Function TestHTTP_Token_RefreshGrant

internal/agent/oauth_token_test.go:214–266

TestHTTP_Token_RefreshGrant: exchange auth_code, then exchange the refresh token for a new pair. Verifies refresh rotation works through the HTTP layer.

(t *testing.T)

// refresh token for a new pair. Verifies refresh rotation works through
// the HTTP layer.
func TestHTTP_Token_RefreshGrant(t *testing.T) {
	server, provider, _, clientID, userID := setupOAuthAPI(t)
	redirectURI := "http://localhost:8765/callback"
	verifier, challenge := newPKCE(t)
	code := mintAuthCode(t, provider, clientID, userID, redirectURI, challenge)

	// Code exchange.
	form := url.Values{}
	form.Set("grant_type", "authorization_code")
	form.Set("code", code)
	form.Set("client_id", clientID)
	form.Set("redirect_uri", redirectURI)
	form.Set("code_verifier", verifier)
	resp, err := http.Post(server.URL+"/oauth2/token",
		"application/x-www-form-urlencoded", strings.NewReader(form.Encode()))
	if err != nil {
		t.Fatal(err)
	}
	var first struct {
		AccessToken  string `json:"access_token"`
		RefreshToken string `json:"refresh_token"`
	}
	json.NewDecoder(resp.Body).Decode(&first)
	resp.Body.Close()

	// Refresh exchange.
	form = url.Values{}
	form.Set("grant_type", "refresh_token")
	form.Set("refresh_token", first.RefreshToken)
	form.Set("client_id", clientID)
	resp2, err := http.Post(server.URL+"/oauth2/token",
		"application/x-www-form-urlencoded", strings.NewReader(form.Encode()))
	if err != nil {
		t.Fatal(err)
	}
	defer resp2.Body.Close()
	if resp2.StatusCode != http.StatusOK {
		t.Fatalf("refresh exchange status = %d, want 200", resp2.StatusCode)
	}
	var second struct {
		AccessToken  string `json:"access_token"`
		RefreshToken string `json:"refresh_token"`
	}
	if err := json.NewDecoder(resp2.Body).Decode(&second); err != nil {
		t.Fatal(err)
	}
	if second.AccessToken == first.AccessToken {
		t.Error("refresh should have rotated the access token")
	}
	if second.RefreshToken == first.RefreshToken {
		t.Error("refresh should have rotated the refresh token (single-use)")
	}
}

// TestHTTP_Token_BadPKCE confirms fosite rejects a wrong verifier at
// the HTTP boundary with invalid_grant per RFC 6749 §5.2.