auth

Paddy 2015-01-18 Parent:e000b1c24fc0 Child:dcd2125c4f57

123:0a1e16b9c141 Go to Latest

auth/token_test.go

Refactor verifyClient, implement refresh tokens. Refactor verifyClient into verifyClient and getClientAuth. We moved verifyClient out of each of the GrantType's validation functions and into the access token endpoint, where it will be called before the GrantType's validation function. Yay, less code repetition. And seeing as we always want to verify the client, that seems like a good way to prevent things like 118a69954621 from happening. This did, however, force us to add an AllowsPublic property to the GrantType, so the token endpoint knows whether or not a public Client is valid for any given GrantType. We also implemented the refresh token grant type, which required adding ClientID and RefreshRevoked as properties on the Token type. We need ClientID because we need to constrain refresh tokens to the client that issued them. We also should probably keep track of which tokens belong to which clients, just as a general rule of thumb. RefreshRevoked had to be created, next to Revoked, because the AccessToken could be revoked and the RefreshToken still valid, or vice versa. Notably, when you issue a new refresh token, the old one is revoked, but the access token is still valid. It remains to be seen whether this is a good way to track things or not. The number of duplicated properties lead me to believe our type is not a great representation of the underlying concepts.

Download raw file
View source Diff to previous Annotate
History
1 package auth
2
3 import (
4 "testing"
5 "time"
6
7 "code.secondbit.org/uuid.hg"
8 )
9
10 var tokenStores = []tokenStore{NewMemstore()}
11
12 func compareTokens(token1, token2 Token) (success bool, field string, val1, val2 interface{}) {
13 if token1.AccessToken != token2.AccessToken {
14 return false, "access token", token1.AccessToken, token2.AccessToken
15 }
16 if token1.RefreshToken != token2.RefreshToken {
17 return false, "refresh token", token1.RefreshToken, token2.RefreshToken
18 }
19 if !token1.Created.Equal(token2.Created) {
20 return false, "created", token1.Created, token2.Created
21 }
22 if token1.CreatedFrom != token2.CreatedFrom {
23 return false, "created from", token1.CreatedFrom, token2.CreatedFrom
24 }
25 if token1.ExpiresIn != token2.ExpiresIn {
26 return false, "expires in", token1.ExpiresIn, token2.ExpiresIn
27 }
28 if token1.RefreshExpiresIn != token2.RefreshExpiresIn {
29 return false, "refresh expires in", token1.RefreshExpiresIn, token2.RefreshExpiresIn
30 }
31 if token1.TokenType != token2.TokenType {
32 return false, "token type", token1.TokenType, token2.TokenType
33 }
34 if token1.Scope != token2.Scope {
35 return false, "scope", token1.Scope, token2.Scope
36 }
37 if !token1.ProfileID.Equal(token2.ProfileID) {
38 return false, "profile ID", token1.ProfileID, token2.ProfileID
39 }
40 if token1.Revoked != token2.Revoked {
41 return false, "revoked", token1.Revoked, token2.Revoked
42 }
43 return true, "", nil, nil
44 }
45
46 func TestTokenStoreSuccess(t *testing.T) {
47 t.Parallel()
48 token := Token{
49 AccessToken: "access",
50 RefreshToken: "refresh",
51 Created: time.Now(),
52 ExpiresIn: 3600,
53 TokenType: "bearer",
54 Scope: "scope",
55 ProfileID: uuid.NewID(),
56 }
57 for _, store := range tokenStores {
58 context := Context{tokens: store}
59 err := context.SaveToken(token)
60 if err != nil {
61 t.Errorf("Error saving token to %T: %s", store, err)
62 }
63 err = context.SaveToken(token)
64 if err != ErrTokenAlreadyExists {
65 t.Errorf("Expected ErrTokenAlreadyExists from %T, got %s", store, err)
66 }
67 retrievedAccess, err := context.GetToken(token.AccessToken, false)
68 if err != nil {
69 t.Errorf("Error retrieving token from %T: %s", store, err)
70 }
71 success, field, expectation, result := compareTokens(token, retrievedAccess)
72 if !success {
73 t.Errorf("Expected field %s to be %v, but got %v from %T", field, expectation, result, store)
74 }
75 retrievedRefresh, err := context.GetToken(token.RefreshToken, true)
76 if err != nil {
77 t.Errorf("Error retrieving refresh token from %T: %s", store, err)
78 }
79 success, field, expectation, result = compareTokens(token, retrievedRefresh)
80 if !success {
81 t.Errorf("Expected field %s to be %v, but got %v from %T", field, expectation, result, store)
82 }
83 retrievedProfile, err := context.GetTokensByProfileID(token.ProfileID, 25, 0)
84 if err != nil {
85 t.Errorf("Error retrieving token by profile from %T: %s", store, err)
86 }
87 if len(retrievedProfile) != 1 {
88 t.Errorf("Expected 1 token retrieved by profile ID from %T, got %+v", store, retrievedProfile)
89 }
90 success, field, expectation, result = compareTokens(token, retrievedProfile[0])
91 if !success {
92 t.Errorf("Expected field %s to be %v, but got %v from %T", field, expectation, result, store)
93 }
94 err = context.RevokeToken(token.AccessToken, false)
95 if err != nil {
96 t.Errorf("Error revoking token in %T: %s", store, err)
97 }
98 retrievedRevoked, err := context.GetToken(token.AccessToken, false)
99 if err != nil {
100 t.Errorf("Error retrieving token from %T: %s", store, err)
101 }
102 token.Revoked = true
103 success, field, expectation, result = compareTokens(token, retrievedRevoked)
104 if !success {
105 t.Errorf("Expected field %s to be %v, but got %v from %T", field, expectation, result, store)
106 }
107 // TODO(paddy): test revoking by refresh token.
108 err = context.RemoveToken(token.AccessToken)
109 if err != nil {
110 t.Errorf("Error removing token from %T: %s", store, err)
111 }
112 _, err = context.GetToken(token.AccessToken, false)
113 if err != ErrTokenNotFound {
114 t.Errorf("Expected ErrTokenNotFound from %T, got %s", store, err)
115 }
116 _, err = context.GetToken(token.RefreshToken, true)
117 if err != ErrTokenNotFound {
118 t.Errorf("Expected ErrTokenNotFound from %T, got %s", store, err)
119 }
120 retrievedProfile, err = context.GetTokensByProfileID(token.ProfileID, 25, 0)
121 if err != nil {
122 t.Errorf("Error retrieving token by profile from %T: %s", store, err)
123 }
124 if len(retrievedProfile) != 0 {
125 t.Errorf("Expected list of 0 tokens from %T, got %+v", store, retrievedProfile)
126 }
127 err = context.RemoveToken(token.AccessToken)
128 if err != ErrTokenNotFound {
129 t.Errorf("Expected ErrTokenNotFound from %T, got %s", store, err)
130 }
131 err = context.RevokeToken(token.AccessToken, false)
132 if err != ErrTokenNotFound {
133 t.Errorf("Expected ErrTokenNotFound from %T, got %s", store, err)
134 }
135 err = context.RevokeToken(token.RefreshToken, true)
136 if err != ErrTokenNotFound {
137 t.Errorf("Expected ErrTokenNotFound from %T, got %s", store, err)
138 }
139 }
140 }