|
5 | 5 | "crypto/rand" |
6 | 6 | "crypto/rsa" |
7 | 7 | "crypto/sha256" |
| 8 | + "encoding/base64" |
8 | 9 | "encoding/json" |
| 10 | + "fmt" |
9 | 11 | "net/http" |
10 | 12 | "net/http/cookiejar" |
11 | 13 | "net/http/httptest" |
@@ -271,3 +273,196 @@ func TestPrivateClient(t *testing.T) { |
271 | 273 | require.NotEmpty(t, newAccessToken) |
272 | 274 | require.NotEqual(t, originalAccessToken, newAccessToken, "Access token should be different after refresh") |
273 | 275 | } |
| 276 | + |
| 277 | +// registerTestClient is a helper that registers a private OAuth client and returns the registration response. |
| 278 | +func registerTestClient(t *testing.T, serverURL string) registrationResponse { |
| 279 | + t.Helper() |
| 280 | + |
| 281 | + regReq := registrationRequest{ |
| 282 | + ClientName: "Test OAuth Client", |
| 283 | + GrantTypes: []string{"authorization_code", "refresh_token"}, |
| 284 | + ResponseTypes: []string{"code"}, |
| 285 | + TokenEndpointAuthMethod: "client_secret_basic", |
| 286 | + Scope: "test", |
| 287 | + RedirectURIs: []string{"http://localhost:8080/callback"}, |
| 288 | + } |
| 289 | + |
| 290 | + reqBody, err := json.Marshal(regReq) |
| 291 | + require.NoError(t, err) |
| 292 | + |
| 293 | + resp, err := http.Post(serverURL+RegistrationEndpoint, "application/json", bytes.NewReader(reqBody)) |
| 294 | + require.NoError(t, err) |
| 295 | + defer resp.Body.Close() |
| 296 | + |
| 297 | + require.Equal(t, http.StatusCreated, resp.StatusCode) |
| 298 | + |
| 299 | + var regResp registrationResponse |
| 300 | + err = json.NewDecoder(resp.Body).Decode(®Resp) |
| 301 | + require.NoError(t, err) |
| 302 | + |
| 303 | + return regResp |
| 304 | +} |
| 305 | + |
| 306 | +// testAuthFlowWithURL performs the OAuth authorization flow given a raw authorization URL |
| 307 | +// and returns the callback URL after authorization completes. |
| 308 | +func testAuthFlowWithURL(t *testing.T, serverURL, authURL string) *url.URL { |
| 309 | + t.Helper() |
| 310 | + |
| 311 | + jar, err := cookiejar.New(nil) |
| 312 | + require.NoError(t, err) |
| 313 | + client := &http.Client{ |
| 314 | + Jar: jar, |
| 315 | + CheckRedirect: func(req *http.Request, via []*http.Request) error { |
| 316 | + return http.ErrUseLastResponse |
| 317 | + }, |
| 318 | + } |
| 319 | + |
| 320 | + // Step 1: Make initial authorization request |
| 321 | + authResp, err := client.Get(authURL) |
| 322 | + require.NoError(t, err) |
| 323 | + defer authResp.Body.Close() |
| 324 | + |
| 325 | + require.Contains(t, []int{http.StatusFound, http.StatusSeeOther}, authResp.StatusCode, |
| 326 | + "expected redirect, got %d", authResp.StatusCode) |
| 327 | + location := authResp.Header.Get("Location") |
| 328 | + require.NotEmpty(t, location) |
| 329 | + require.Contains(t, location, strings.ReplaceAll(AuthorizationReturnEndpoint, ":ar_id", "")) |
| 330 | + |
| 331 | + // Step 2: Follow the redirect to complete authorization |
| 332 | + authReturnResp, err := client.Get(serverURL + location) |
| 333 | + require.NoError(t, err) |
| 334 | + defer authReturnResp.Body.Close() |
| 335 | + |
| 336 | + require.Contains(t, []int{http.StatusFound, http.StatusSeeOther}, authReturnResp.StatusCode, |
| 337 | + "expected redirect with authorization code, got %d", authReturnResp.StatusCode) |
| 338 | + callbackLocation := authReturnResp.Header.Get("Location") |
| 339 | + require.NotEmpty(t, callbackLocation) |
| 340 | + |
| 341 | + callbackURL, err := url.Parse(callbackLocation) |
| 342 | + require.NoError(t, err) |
| 343 | + require.NotEmpty(t, callbackURL.Query().Get("code"), "callback URL should contain an authorization code") |
| 344 | + |
| 345 | + return callbackURL |
| 346 | +} |
| 347 | + |
| 348 | +func TestAuthWithoutState(t *testing.T) { |
| 349 | + server, _, _ := setupTestServer(t) |
| 350 | + regResp := registerTestClient(t, server.URL) |
| 351 | + |
| 352 | + // Build authorization URL manually WITHOUT a state parameter |
| 353 | + authURL := fmt.Sprintf("%s%s?response_type=code&client_id=%s&redirect_uri=%s", |
| 354 | + server.URL, AuthorizationEndpoint, regResp.ClientID, |
| 355 | + url.QueryEscape("http://localhost:8080/callback")) |
| 356 | + |
| 357 | + callbackURL := testAuthFlowWithURL(t, server.URL, authURL) |
| 358 | + |
| 359 | + // Server should have generated a state and echoed it back |
| 360 | + require.NotEmpty(t, callbackURL.Query().Get("state"), "server should generate a state when client omits it") |
| 361 | + |
| 362 | + // Exchange authorization code for tokens |
| 363 | + code := callbackURL.Query().Get("code") |
| 364 | + tokenReq := url.Values{} |
| 365 | + tokenReq.Set("grant_type", "authorization_code") |
| 366 | + tokenReq.Set("code", code) |
| 367 | + tokenReq.Set("redirect_uri", "http://localhost:8080/callback") |
| 368 | + tokenReq.Set("client_id", regResp.ClientID) |
| 369 | + tokenReq.Set("client_secret", regResp.ClientSecret) |
| 370 | + |
| 371 | + tokenResp, err := http.PostForm(server.URL+TokenEndpoint, tokenReq) |
| 372 | + require.NoError(t, err) |
| 373 | + defer tokenResp.Body.Close() |
| 374 | + |
| 375 | + require.Equal(t, http.StatusOK, tokenResp.StatusCode) |
| 376 | + |
| 377 | + var tokenResult map[string]any |
| 378 | + err = json.NewDecoder(tokenResp.Body).Decode(&tokenResult) |
| 379 | + require.NoError(t, err) |
| 380 | + require.NotEmpty(t, tokenResult["access_token"]) |
| 381 | +} |
| 382 | + |
| 383 | +func TestAuthWithEmptyState(t *testing.T) { |
| 384 | + server, _, _ := setupTestServer(t) |
| 385 | + regResp := registerTestClient(t, server.URL) |
| 386 | + |
| 387 | + // Build authorization URL with an empty state parameter |
| 388 | + authURL := fmt.Sprintf("%s%s?response_type=code&client_id=%s&redirect_uri=%s&state=", |
| 389 | + server.URL, AuthorizationEndpoint, regResp.ClientID, |
| 390 | + url.QueryEscape("http://localhost:8080/callback")) |
| 391 | + |
| 392 | + callbackURL := testAuthFlowWithURL(t, server.URL, authURL) |
| 393 | + |
| 394 | + // Server should have generated a state and echoed it back |
| 395 | + require.NotEmpty(t, callbackURL.Query().Get("state"), "server should generate a state when client sends empty state") |
| 396 | + |
| 397 | + // Exchange authorization code for tokens |
| 398 | + code := callbackURL.Query().Get("code") |
| 399 | + tokenReq := url.Values{} |
| 400 | + tokenReq.Set("grant_type", "authorization_code") |
| 401 | + tokenReq.Set("code", code) |
| 402 | + tokenReq.Set("redirect_uri", "http://localhost:8080/callback") |
| 403 | + tokenReq.Set("client_id", regResp.ClientID) |
| 404 | + tokenReq.Set("client_secret", regResp.ClientSecret) |
| 405 | + |
| 406 | + tokenResp, err := http.PostForm(server.URL+TokenEndpoint, tokenReq) |
| 407 | + require.NoError(t, err) |
| 408 | + defer tokenResp.Body.Close() |
| 409 | + |
| 410 | + require.Equal(t, http.StatusOK, tokenResp.StatusCode) |
| 411 | + |
| 412 | + var tokenResult map[string]any |
| 413 | + err = json.NewDecoder(tokenResp.Body).Decode(&tokenResult) |
| 414 | + require.NoError(t, err) |
| 415 | + require.NotEmpty(t, tokenResult["access_token"]) |
| 416 | +} |
| 417 | + |
| 418 | +func TestAccessTokenAudienceClaim(t *testing.T) { |
| 419 | + server, _, _ := setupTestServer(t) |
| 420 | + regResp := registerTestClient(t, server.URL) |
| 421 | + |
| 422 | + config := &oauth2.Config{ |
| 423 | + ClientID: regResp.ClientID, |
| 424 | + ClientSecret: regResp.ClientSecret, |
| 425 | + RedirectURL: "http://localhost:8080/callback", |
| 426 | + Scopes: []string{}, |
| 427 | + Endpoint: oauth2.Endpoint{ |
| 428 | + AuthURL: server.URL + AuthorizationEndpoint, |
| 429 | + TokenURL: server.URL + TokenEndpoint, |
| 430 | + }, |
| 431 | + } |
| 432 | + |
| 433 | + callbackURL := testAuthFlowWithURL(t, server.URL, config.AuthCodeURL("test-state")) |
| 434 | + code := callbackURL.Query().Get("code") |
| 435 | + |
| 436 | + tokenReq := url.Values{} |
| 437 | + tokenReq.Set("grant_type", "authorization_code") |
| 438 | + tokenReq.Set("code", code) |
| 439 | + tokenReq.Set("redirect_uri", "http://localhost:8080/callback") |
| 440 | + tokenReq.Set("client_id", regResp.ClientID) |
| 441 | + tokenReq.Set("client_secret", regResp.ClientSecret) |
| 442 | + |
| 443 | + tokenResp, err := http.PostForm(server.URL+TokenEndpoint, tokenReq) |
| 444 | + require.NoError(t, err) |
| 445 | + defer tokenResp.Body.Close() |
| 446 | + require.Equal(t, http.StatusOK, tokenResp.StatusCode) |
| 447 | + |
| 448 | + var tokenResult map[string]any |
| 449 | + err = json.NewDecoder(tokenResp.Body).Decode(&tokenResult) |
| 450 | + require.NoError(t, err) |
| 451 | + |
| 452 | + accessToken := tokenResult["access_token"].(string) |
| 453 | + |
| 454 | + // Decode JWT payload and verify aud claim contains the external URL |
| 455 | + parts := strings.Split(accessToken, ".") |
| 456 | + require.Len(t, parts, 3, "access token should be a JWT with 3 parts") |
| 457 | + |
| 458 | + payload, err := base64.RawURLEncoding.DecodeString(parts[1]) |
| 459 | + require.NoError(t, err) |
| 460 | + |
| 461 | + var claims map[string]any |
| 462 | + err = json.Unmarshal(payload, &claims) |
| 463 | + require.NoError(t, err) |
| 464 | + |
| 465 | + aud, ok := claims["aud"].([]any) |
| 466 | + require.True(t, ok, "aud claim should be present as an array") |
| 467 | + require.Contains(t, aud, "http://localhost:8080", "aud should contain the external URL") |
| 468 | +} |
0 commit comments