Function mintAuthCode

internal/agent/oauth_token_test.go:117–152

mintAuthCode drives fosite's authorize flow inline to produce a code for the given user/client. This is what the consent handler will do in slice 5; for slice 4's HTTP test we just need a code to exchange at /token.

(t *testing.T, provider fosite.OAuth2Provider, clientID, userID, redirectURI, challenge string)

// in slice 5; for slice 4's HTTP test we just need a code to exchange
// at /token.
func mintAuthCode(t *testing.T, provider fosite.OAuth2Provider, clientID, userID, redirectURI, challenge string) string {
	t.Helper()
	ctx := context.Background()
	q := url.Values{}
	q.Set("response_type", "code")
	q.Set("client_id", clientID)
	q.Set("redirect_uri", redirectURI)
	q.Set("scope", "mcp")
	q.Set("state", "abc123abc123abc123")
	q.Set("code_challenge", challenge)
	q.Set("code_challenge_method", "S256")

	authReq, _ := http.NewRequest("GET", "https://test.e2a.dev/oauth2/authorize?"+q.Encode(), nil)
	ar, err := provider.NewAuthorizeRequest(ctx, authReq)
	if err != nil {
		t.Fatalf("NewAuthorizeRequest: %v", err)
	}
	ar.SetSession(&oauth.Session{UserID: userID, AgentEmail: "agent@example.com", Subject: userID})
	ar.GrantScope("mcp")

	resp, err := provider.NewAuthorizeResponse(ctx, ar, ar.GetSession())
	if err != nil {
		t.Fatalf("NewAuthorizeResponse: %v", err)
	}
	rec := httptest.NewRecorder()
	provider.WriteAuthorizeResponse(ctx, rec, ar, resp)
	loc, err := url.Parse(rec.Header().Get("Location"))
	if err != nil {
		t.Fatalf("parse Location: %v", err)
	}
	code := loc.Query().Get("code")
	if code == "" {
		t.Fatalf("no code in redirect: %s", rec.Header().Get("Location"))
	}
	return code
}

// TestHTTP_Token_AuthCode covers the happy path: POST /oauth2/token
// with an auth_code grant + PKCE verifier yields an access+refresh