL+"/oauth2/token",
		"application/x-www-form-urlencoded", strings.NewReader(form.Encode()))
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != http.StatusOK {
		t.Fatalf("first exchange: status = %d, want 200", resp.StatusCode)
	}
	var first struct {
		AccessToken string `json:"access_token"`
	}
	json.NewDecoder(resp.Body).Decode(&first)
	resp.Body.Close()

	// Replay: same code, same verifier. Must fail.
	resp2, err := http.Post(server.URL+"/oauth2/token",
		"application/x-www-form-urlencoded", strings.NewReader(form.Encode()))
	if err != nil {
		t.Fatal(err)
	}
	defer resp2.Body.Close()
	if resp2.StatusCode != http.StatusBadRequest {
		t.Fatalf("replay: status = %d, want 400 invalid_grant", resp2.StatusCode)
	}

	// And the tokens from the first exchange must be revoked (the
	// §10.5 reuse defense fosite drives via RevokeAccessToken +
	// RevokeRefreshToken). Both halves must fire — checking only the
	// access side would miss a regression that broke the refresh
	// cascade.
	var accessRevoked bool
	if err := pool.QueryRow(context.Background(), `
		SELECT revoked_at IS NOT NULL FROM oauth_access_tokens
		WHERE request_id IN (
		    SELECT request_id FROM oauth_auth_codes WHERE active = FALSE
		)
		LIMIT 1
	`).Scan(&accessRevoked); err != nil {
		t.Fatalf("query access revoked status: %v", err)
	}
	if !accessRevoked {
		t.Error("expected the originally-issued access token to be revoked after code replay")
	}