Function TestAuthCodeWithDefaultStrategy

oauth2/oauth2_auth_code_test.go:170–1732

TestAuthCodeWithDefaultStrategy runs proper integration tests against in-memory and database connectors, specifically we test: - [x] If the flow - in general - works - [x] If `authenticatedAt` is properly managed across the lifecycle - [x] The value `authenticatedAt` should be an old time if no use

(t *testing.T)

// - [x] If `id_token_hint` is handled properly
//   - [x] What happens if `id_token_hint` does not match the value from the handled authentication request ("accept login")
func TestAuthCodeWithDefaultStrategy(t *testing.T) {
	t.Parallel()

	ctx := context.Background()

	for dbName, reg := range testhelpers.ConnectDatabases(t, true, driver.WithConfigOptions(configx.WithValues(map[string]any{
		config.KeyAccessTokenStrategy: "opaque",
		config.KeyRefreshTokenHook:    "",
	}))) {
		t.Run("registry="+dbName, func(t *testing.T) {
			t.Parallel()

			rng := rand.New(rand.NewSource(time.Now().UnixNano()))

			jwk.EnsureAsymmetricKeypairExists(t, reg, string(jose.ES256), x.OpenIDConnectKeyName)
			jwk.EnsureAsymmetricKeypairExists(t, reg, string(jose.ES256), x.OAuth2JWTKeyName)

			publicTS, adminTS := testhelpers.NewOAuth2Server(ctx, t, reg)

			publicClient := hydra.NewAPIClient(hydra.NewConfiguration())
			publicClient.GetConfig().Servers = hydra.ServerConfigurations{{URL: publicTS.URL}}
			adminClient := hydra.NewAPIClient(hydra.NewConfiguration())
			adminClient.GetConfig().Servers = hydra.ServerConfigurations{{URL: adminTS.URL}}

			assertRefreshToken := func(t *testing.T, token *oauth2.Token, c *oauth2.Config, expectedExp time.Time) gjson.Result {
				introspect := testhelpers.IntrospectToken(t, token.RefreshToken, adminTS)
				if !expectedExp.IsZero() {
					require.WithinDuration(t, expectedExp, time.Unix(introspect.Get("exp").Int(), 0), time.Second*3)
				}
				return introspect
			}

			assertIDToken := func(t *testing.T, token *oauth2.Token, c *oauth2.Config, expectedSubject, expectedNonce string, expectedExp time.Time) gjson.Result {
				idt, ok := token.Extra("id_token").(string)
				require.True(t, ok)
				assert.NotEmpty(t, idt)

				claims := gjson.ParseBytes(testhelpers.InsecureDecodeJWT(t, idt))
				assert.Truef(t, time.Now().After(time.Unix(claims.Get("iat").Int(), 0)), "%s", claims)
				assert.Truef(t, time.Now().After(time.Unix(claims.Get("nbf").Int(), 0)), "%s", claims)
				assert.Truef(t, time.Now().Before(time.Unix(claims.Get("exp").Int(), 0)), "%s", claims)
				if !expectedExp.IsZero() {
					// 1.5s due to rounding
					require.WithinDuration(t, expectedExp, time.Unix(claims.Get("exp").Int(), 0), 1*time.Second+500*time.Millisecond)
				}
				assert.NotEmptyf(t, claims.Get("jti").String(), "%s", claims)
				assert.EqualValuesf(t, reg.Config().IssuerURL(ctx).String(), claims.Get("iss").String(), "%s", claims)
				assert.NotEmptyf(t, claims.Get("sid").String(), "%s", claims)
				assert.Equalf(t, "1", claims.Get("acr").String(), "%s", claims)
				require.Lenf(t, claims.Get("amr").Array(), 1, "%s", claims)
				assert.EqualValuesf(t, "pwd", claims.Get("amr.0").String(), "%s", claims)

				require.Lenf(t, claims.Get("aud").Array(), 1, "%s", claims)
				assert.EqualValuesf(t, c.ClientID, claims.Get("aud.0").String(), "%s", claims)
				assert.EqualValuesf(t, expectedSubject, claims.Get("sub").String(), "%s", claims)
				assert.EqualValuesf(t, expectedNonce, claims.Get("nonce").String(), "%s", claims)
				assert.EqualValuesf(t, `baz`, claims.Get("bar").String(), "%s", claims)
				assert.EqualValuesf(t, `foo@bar.com`, claims.Get("email").String(), "%s", claims)