6da00604ed
Fill in certificate renewal processing, preserve OAuth and JWKS edge cases, embed the compliance-portal app in production builds, and close the smaller portal routing and n8n update gaps. Signed-off-by: Bryan Frimin <bryan@probo.com>
354 lines
9.2 KiB
Go
354 lines
9.2 KiB
Go
// Copyright (c) 2026 Probo Inc <hello@probo.com>.
|
|
//
|
|
// Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
// of this software and associated documentation files (the "Software"), to deal
|
|
// in the Software without restriction, including without limitation the rights
|
|
// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
// copies of the Software, and to permit persons to whom the Software is
|
|
// furnished to do so, subject to the following conditions:
|
|
//
|
|
// The above copyright notice and this permission notice shall be included in
|
|
// all copies or substantial portions of the Software.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
// SOFTWARE.
|
|
|
|
package oauth2_test
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"net/url"
|
|
"slices"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"go.gearno.de/kit/httpclient"
|
|
"go.probo.inc/probo/pkg/coredata"
|
|
"go.probo.inc/probo/pkg/iam/oauth2"
|
|
"go.probo.inc/probo/pkg/iam/oauth2scope"
|
|
"go.probo.inc/probo/pkg/probo"
|
|
"go.probo.inc/probo/pkg/uri"
|
|
)
|
|
|
|
func TestFetchServerMetadata(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
server := httptest.NewServer(
|
|
http.HandlerFunc(
|
|
func(w http.ResponseWriter, r *http.Request) {
|
|
assert.Equal(t, "/.well-known/openid-configuration", r.URL.Path)
|
|
|
|
_ = json.NewEncoder(w).Encode(
|
|
map[string]string{
|
|
"issuer": "https://auth.example.com",
|
|
"authorization_endpoint": "https://auth.example.com/api/connect/v1/oauth2/authorize",
|
|
"token_endpoint": "https://auth.example.com/api/connect/v1/oauth2/token",
|
|
},
|
|
)
|
|
},
|
|
),
|
|
)
|
|
t.Cleanup(server.Close)
|
|
|
|
client := httpclient.DefaultClient(
|
|
httpclient.WithSSRFProtection(),
|
|
httpclient.WithSSRFAllowLoopback(),
|
|
)
|
|
|
|
metadata, err := oauth2.FetchServerMetadata(context.Background(), client, server.URL)
|
|
require.NoError(t, err)
|
|
assert.Equal(
|
|
t,
|
|
uri.URI("https://auth.example.com/api/connect/v1/oauth2/authorize"),
|
|
metadata.AuthorizationEndpoint,
|
|
)
|
|
}
|
|
|
|
func TestAuthorizationURLWithQuery(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
authorizationEndpoint := uri.URI("https://auth.example.com/api/connect/v1/oauth2/authorize")
|
|
query := url.Values{}
|
|
query.Set("client_id", "https://trust.example.com/.well-known/oauth-client-metadata")
|
|
query.Set("response_type", "code")
|
|
|
|
got, err := oauth2.AuthorizationURLWithQuery(authorizationEndpoint, query)
|
|
require.NoError(t, err)
|
|
assert.Equal(
|
|
t,
|
|
"https://auth.example.com/api/connect/v1/oauth2/authorize?client_id=https%3A%2F%2Ftrust.example.com%2F.well-known%2Foauth-client-metadata&response_type=code",
|
|
got,
|
|
)
|
|
}
|
|
|
|
func TestAuthorizationURLWithQueryPreservesEndpointQuery(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
authorizationEndpoint := uri.URI(
|
|
"https://auth.example.com/api/connect/v1/oauth2/authorize?tenant=acme",
|
|
)
|
|
query := url.Values{}
|
|
query.Set("client_id", "https://trust.example.com/.well-known/oauth-client-metadata")
|
|
query.Set("response_type", "code")
|
|
|
|
got, err := oauth2.AuthorizationURLWithQuery(authorizationEndpoint, query)
|
|
require.NoError(t, err)
|
|
|
|
parsed, err := url.Parse(got)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "acme", parsed.Query().Get("tenant"))
|
|
assert.Equal(t, "https://trust.example.com/.well-known/oauth-client-metadata", parsed.Query().Get("client_id"))
|
|
assert.Equal(t, "code", parsed.Query().Get("response_type"))
|
|
}
|
|
|
|
func TestNewMetadata(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
reg := oauth2scope.NewRegistry().Register(
|
|
map[coredata.OAuth2Scope][]string{
|
|
probo.ScopeV1DocumentRead: {"core:document:get"},
|
|
},
|
|
)
|
|
|
|
issuer := uri.URI("https://auth.example.com")
|
|
endpoints := oauth2.Endpoints{
|
|
Authorization: "https://auth.example.com/authorize",
|
|
Token: "https://auth.example.com/token",
|
|
Userinfo: "https://auth.example.com/userinfo",
|
|
JWKS: "https://auth.example.com/.well-known/jwks.json",
|
|
Registration: "https://auth.example.com/register",
|
|
Introspection: "https://auth.example.com/introspect",
|
|
Revocation: "https://auth.example.com/revoke",
|
|
DeviceAuthorization: "https://auth.example.com/device",
|
|
}
|
|
|
|
metadata := oauth2.NewMetadata(issuer, endpoints, reg.RegisteredScopes())
|
|
require.NotNil(t, metadata)
|
|
|
|
t.Run(
|
|
"issuer",
|
|
func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
assert.Equal(t, issuer, metadata.Issuer)
|
|
},
|
|
)
|
|
|
|
t.Run(
|
|
"endpoints",
|
|
func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
assert.Equal(t, endpoints.Authorization, metadata.AuthorizationEndpoint)
|
|
assert.Equal(t, endpoints.Token, metadata.TokenEndpoint)
|
|
assert.Equal(t, endpoints.Userinfo, metadata.UserinfoEndpoint)
|
|
assert.Equal(t, endpoints.JWKS, metadata.JwksURI)
|
|
assert.Equal(t, endpoints.Registration, metadata.RegistrationEndpoint)
|
|
assert.Equal(t, endpoints.Introspection, metadata.IntrospectionEndpoint)
|
|
assert.Equal(t, endpoints.Revocation, metadata.RevocationEndpoint)
|
|
assert.Equal(t, endpoints.DeviceAuthorization, metadata.DeviceAuthorizationEndpoint)
|
|
},
|
|
)
|
|
|
|
t.Run(
|
|
"scopes supported",
|
|
func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
expectedScopes := slices.Concat(
|
|
[]coredata.OAuth2Scope{
|
|
oauth2.ScopeOpenID,
|
|
oauth2.ScopeProfile,
|
|
oauth2.ScopeEmail,
|
|
oauth2.ScopeOfflineAccess,
|
|
},
|
|
reg.RegisteredScopes(),
|
|
)
|
|
|
|
assert.Equal(t, expectedScopes, metadata.ScopesSupported)
|
|
assert.Contains(t, metadata.ScopesSupported, oauth2.ScopeOpenID)
|
|
assert.Contains(t, metadata.ScopesSupported, probo.ScopeV1DocumentRead)
|
|
},
|
|
)
|
|
|
|
t.Run(
|
|
"protected resources",
|
|
func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
assert.Equal(t, []uri.URI{issuer}, metadata.ProtectedResources)
|
|
},
|
|
)
|
|
|
|
t.Run(
|
|
"response types supported",
|
|
func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
assert.Equal(
|
|
t,
|
|
[]coredata.OAuth2ResponseType{
|
|
coredata.OAuth2ResponseTypeCode,
|
|
},
|
|
metadata.ResponseTypesSupported,
|
|
)
|
|
},
|
|
)
|
|
|
|
t.Run(
|
|
"grant types supported",
|
|
func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
assert.Equal(
|
|
t,
|
|
[]coredata.OAuth2GrantType{
|
|
coredata.OAuth2GrantTypeAuthorizationCode,
|
|
coredata.OAuth2GrantTypeRefreshToken,
|
|
coredata.OAuth2GrantTypeDeviceCode,
|
|
},
|
|
metadata.GrantTypesSupported,
|
|
)
|
|
},
|
|
)
|
|
|
|
t.Run(
|
|
"token endpoint auth methods supported",
|
|
func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
assert.Equal(
|
|
t,
|
|
[]coredata.OAuth2ClientTokenEndpointAuthMethod{
|
|
coredata.OAuth2ClientTokenEndpointAuthMethodClientSecretBasic,
|
|
coredata.OAuth2ClientTokenEndpointAuthMethodClientSecretPost,
|
|
coredata.OAuth2ClientTokenEndpointAuthMethodNone,
|
|
},
|
|
metadata.TokenEndpointAuthMethodsSupported,
|
|
)
|
|
},
|
|
)
|
|
|
|
t.Run(
|
|
"revocation endpoint auth methods supported",
|
|
func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
assert.Equal(
|
|
t,
|
|
[]coredata.OAuth2ClientTokenEndpointAuthMethod{
|
|
coredata.OAuth2ClientTokenEndpointAuthMethodClientSecretBasic,
|
|
coredata.OAuth2ClientTokenEndpointAuthMethodClientSecretPost,
|
|
coredata.OAuth2ClientTokenEndpointAuthMethodNone,
|
|
},
|
|
metadata.RevocationEndpointAuthMethodsSupported,
|
|
)
|
|
},
|
|
)
|
|
|
|
t.Run(
|
|
"introspection endpoint auth methods supported",
|
|
func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
assert.Equal(
|
|
t,
|
|
[]coredata.OAuth2ClientTokenEndpointAuthMethod{
|
|
coredata.OAuth2ClientTokenEndpointAuthMethodClientSecretBasic,
|
|
coredata.OAuth2ClientTokenEndpointAuthMethodClientSecretPost,
|
|
coredata.OAuth2ClientTokenEndpointAuthMethodNone,
|
|
},
|
|
metadata.IntrospectionEndpointAuthMethodsSupported,
|
|
)
|
|
},
|
|
)
|
|
|
|
t.Run(
|
|
"subject types supported",
|
|
func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
assert.Equal(
|
|
t,
|
|
[]coredata.OAuth2SubjectType{
|
|
coredata.OAuth2SubjectTypePublic,
|
|
},
|
|
metadata.SubjectTypesSupported,
|
|
)
|
|
},
|
|
)
|
|
|
|
t.Run(
|
|
"id token signing algorithms supported",
|
|
func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
assert.Equal(
|
|
t,
|
|
[]coredata.OAuth2SigningAlgorithm{
|
|
coredata.OAuth2SigningAlgorithmRS256,
|
|
},
|
|
metadata.IDTokenSigningAlgValuesSupported,
|
|
)
|
|
},
|
|
)
|
|
|
|
t.Run(
|
|
"code challenge methods supported",
|
|
func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
assert.Equal(
|
|
t,
|
|
[]coredata.OAuth2CodeChallengeMethod{
|
|
coredata.OAuth2CodeChallengeMethodS256,
|
|
},
|
|
metadata.CodeChallengeMethodsSupported,
|
|
)
|
|
},
|
|
)
|
|
|
|
t.Run(
|
|
"claims supported",
|
|
func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
assert.Equal(
|
|
t,
|
|
[]coredata.OAuth2Claim{
|
|
coredata.OAuth2ClaimIssuer,
|
|
coredata.OAuth2ClaimSubject,
|
|
coredata.OAuth2ClaimAudience,
|
|
coredata.OAuth2ClaimExpiration,
|
|
coredata.OAuth2ClaimIssuedAt,
|
|
coredata.OAuth2ClaimAuthTime,
|
|
coredata.OAuth2ClaimNonce,
|
|
coredata.OAuth2ClaimAtHash,
|
|
coredata.OAuth2ClaimEmail,
|
|
coredata.OAuth2ClaimEmailVerified,
|
|
coredata.OAuth2ClaimName,
|
|
},
|
|
metadata.ClaimsSupported,
|
|
)
|
|
},
|
|
)
|
|
|
|
t.Run(
|
|
"cimd supported",
|
|
func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
assert.True(t, metadata.ClientIDMetadataDocumentSupported)
|
|
},
|
|
)
|
|
}
|