324 lines
11 KiB
Go
324 lines
11 KiB
Go
package openapi
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"io"
|
|
"net/http"
|
|
"net/url"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/yaoapp/yao/openapi/oauth/types"
|
|
)
|
|
|
|
func TestOAuthRegister(t *testing.T) {
|
|
serverURL := Prepare(t)
|
|
defer Clean()
|
|
|
|
// Debug: Check if Server is properly initialized
|
|
if Server == nil {
|
|
t.Fatal("OpenAPI Server is nil")
|
|
}
|
|
|
|
if Server.Config == nil {
|
|
t.Fatal("OpenAPI Server.Config is nil")
|
|
}
|
|
|
|
if Server.OAuth == nil {
|
|
t.Fatal("OpenAPI Server.OAuth is nil")
|
|
}
|
|
|
|
t.Logf("Server initialized with BaseURL: %s", Server.Config.BaseURL)
|
|
|
|
// Get base URL from server config
|
|
baseURL := ""
|
|
if Server != nil && Server.Config != nil {
|
|
baseURL = Server.Config.BaseURL
|
|
}
|
|
|
|
endpoint := serverURL + baseURL + "/oauth/register"
|
|
t.Logf("Testing endpoint: %s", endpoint)
|
|
|
|
t.Run("Valid Client Registration", func(t *testing.T) {
|
|
// Minimal valid registration request to isolate the issue
|
|
req := types.DynamicClientRegistrationRequest{
|
|
RedirectURIs: []string{
|
|
"http://localhost/callback",
|
|
},
|
|
ClientName: "Test Client",
|
|
}
|
|
|
|
// Convert to JSON
|
|
jsonData, err := json.Marshal(req)
|
|
assert.NoError(t, err)
|
|
t.Logf("Request JSON: %s", string(jsonData))
|
|
|
|
// Make POST request
|
|
t.Logf("Making POST request to: %s", endpoint)
|
|
resp, err := http.Post(endpoint, "application/json", bytes.NewBuffer(jsonData))
|
|
assert.NoError(t, err)
|
|
assert.NotNil(t, resp)
|
|
defer resp.Body.Close()
|
|
|
|
t.Logf("Response status code: %d", resp.StatusCode)
|
|
|
|
// Verify OAuth 2.1 security headers are present
|
|
assert.Equal(t, "no-store", resp.Header.Get("Cache-Control"), "Cache-Control header should be set")
|
|
assert.Equal(t, "no-cache", resp.Header.Get("Pragma"), "Pragma header should be set")
|
|
assert.Equal(t, "nosniff", resp.Header.Get("X-Content-Type-Options"), "X-Content-Type-Options header should be set")
|
|
assert.Equal(t, "DENY", resp.Header.Get("X-Frame-Options"), "X-Frame-Options header should be set")
|
|
assert.Equal(t, "no-referrer", resp.Header.Get("Referrer-Policy"), "Referrer-Policy header should be set")
|
|
assert.Equal(t, "application/json;charset=UTF-8", resp.Header.Get("Content-Type"), "Content-Type header should be set")
|
|
|
|
// Read the complete response body for debugging
|
|
bodyBytes, _ := io.ReadAll(resp.Body)
|
|
t.Logf("Complete response body: %s", string(bodyBytes))
|
|
|
|
// Reset the response body for JSON decoding
|
|
resp.Body = io.NopCloser(bytes.NewReader(bodyBytes))
|
|
|
|
// Check status code
|
|
if resp.StatusCode != http.StatusCreated {
|
|
// Read error response for debugging
|
|
body, _ := io.ReadAll(resp.Body)
|
|
t.Logf("Expected 201, got %d. Response: %s", resp.StatusCode, string(body))
|
|
}
|
|
assert.Equal(t, http.StatusCreated, resp.StatusCode)
|
|
|
|
// Parse response
|
|
t.Logf("Parsing response body...")
|
|
var response types.DynamicClientRegistrationResponse
|
|
err = json.NewDecoder(resp.Body).Decode(&response)
|
|
if err != nil {
|
|
t.Logf("Failed to decode response: %v", err)
|
|
}
|
|
assert.NoError(t, err)
|
|
|
|
t.Logf("Response ClientID: %s", response.ClientID)
|
|
t.Logf("Response ClientSecret: %s", response.ClientSecret)
|
|
|
|
// Verify response contains generated client credentials
|
|
assert.NotEmpty(t, response.ClientID)
|
|
assert.NotEmpty(t, response.ClientSecret)
|
|
|
|
// Verify request data is preserved in response
|
|
if response.DynamicClientRegistrationRequest != nil {
|
|
assert.Equal(t, req.ClientName, response.DynamicClientRegistrationRequest.ClientName)
|
|
assert.Equal(t, req.RedirectURIs, response.DynamicClientRegistrationRequest.RedirectURIs)
|
|
|
|
// Verify that default values were applied when not specified in request
|
|
assert.NotEmpty(t, response.DynamicClientRegistrationRequest.GrantTypes, "Server should apply default grant types")
|
|
assert.NotEmpty(t, response.DynamicClientRegistrationRequest.ResponseTypes, "Server should apply default response types")
|
|
assert.Equal(t, "web", response.DynamicClientRegistrationRequest.ApplicationType, "Server should apply default application type")
|
|
assert.Equal(t, "client_secret_basic", response.DynamicClientRegistrationRequest.TokenEndpointAuthMethod, "Server should apply default auth method")
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestOAuthAuthorize(t *testing.T) {
|
|
serverURL := Prepare(t)
|
|
defer Clean()
|
|
|
|
// Register a test client for realistic testing
|
|
testClient := RegisterTestClient(t, "OAuth Test Client", []string{"http://localhost/callback"})
|
|
defer CleanupTestClient(t, testClient.ClientID)
|
|
|
|
// Prepare test data
|
|
endpoint := serverURL + Server.Config.BaseURL + "/oauth/authorize"
|
|
t.Logf("Testing authorize endpoint: %s", endpoint)
|
|
|
|
t.Run("Valid Authorization Request", func(t *testing.T) {
|
|
// Test valid authorization request with real client
|
|
params := url.Values{}
|
|
params.Set("client_id", testClient.ClientID) // Use real registered client ID
|
|
params.Set("response_type", "code")
|
|
params.Set("redirect_uri", testClient.RedirectURIs[0]) // Use registered redirect URI
|
|
params.Set("scope", "openid profile")
|
|
params.Set("state", "test-state-123")
|
|
|
|
requestURL := endpoint + "?" + params.Encode()
|
|
t.Logf("Making GET request to: %s", requestURL)
|
|
|
|
// Configure HTTP client to not follow redirects automatically
|
|
client := &http.Client{
|
|
CheckRedirect: func(req *http.Request, via []*http.Request) error {
|
|
return http.ErrUseLastResponse
|
|
},
|
|
}
|
|
|
|
resp, err := client.Get(requestURL)
|
|
assert.NoError(t, err)
|
|
assert.NotNil(t, resp)
|
|
defer resp.Body.Close()
|
|
|
|
t.Logf("Response status code: %d", resp.StatusCode)
|
|
|
|
// Should redirect with either success (302) or error (302)
|
|
assert.Equal(t, http.StatusFound, resp.StatusCode)
|
|
|
|
// Check redirect location
|
|
location := resp.Header.Get("Location")
|
|
assert.NotEmpty(t, location, "Location header should be present")
|
|
t.Logf("Redirect location: %s", location)
|
|
|
|
// Parse redirect URL to check parameters
|
|
redirectURL, err := url.Parse(location)
|
|
assert.NoError(t, err)
|
|
|
|
// Should contain either 'code' (success) or 'error' (failure) parameter
|
|
query := redirectURL.Query()
|
|
hasCode := query.Get("code") != ""
|
|
hasError := query.Get("error") != ""
|
|
assert.True(t, hasCode || hasError, "Redirect should contain either 'code' or 'error' parameter")
|
|
|
|
// State parameter should be preserved
|
|
assert.Equal(t, "test-state-123", query.Get("state"), "State parameter should be preserved")
|
|
|
|
t.Logf("Authorization result - Code: %s, Error: %s", query.Get("code"), query.Get("error"))
|
|
})
|
|
|
|
t.Run("Invalid Client ID", func(t *testing.T) {
|
|
// Test with invalid client ID
|
|
params := url.Values{}
|
|
params.Set("client_id", "invalid-client-id")
|
|
params.Set("response_type", "code")
|
|
params.Set("redirect_uri", "http://localhost/callback")
|
|
params.Set("scope", "openid profile")
|
|
params.Set("state", "test-state-456")
|
|
|
|
requestURL := endpoint + "?" + params.Encode()
|
|
|
|
client := &http.Client{
|
|
CheckRedirect: func(req *http.Request, via []*http.Request) error {
|
|
return http.ErrUseLastResponse
|
|
},
|
|
}
|
|
|
|
resp, err := client.Get(requestURL)
|
|
assert.NoError(t, err)
|
|
assert.NotNil(t, resp)
|
|
defer resp.Body.Close()
|
|
|
|
assert.Equal(t, http.StatusFound, resp.StatusCode)
|
|
|
|
location := resp.Header.Get("Location")
|
|
redirectURL, err := url.Parse(location)
|
|
assert.NoError(t, err)
|
|
|
|
query := redirectURL.Query()
|
|
assert.Equal(t, "invalid_client", query.Get("error"), "Should return invalid_client error")
|
|
assert.Equal(t, "test-state-456", query.Get("state"), "State should be preserved")
|
|
})
|
|
|
|
t.Run("Valid Authorization Request via POST", func(t *testing.T) {
|
|
// Test valid authorization request with POST method
|
|
form := url.Values{}
|
|
form.Set("client_id", testClient.ClientID)
|
|
form.Set("response_type", "code")
|
|
form.Set("redirect_uri", testClient.RedirectURIs[0])
|
|
form.Set("scope", "openid profile")
|
|
form.Set("state", "test-post-state-789")
|
|
|
|
t.Logf("Making POST request to: %s", endpoint)
|
|
|
|
// Configure HTTP client to not follow redirects automatically
|
|
client := &http.Client{
|
|
CheckRedirect: func(req *http.Request, via []*http.Request) error {
|
|
return http.ErrUseLastResponse
|
|
},
|
|
}
|
|
|
|
resp, err := client.PostForm(endpoint, form)
|
|
assert.NoError(t, err)
|
|
assert.NotNil(t, resp)
|
|
defer resp.Body.Close()
|
|
|
|
t.Logf("Response status code: %d", resp.StatusCode)
|
|
|
|
// Should redirect with either success (302) or error (302)
|
|
assert.Equal(t, http.StatusFound, resp.StatusCode)
|
|
|
|
// Check redirect location
|
|
location := resp.Header.Get("Location")
|
|
assert.NotEmpty(t, location, "Location header should be present")
|
|
t.Logf("Redirect location: %s", location)
|
|
|
|
// Parse redirect URL to check parameters
|
|
redirectURL, err := url.Parse(location)
|
|
assert.NoError(t, err)
|
|
|
|
// Should contain either 'code' (success) or 'error' (failure) parameter
|
|
query := redirectURL.Query()
|
|
hasCode := query.Get("code") != ""
|
|
hasError := query.Get("error") != ""
|
|
assert.True(t, hasCode || hasError, "Redirect should contain either 'code' or 'error' parameter")
|
|
|
|
// State parameter should be preserved
|
|
assert.Equal(t, "test-post-state-789", query.Get("state"), "State parameter should be preserved")
|
|
|
|
t.Logf("Authorization result (POST) - Code: %s, Error: %s", query.Get("code"), query.Get("error"))
|
|
})
|
|
|
|
t.Run("Invalid Response Type via POST", func(t *testing.T) {
|
|
// Test with invalid response type using POST
|
|
form := url.Values{}
|
|
form.Set("client_id", testClient.ClientID)
|
|
form.Set("response_type", "token") // Implicit flow - deprecated in OAuth 2.1
|
|
form.Set("redirect_uri", testClient.RedirectURIs[0])
|
|
form.Set("scope", "openid profile")
|
|
form.Set("state", "test-invalid-response-type")
|
|
|
|
client := &http.Client{
|
|
CheckRedirect: func(req *http.Request, via []*http.Request) error {
|
|
return http.ErrUseLastResponse
|
|
},
|
|
}
|
|
|
|
resp, err := client.PostForm(endpoint, form)
|
|
assert.NoError(t, err)
|
|
assert.NotNil(t, resp)
|
|
defer resp.Body.Close()
|
|
|
|
assert.Equal(t, http.StatusFound, resp.StatusCode)
|
|
|
|
location := resp.Header.Get("Location")
|
|
redirectURL, err := url.Parse(location)
|
|
assert.NoError(t, err)
|
|
|
|
query := redirectURL.Query()
|
|
assert.Equal(t, "unsupported_response_type", query.Get("error"), "Should return unsupported_response_type error")
|
|
assert.Equal(t, "test-invalid-response-type", query.Get("state"), "State should be preserved")
|
|
})
|
|
|
|
t.Run("Missing Required Parameters via POST", func(t *testing.T) {
|
|
// Test with missing client_id using POST
|
|
form := url.Values{}
|
|
// Missing client_id
|
|
form.Set("response_type", "code")
|
|
form.Set("redirect_uri", testClient.RedirectURIs[0])
|
|
form.Set("scope", "openid profile")
|
|
form.Set("state", "test-missing-client-id")
|
|
|
|
client := &http.Client{
|
|
CheckRedirect: func(req *http.Request, via []*http.Request) error {
|
|
return http.ErrUseLastResponse
|
|
},
|
|
}
|
|
|
|
resp, err := client.PostForm(endpoint, form)
|
|
assert.NoError(t, err)
|
|
assert.NotNil(t, resp)
|
|
defer resp.Body.Close()
|
|
|
|
assert.Equal(t, http.StatusFound, resp.StatusCode)
|
|
|
|
location := resp.Header.Get("Location")
|
|
redirectURL, err := url.Parse(location)
|
|
assert.NoError(t, err)
|
|
|
|
query := redirectURL.Query()
|
|
assert.Equal(t, "invalid_request", query.Get("error"), "Should return invalid_request error")
|
|
assert.Equal(t, "test-missing-client-id", query.Get("state"), "State should be preserved")
|
|
})
|
|
}
|