Add OAuth2 API scope registration and enforcement
Register v1 API scopes in coredata, advertise them in OIDC discovery and protected-resource metadata, show them on the consent screen, and enforce scope-to-action mapping in the IAM Authorizer before policy evaluation. Signed-off-by: Ludovic Vielle <ludovic@probo.com>
This commit is contained in:
Ludovic Vielle
256
pkg/iam/oauth2/metadata_test.go
Normal file
256
pkg/iam/oauth2/metadata_test.go
Normal file
@@ -0,0 +1,256 @@
|
||||
// Copyright (c) 2026 Probo Inc <hello@probo.com>.
|
||||
//
|
||||
// Permission to use, copy, modify, and/or distribute this software for any
|
||||
// purpose with or without fee is hereby granted, provided that the above
|
||||
// copyright notice and this permission notice appear in all copies.
|
||||
//
|
||||
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
||||
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
||||
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
// PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
package oauth2_test
|
||||
|
||||
import (
|
||||
"slices"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"go.probo.inc/probo/pkg/coredata"
|
||||
"go.probo.inc/probo/pkg/iam/oauth2"
|
||||
"go.probo.inc/probo/pkg/probo"
|
||||
"go.probo.inc/probo/pkg/uri"
|
||||
)
|
||||
|
||||
func TestNewMetadata(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
apiScopes := []coredata.OAuth2Scope{probo.ScopeV1DocumentRead}
|
||||
|
||||
issuer := uri.URI("https://auth.example.com")
|
||||
endpoints := oauth2.Endpoints{
|
||||
Authorization: "https://auth.example.com/authorize",
|
||||
Token: "https://auth.example.com/token",
|
||||
Userinfo: "https://auth.example.com/userinfo",
|
||||
JWKS: "https://auth.example.com/.well-known/jwks.json",
|
||||
Registration: "https://auth.example.com/register",
|
||||
Introspection: "https://auth.example.com/introspect",
|
||||
Revocation: "https://auth.example.com/revoke",
|
||||
DeviceAuthorization: "https://auth.example.com/device",
|
||||
}
|
||||
|
||||
metadata := oauth2.NewMetadata(issuer, endpoints, apiScopes)
|
||||
require.NotNil(t, metadata)
|
||||
|
||||
t.Run(
|
||||
"issuer",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
assert.Equal(t, issuer, metadata.Issuer)
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"endpoints",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
assert.Equal(t, endpoints.Authorization, metadata.AuthorizationEndpoint)
|
||||
assert.Equal(t, endpoints.Token, metadata.TokenEndpoint)
|
||||
assert.Equal(t, endpoints.Userinfo, metadata.UserinfoEndpoint)
|
||||
assert.Equal(t, endpoints.JWKS, metadata.JwksURI)
|
||||
assert.Equal(t, endpoints.Registration, metadata.RegistrationEndpoint)
|
||||
assert.Equal(t, endpoints.Introspection, metadata.IntrospectionEndpoint)
|
||||
assert.Equal(t, endpoints.Revocation, metadata.RevocationEndpoint)
|
||||
assert.Equal(t, endpoints.DeviceAuthorization, metadata.DeviceAuthorizationEndpoint)
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"scopes supported",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
expectedScopes := slices.Concat(
|
||||
[]coredata.OAuth2Scope{
|
||||
oauth2.ScopeOpenID,
|
||||
oauth2.ScopeProfile,
|
||||
oauth2.ScopeEmail,
|
||||
oauth2.ScopeOfflineAccess,
|
||||
},
|
||||
apiScopes,
|
||||
)
|
||||
|
||||
assert.Equal(t, expectedScopes, metadata.ScopesSupported)
|
||||
assert.Contains(t, metadata.ScopesSupported, oauth2.ScopeOpenID)
|
||||
assert.Contains(t, metadata.ScopesSupported, probo.ScopeV1DocumentRead)
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"protected resources",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
assert.Equal(t, []uri.URI{issuer}, metadata.ProtectedResources)
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"response types supported",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
assert.Equal(
|
||||
t,
|
||||
[]coredata.OAuth2ResponseType{
|
||||
coredata.OAuth2ResponseTypeCode,
|
||||
},
|
||||
metadata.ResponseTypesSupported,
|
||||
)
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"grant types supported",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
assert.Equal(
|
||||
t,
|
||||
[]coredata.OAuth2GrantType{
|
||||
coredata.OAuth2GrantTypeAuthorizationCode,
|
||||
coredata.OAuth2GrantTypeRefreshToken,
|
||||
coredata.OAuth2GrantTypeDeviceCode,
|
||||
},
|
||||
metadata.GrantTypesSupported,
|
||||
)
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"token endpoint auth methods supported",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
assert.Equal(
|
||||
t,
|
||||
[]coredata.OAuth2ClientTokenEndpointAuthMethod{
|
||||
coredata.OAuth2ClientTokenEndpointAuthMethodClientSecretBasic,
|
||||
coredata.OAuth2ClientTokenEndpointAuthMethodClientSecretPost,
|
||||
coredata.OAuth2ClientTokenEndpointAuthMethodNone,
|
||||
},
|
||||
metadata.TokenEndpointAuthMethodsSupported,
|
||||
)
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"revocation endpoint auth methods supported",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
assert.Equal(
|
||||
t,
|
||||
[]coredata.OAuth2ClientTokenEndpointAuthMethod{
|
||||
coredata.OAuth2ClientTokenEndpointAuthMethodClientSecretBasic,
|
||||
coredata.OAuth2ClientTokenEndpointAuthMethodClientSecretPost,
|
||||
coredata.OAuth2ClientTokenEndpointAuthMethodNone,
|
||||
},
|
||||
metadata.RevocationEndpointAuthMethodsSupported,
|
||||
)
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"introspection endpoint auth methods supported",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
assert.Equal(
|
||||
t,
|
||||
[]coredata.OAuth2ClientTokenEndpointAuthMethod{
|
||||
coredata.OAuth2ClientTokenEndpointAuthMethodClientSecretBasic,
|
||||
coredata.OAuth2ClientTokenEndpointAuthMethodClientSecretPost,
|
||||
coredata.OAuth2ClientTokenEndpointAuthMethodNone,
|
||||
},
|
||||
metadata.IntrospectionEndpointAuthMethodsSupported,
|
||||
)
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"subject types supported",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
assert.Equal(
|
||||
t,
|
||||
[]coredata.OAuth2SubjectType{
|
||||
coredata.OAuth2SubjectTypePublic,
|
||||
},
|
||||
metadata.SubjectTypesSupported,
|
||||
)
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"id token signing algorithms supported",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
assert.Equal(
|
||||
t,
|
||||
[]coredata.OAuth2SigningAlgorithm{
|
||||
coredata.OAuth2SigningAlgorithmRS256,
|
||||
},
|
||||
metadata.IDTokenSigningAlgValuesSupported,
|
||||
)
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"code challenge methods supported",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
assert.Equal(
|
||||
t,
|
||||
[]coredata.OAuth2CodeChallengeMethod{
|
||||
coredata.OAuth2CodeChallengeMethodS256,
|
||||
},
|
||||
metadata.CodeChallengeMethodsSupported,
|
||||
)
|
||||
},
|
||||
)
|
||||
|
||||
t.Run(
|
||||
"claims supported",
|
||||
func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
assert.Equal(
|
||||
t,
|
||||
[]coredata.OAuth2Claim{
|
||||
coredata.OAuth2ClaimIssuer,
|
||||
coredata.OAuth2ClaimSubject,
|
||||
coredata.OAuth2ClaimAudience,
|
||||
coredata.OAuth2ClaimExpiration,
|
||||
coredata.OAuth2ClaimIssuedAt,
|
||||
coredata.OAuth2ClaimAuthTime,
|
||||
coredata.OAuth2ClaimNonce,
|
||||
coredata.OAuth2ClaimAtHash,
|
||||
coredata.OAuth2ClaimEmail,
|
||||
coredata.OAuth2ClaimEmailVerified,
|
||||
coredata.OAuth2ClaimName,
|
||||
},
|
||||
metadata.ClaimsSupported,
|
||||
)
|
||||
},
|
||||
)
|
||||
}
|
||||
Reference in New Issue
Block a user