e936407452
- Added a comprehensive test for the OAuth client registration endpoint, ensuring proper handling of valid requests and responses. - Updated the response handling methods to comply with RFC standards, including a new method for direct OAuth responses. - Refactored existing response methods to improve security header management and streamline response generation. - Enhanced test logging for better debugging and verification of response data during OAuth registration tests.
116 lines
4 KiB
Go
116 lines
4 KiB
Go
package openapi
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"io"
|
|
"net/http"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/yaoapp/yao/openapi/oauth/types"
|
|
)
|
|
|
|
func TestOAuthRegister(t *testing.T) {
|
|
serverURL := Prepare(t)
|
|
defer Clean()
|
|
|
|
// Debug: Check if Server is properly initialized
|
|
if Server == nil {
|
|
t.Fatal("OpenAPI Server is nil")
|
|
}
|
|
|
|
if Server.Config == nil {
|
|
t.Fatal("OpenAPI Server.Config is nil")
|
|
}
|
|
|
|
if Server.OAuth == nil {
|
|
t.Fatal("OpenAPI Server.OAuth is nil")
|
|
}
|
|
|
|
t.Logf("Server initialized with BaseURL: %s", Server.Config.BaseURL)
|
|
|
|
// Get base URL from server config
|
|
baseURL := ""
|
|
if Server != nil && Server.Config != nil {
|
|
baseURL = Server.Config.BaseURL
|
|
}
|
|
|
|
endpoint := serverURL + baseURL + "/oauth/register"
|
|
t.Logf("Testing endpoint: %s", endpoint)
|
|
|
|
t.Run("Valid Client Registration", func(t *testing.T) {
|
|
// Minimal valid registration request to isolate the issue
|
|
req := types.DynamicClientRegistrationRequest{
|
|
RedirectURIs: []string{
|
|
"http://localhost/callback",
|
|
},
|
|
ClientName: "Test Client",
|
|
}
|
|
|
|
// Convert to JSON
|
|
jsonData, err := json.Marshal(req)
|
|
assert.NoError(t, err)
|
|
t.Logf("Request JSON: %s", string(jsonData))
|
|
|
|
// Make POST request
|
|
t.Logf("Making POST request to: %s", endpoint)
|
|
resp, err := http.Post(endpoint, "application/json", bytes.NewBuffer(jsonData))
|
|
assert.NoError(t, err)
|
|
assert.NotNil(t, resp)
|
|
defer resp.Body.Close()
|
|
|
|
t.Logf("Response status code: %d", resp.StatusCode)
|
|
|
|
// Verify OAuth 2.1 security headers are present
|
|
assert.Equal(t, "no-store", resp.Header.Get("Cache-Control"), "Cache-Control header should be set")
|
|
assert.Equal(t, "no-cache", resp.Header.Get("Pragma"), "Pragma header should be set")
|
|
assert.Equal(t, "nosniff", resp.Header.Get("X-Content-Type-Options"), "X-Content-Type-Options header should be set")
|
|
assert.Equal(t, "DENY", resp.Header.Get("X-Frame-Options"), "X-Frame-Options header should be set")
|
|
assert.Equal(t, "no-referrer", resp.Header.Get("Referrer-Policy"), "Referrer-Policy header should be set")
|
|
assert.Equal(t, "application/json;charset=UTF-8", resp.Header.Get("Content-Type"), "Content-Type header should be set")
|
|
|
|
// Read the complete response body for debugging
|
|
bodyBytes, _ := io.ReadAll(resp.Body)
|
|
t.Logf("Complete response body: %s", string(bodyBytes))
|
|
|
|
// Reset the response body for JSON decoding
|
|
resp.Body = io.NopCloser(bytes.NewReader(bodyBytes))
|
|
|
|
// Check status code
|
|
if resp.StatusCode != http.StatusCreated {
|
|
// Read error response for debugging
|
|
body, _ := io.ReadAll(resp.Body)
|
|
t.Logf("Expected 201, got %d. Response: %s", resp.StatusCode, string(body))
|
|
}
|
|
assert.Equal(t, http.StatusCreated, resp.StatusCode)
|
|
|
|
// Parse response
|
|
t.Logf("Parsing response body...")
|
|
var response types.DynamicClientRegistrationResponse
|
|
err = json.NewDecoder(resp.Body).Decode(&response)
|
|
if err != nil {
|
|
t.Logf("Failed to decode response: %v", err)
|
|
}
|
|
assert.NoError(t, err)
|
|
|
|
t.Logf("Response ClientID: %s", response.ClientID)
|
|
t.Logf("Response ClientSecret: %s", response.ClientSecret)
|
|
|
|
// Verify response contains generated client credentials
|
|
assert.NotEmpty(t, response.ClientID)
|
|
assert.NotEmpty(t, response.ClientSecret)
|
|
|
|
// Verify request data is preserved in response
|
|
if response.DynamicClientRegistrationRequest != nil {
|
|
assert.Equal(t, req.ClientName, response.DynamicClientRegistrationRequest.ClientName)
|
|
assert.Equal(t, req.RedirectURIs, response.DynamicClientRegistrationRequest.RedirectURIs)
|
|
|
|
// Verify that default values were applied when not specified in request
|
|
assert.NotEmpty(t, response.DynamicClientRegistrationRequest.GrantTypes, "Server should apply default grant types")
|
|
assert.NotEmpty(t, response.DynamicClientRegistrationRequest.ResponseTypes, "Server should apply default response types")
|
|
assert.Equal(t, "web", response.DynamicClientRegistrationRequest.ApplicationType, "Server should apply default application type")
|
|
assert.Equal(t, "client_secret_basic", response.DynamicClientRegistrationRequest.TokenEndpointAuthMethod, "Server should apply default auth method")
|
|
}
|
|
})
|
|
}
|