(t *testing.T)
| 359 | } |
| 360 | |
| 361 | func TestHandleCallback_NonceMismatch_Rejected(t *testing.T) { |
| 362 | ua, _, srv := setupUserAuthWithFakeOAuth(t) |
| 363 | |
| 364 | state := auth.EncodeOAuthState(&auth.OAuthState{ |
| 365 | Nonce: "correct-nonce", |
| 366 | CLICallback: "http://127.0.0.1:43123/callback", |
| 367 | CLIState: "cli_state_abc", |
| 368 | }) |
| 369 | |
| 370 | req := httptest.NewRequest( |
| 371 | http.MethodGet, |
| 372 | fmt.Sprintf("/api/auth/callback?code=fake-code&state=%s", url.QueryEscape(state)), |
| 373 | nil, |
| 374 | ) |
| 375 | req.AddCookie(&http.Cookie{Name: "e2a_oauth_state", Value: "wrong-nonce"}) |
| 376 | _ = srv |
| 377 | w := httptest.NewRecorder() |
| 378 | |
| 379 | ua.HandleCallback(w, req) |
| 380 | |
| 381 | if w.Code != http.StatusBadRequest { |
| 382 | t.Fatalf("status = %d, want %d", w.Code, http.StatusBadRequest) |
| 383 | } |
| 384 | } |
| 385 | |
| 386 | func TestHandleCallback_InvalidState_Rejected(t *testing.T) { |
| 387 | ua, _, srv := setupUserAuthWithFakeOAuth(t) |
nothing calls this directly
no test coverage detected