probo/pkg/iam/oauth2/metadata_test.go

// Copyright (c) 2026 Probo Inc <hello@probo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.

package oauth2_test

import (
	"slices"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
	"go.probo.inc/probo/pkg/coredata"
	"go.probo.inc/probo/pkg/iam/oauth2"
	"go.probo.inc/probo/pkg/iam/oauth2scope"
	"go.probo.inc/probo/pkg/probo"
	"go.probo.inc/probo/pkg/uri"
)

func TestNewMetadata(t *testing.T) {
	t.Parallel()

	reg := oauth2scope.NewRegistry().Register(
		map[coredata.OAuth2Scope][]string{
			probo.ScopeV1DocumentRead: {"core:document:get"},
		},
	)

	issuer := uri.URI("https://auth.example.com")
	endpoints := oauth2.Endpoints{
		Authorization:       "https://auth.example.com/authorize",
		Token:               "https://auth.example.com/token",
		Userinfo:            "https://auth.example.com/userinfo",
		JWKS:                "https://auth.example.com/.well-known/jwks.json",
		Registration:        "https://auth.example.com/register",
		Introspection:       "https://auth.example.com/introspect",
		Revocation:          "https://auth.example.com/revoke",
		DeviceAuthorization: "https://auth.example.com/device",
	}

	metadata := oauth2.NewMetadata(issuer, endpoints, reg.RegisteredScopes())
	require.NotNil(t, metadata)

	t.Run(
		"issuer",
		func(t *testing.T) {
			t.Parallel()

			assert.Equal(t, issuer, metadata.Issuer)
		},
	)

	t.Run(
		"endpoints",
		func(t *testing.T) {
			t.Parallel()

			assert.Equal(t, endpoints.Authorization, metadata.AuthorizationEndpoint)
			assert.Equal(t, endpoints.Token, metadata.TokenEndpoint)
			assert.Equal(t, endpoints.Userinfo, metadata.UserinfoEndpoint)
			assert.Equal(t, endpoints.JWKS, metadata.JwksURI)
			assert.Equal(t, endpoints.Registration, metadata.RegistrationEndpoint)
			assert.Equal(t, endpoints.Introspection, metadata.IntrospectionEndpoint)
			assert.Equal(t, endpoints.Revocation, metadata.RevocationEndpoint)
			assert.Equal(t, endpoints.DeviceAuthorization, metadata.DeviceAuthorizationEndpoint)
		},
	)

	t.Run(
		"scopes supported",
		func(t *testing.T) {
			t.Parallel()

			expectedScopes := slices.Concat(
				[]coredata.OAuth2Scope{
					oauth2.ScopeOpenID,
					oauth2.ScopeProfile,
					oauth2.ScopeEmail,
					oauth2.ScopeOfflineAccess,
				},
				reg.RegisteredScopes(),
			)

			assert.Equal(t, expectedScopes, metadata.ScopesSupported)
			assert.Contains(t, metadata.ScopesSupported, oauth2.ScopeOpenID)
			assert.Contains(t, metadata.ScopesSupported, probo.ScopeV1DocumentRead)
		},
	)

	t.Run(
		"protected resources",
		func(t *testing.T) {
			t.Parallel()

			assert.Equal(t, []uri.URI{issuer}, metadata.ProtectedResources)
		},
	)

	t.Run(
		"response types supported",
		func(t *testing.T) {
			t.Parallel()

			assert.Equal(
				t,
				[]coredata.OAuth2ResponseType{
					coredata.OAuth2ResponseTypeCode,
				},
				metadata.ResponseTypesSupported,
			)
		},
	)

	t.Run(
		"grant types supported",
		func(t *testing.T) {
			t.Parallel()

			assert.Equal(
				t,
				[]coredata.OAuth2GrantType{
					coredata.OAuth2GrantTypeAuthorizationCode,
					coredata.OAuth2GrantTypeRefreshToken,
					coredata.OAuth2GrantTypeDeviceCode,
				},
				metadata.GrantTypesSupported,
			)
		},
	)

	t.Run(
		"token endpoint auth methods supported",
		func(t *testing.T) {
			t.Parallel()

			assert.Equal(
				t,
				[]coredata.OAuth2ClientTokenEndpointAuthMethod{
					coredata.OAuth2ClientTokenEndpointAuthMethodClientSecretBasic,
					coredata.OAuth2ClientTokenEndpointAuthMethodClientSecretPost,
					coredata.OAuth2ClientTokenEndpointAuthMethodNone,
				},
				metadata.TokenEndpointAuthMethodsSupported,
			)
		},
	)

	t.Run(
		"revocation endpoint auth methods supported",
		func(t *testing.T) {
			t.Parallel()

			assert.Equal(
				t,
				[]coredata.OAuth2ClientTokenEndpointAuthMethod{
					coredata.OAuth2ClientTokenEndpointAuthMethodClientSecretBasic,
					coredata.OAuth2ClientTokenEndpointAuthMethodClientSecretPost,
					coredata.OAuth2ClientTokenEndpointAuthMethodNone,
				},
				metadata.RevocationEndpointAuthMethodsSupported,
			)
		},
	)

	t.Run(
		"introspection endpoint auth methods supported",
		func(t *testing.T) {
			t.Parallel()

			assert.Equal(
				t,
				[]coredata.OAuth2ClientTokenEndpointAuthMethod{
					coredata.OAuth2ClientTokenEndpointAuthMethodClientSecretBasic,
					coredata.OAuth2ClientTokenEndpointAuthMethodClientSecretPost,
					coredata.OAuth2ClientTokenEndpointAuthMethodNone,
				},
				metadata.IntrospectionEndpointAuthMethodsSupported,
			)
		},
	)

	t.Run(
		"subject types supported",
		func(t *testing.T) {
			t.Parallel()

			assert.Equal(
				t,
				[]coredata.OAuth2SubjectType{
					coredata.OAuth2SubjectTypePublic,
				},
				metadata.SubjectTypesSupported,
			)
		},
	)

	t.Run(
		"id token signing algorithms supported",
		func(t *testing.T) {
			t.Parallel()

			assert.Equal(
				t,
				[]coredata.OAuth2SigningAlgorithm{
					coredata.OAuth2SigningAlgorithmRS256,
				},
				metadata.IDTokenSigningAlgValuesSupported,
			)
		},
	)

	t.Run(
		"code challenge methods supported",
		func(t *testing.T) {
			t.Parallel()

			assert.Equal(
				t,
				[]coredata.OAuth2CodeChallengeMethod{
					coredata.OAuth2CodeChallengeMethodS256,
				},
				metadata.CodeChallengeMethodsSupported,
			)
		},
	)

	t.Run(
		"claims supported",
		func(t *testing.T) {
			t.Parallel()

			assert.Equal(
				t,
				[]coredata.OAuth2Claim{
					coredata.OAuth2ClaimIssuer,
					coredata.OAuth2ClaimSubject,
					coredata.OAuth2ClaimAudience,
					coredata.OAuth2ClaimExpiration,
					coredata.OAuth2ClaimIssuedAt,
					coredata.OAuth2ClaimAuthTime,
					coredata.OAuth2ClaimNonce,
					coredata.OAuth2ClaimAtHash,
					coredata.OAuth2ClaimEmail,
					coredata.OAuth2ClaimEmailVerified,
					coredata.OAuth2ClaimName,
				},
				metadata.ClaimsSupported,
			)
		},
	)

	t.Run(
		"cimd supported",
		func(t *testing.T) {
			t.Parallel()

			assert.True(t, metadata.ClientIDMetadataDocumentSupported)
		},
	)
}