auth
auth/oauth2_test.go
Make all tests that deal with the store interfaces go through the Context. This is mainly important so that pre- and post- save/retrieval/deletion/whatever transforms can be done without doing them in every single implementation of the store. Change the Endpoint URI property to be a string, not a *url.URL. This makes testing easier, JSON responses cleaner, and is all around just a better strategy. Just because we turn it into a URL every now and then doesn't mean that's how we need to store it. Add JSON tags to the Client type and Endpoint type. Create normalizeURI and normalizeURIString methods to... well, normalize the Endpoint URIs. This makes it so that we can compare them, and forgive some arbitrary user behaviour (like slashes, etc.) Add a NormalizedURI property to the Endpoint type. This is where we store the NormalizedURI, which is what we'll be using when we want to check if an endpoint is valid or not. For the sake of tests and predictability, however, we always want to redirect to the URI, not the NormalizedURI. Add checks to the Client creation API endpoint to give better errors. Now leaving out the Type won't be considered an invalid type, it will be considered a missing parameter. An empty name will be reported as a missing parameter, a name with too few characters will be reported as an insufficient name, and a name with too many characters will be reported as an overflow name. We gather as many of these errors as apply before returning. Check if an Endpoint URI is absolute before adding it as an endpoint, or return an invalid value error if it is not. Always return the errors array when creating a client. We could succeed in creating one or more things and still have errors. We should return anything that's created _as well as_ any errors encountered. Add unit testing for our CreateClientHandler. Fix our oauth2 tests so that if there's an error in the body, it's in the test logs. This should help debugging significantly. Fix our oauth2 tests so that the Profile only requires 1 iteration for its password hashing. This means each time we want to validate a session, it doesn't add a full second to our test runs. This is a big speed improvement for our tests. Add test helper methods for comparing API errors, API responses, and filling in server-generated information in a response that it's impossible to have an expectation around (e.g., IDs) so that we can use our comparison helpers to check if a response is as we expect it. Fix a typo in our Context helpers that was reporting no sessionStore being set _only_ when a sessionStore was set. So yes, the opposite of what we wanted. Oops. This was discovered by passing all our tests through the context. methods instead of operating on the stores themselves.
1 package auth
3 import (
4 "bytes"
5 "encoding/json"
6 "html/template"
7 "io/ioutil"
8 "net/http"
9 "net/http/httptest"
10 "net/url"
11 "testing"
12 "time"
14 "code.secondbit.org/uuid.hg"
15 )
17 const (
18 scopeSet = 1 << iota
19 stateSet
20 uriSet
21 )
23 func stripParam(param string, u *url.URL) {
24 q := u.Query()
25 q.Del(param)
26 u.RawQuery = q.Encode()
27 }
29 func TestGetAuthorizationCodeCodeSuccess(t *testing.T) {
30 t.Parallel()
31 store := NewMemstore()
32 testContext := Context{
33 template: template.Must(template.New(getAuthorizationCodeTemplateName).Parse("{{ if not .error }}Get auth grant{{ else }}{{ .error }}{{ end }}")),
34 clients: store,
35 authCodes: store,
36 profiles: store,
37 tokens: store,
38 sessions: store,
39 }
40 client := Client{
41 ID: uuid.NewID(),
42 Secret: "super secret!",
43 OwnerID: uuid.NewID(),
44 Name: "My test client",
45 Logo: "https://secondbit.org/logo.png",
46 Website: "https://secondbit.org",
47 Type: "public",
48 }
49 endpoint := Endpoint{
50 ID: uuid.NewID(),
51 ClientID: client.ID,
52 URI: "https://test.secondbit.org/redirect",
53 Added: time.Now(),
54 }
55 err := testContext.SaveClient(client)
56 if err != nil {
57 t.Fatal("Can't store client:", err)
58 }
59 err = testContext.AddEndpoints(client.ID, []Endpoint{endpoint})
60 if err != nil {
61 t.Fatal("Can't store endpoint:", err)
62 }
63 profile := Profile{
64 ID: uuid.NewID(),
65 }
66 err = testContext.SaveProfile(profile)
67 if err != nil {
68 t.Fatal("Can't store profile:", err)
69 }
70 session := Session{
71 ID: "testsession",
72 Active: true,
73 ProfileID: profile.ID,
74 }
75 err = testContext.CreateSession(session)
76 if err != nil {
77 t.Fatal("Can't store session:", err)
78 }
79 req, err := http.NewRequest("GET", "https://test.auth.secondbit.org/oauth2/grant", nil)
80 if err != nil {
81 t.Fatal("Can't build request:", err)
82 }
83 cookie := &http.Cookie{
84 Name: authCookieName,
85 Value: session.ID,
86 }
87 req.AddCookie(cookie)
88 for i := 0; i < 1<<3; i++ {
89 w := httptest.NewRecorder()
90 params := url.Values{}
91 // see OAuth 2.0 spec, section 4.1.1
92 params.Set("response_type", "code")
93 params.Set("client_id", client.ID.String())
94 if i&uriSet != 0 {
95 params.Set("redirect_uri", endpoint.URI)
96 }
97 if i&scopeSet != 0 {
98 params.Set("scope", "testscope")
99 }
100 if i&stateSet != 0 {
101 params.Set("state", "my super secure state string")
102 }
103 req.URL.RawQuery = params.Encode()
104 req.Method = "GET"
105 req.Body = nil
106 req.Header.Del("Content-Type")
107 GetAuthorizationCodeHandler(w, req, testContext)
108 if w.Code != http.StatusOK {
109 t.Log("Response body:", w.Body.String())
110 t.Errorf("Expected status code to be %d, got %d for %s", http.StatusOK, w.Code, req.URL.String())
111 }
112 if w.Body.String() != "Get auth grant" {
113 t.Errorf("Expected body to be `%s`, got `%s` for %s", "Get auth grant", w.Body.String(), req.URL.String())
114 }
115 req.Method = "POST"
116 req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
117 w = httptest.NewRecorder()
118 data := url.Values{}
119 data.Set("grant", "approved")
120 body := bytes.NewBufferString(data.Encode())
121 req.Body = ioutil.NopCloser(body)
122 GetAuthorizationCodeHandler(w, req, testContext)
123 if w.Code != http.StatusFound {
124 t.Errorf("Expected status code to be %d, got %d for %s", http.StatusFound, w.Code, req.URL.String())
125 }
126 redirectedTo := w.Header().Get("Location")
127 red, err := url.Parse(redirectedTo)
128 if err != nil {
129 t.Fatalf(`Being redirected to a non-URL "%s" threw error "%s" for "%s"\n`, redirectedTo, err, req.URL.String())
130 }
131 t.Log("Redirected to", redirectedTo)
132 if red.Query().Get("code") == "" {
133 t.Fatalf(`Expected code param in redirect URL to be set, but it wasn't for %s`, req.URL.String())
134 }
135 if _, err := testContext.GetAuthorizationCode(red.Query().Get("code")); err != nil {
136 t.Fatalf(`Unexpected error "%s: retrieving the grant "%s" supplied in the redirect URL for %s`, err, red.Query().Get("code"), req.URL.String())
137 }
138 err = testContext.DeleteAuthorizationCode(red.Query().Get("code"))
139 if err != nil {
140 t.Logf(`Unexpected error "%s" deleting grant "%s" for %s`, err, red.Query().Get("code"), req.URL.String())
141 }
142 stripParam("code", red)
143 if red.Query().Get("state") != params.Get("state") {
144 t.Errorf(`Expected state param in redirect URL to be "%s", got "%s" for %s`, params.Get("state"), red.Query().Get("state"), req.URL.String())
145 }
146 stripParam("state", red)
147 if red.String() != endpoint.URI {
148 t.Errorf(`Expected redirect URL to be "%s", got "%s"`, endpoint.URI, red.String())
149 }
150 }
151 }
153 func TestGetAuthorizationCodeCodeInvalidClient(t *testing.T) {
154 t.Parallel()
155 store := NewMemstore()
156 testContext := Context{
157 template: template.Must(template.New(getAuthorizationCodeTemplateName).Parse("{{ .error }}")),
158 clients: store,
159 authCodes: store,
160 profiles: store,
161 tokens: store,
162 sessions: store,
163 }
164 client := Client{
165 ID: uuid.NewID(),
166 Secret: "super secret!",
167 OwnerID: uuid.NewID(),
168 Name: "My test client",
169 Type: "public",
170 }
171 err := testContext.SaveClient(client)
172 if err != nil {
173 t.Fatal("Can't store client:", err)
174 }
175 session := Session{
176 ID: "testsession",
177 Active: true,
178 }
179 err = testContext.CreateSession(session)
180 if err != nil {
181 t.Fatal("Can't store session:", err)
182 }
183 req, err := http.NewRequest("GET", "https://test.auth.secondbit.org/oauth2/grant", nil)
184 if err != nil {
185 t.Fatal("Can't build request:", err)
186 }
187 w := httptest.NewRecorder()
188 params := url.Values{}
189 params.Set("response_type", "code")
190 params.Set("redirect_uri", "https://test.secondbit.org/")
191 req.URL.RawQuery = params.Encode()
192 cookie := &http.Cookie{
193 Name: authCookieName,
194 Value: session.ID,
195 }
196 req.AddCookie(cookie)
197 GetAuthorizationCodeHandler(w, req, testContext)
198 if w.Code != http.StatusBadRequest {
199 t.Errorf("Expected status code to be %d, got %d", http.StatusBadRequest, w.Code)
200 }
201 if w.Body.String() != "Client ID must be specified in the request." {
202 t.Errorf(`Expected output to be "%s", got "%s" instead.`, "Client ID must be specified in the request.", w.Body.String())
203 }
204 w = httptest.NewRecorder()
205 params.Set("client_id", "Not an ID")
206 req.URL.RawQuery = params.Encode()
207 GetAuthorizationCodeHandler(w, req, testContext)
208 if w.Code != http.StatusBadRequest {
209 t.Errorf("Expected status code to be %d, got %d", http.StatusBadRequest, w.Code)
210 }
211 if w.Body.String() != "client_id is not a valid Client ID." {
212 t.Errorf(`Expected output to be "%s", got "%s" instead.`, "client_id is not a valid Client ID.", w.Body.String())
213 }
214 w = httptest.NewRecorder()
215 params.Set("client_id", uuid.NewID().String())
216 req.URL.RawQuery = params.Encode()
217 GetAuthorizationCodeHandler(w, req, testContext)
218 if w.Code != http.StatusBadRequest {
219 t.Errorf("Expected status code to be %d, got %d", http.StatusBadRequest, w.Code)
220 }
221 if w.Body.String() != "The specified Client couldn’t be found." {
222 t.Errorf(`Expected output to be "%s", got "%s" instead.`, "The specified Client couldn’t be found.", w.Body.String())
223 }
224 }
226 func TestGetAuthorizationCodeCodeInvalidURI(t *testing.T) {
227 t.Parallel()
228 store := NewMemstore()
229 testContext := Context{
230 template: template.Must(template.New(getAuthorizationCodeTemplateName).Parse("{{ .error }}")),
231 clients: store,
232 authCodes: store,
233 profiles: store,
234 tokens: store,
235 sessions: store,
236 }
237 client := Client{
238 ID: uuid.NewID(),
239 Secret: "super secret!",
240 OwnerID: uuid.NewID(),
241 Name: "My test client",
242 Type: "public",
243 }
244 err := testContext.SaveClient(client)
245 if err != nil {
246 t.Fatal("Can't store client:", err)
247 }
248 session := Session{
249 ID: "testsession",
250 Active: true,
251 }
252 err = testContext.CreateSession(session)
253 if err != nil {
254 t.Fatal("Can't store session:", err)
255 }
256 req, err := http.NewRequest("GET", "https://test.auth.secondbit.org/oauth2/grant", nil)
257 if err != nil {
258 t.Fatal("Can't build request:", err)
259 }
260 cookie := &http.Cookie{
261 Name: authCookieName,
262 Value: session.ID,
263 }
264 req.AddCookie(cookie)
265 w := httptest.NewRecorder()
266 params := url.Values{}
267 params.Set("response_type", "code")
268 params.Set("client_id", client.ID.String())
269 req.URL.RawQuery = params.Encode()
270 GetAuthorizationCodeHandler(w, req, testContext)
271 if w.Code != http.StatusBadRequest {
272 t.Errorf("Expected status code to be %d, got %d", http.StatusBadRequest, w.Code)
273 }
274 if w.Body.String() != "The redirect_uri specified is not valid." {
275 t.Errorf(`Expected output to be "%s", got "%s" instead.`, "The redirect_uri specified is not valid.", w.Body.String())
276 }
277 endpoint := Endpoint{
278 ID: uuid.NewID(),
279 ClientID: client.ID,
280 URI: "https://test.secondbit.org/redirect",
281 Added: time.Now(),
282 }
283 err = testContext.AddEndpoints(client.ID, []Endpoint{endpoint})
284 if err != nil {
285 t.Fatal("Can't store endpoint:", err)
286 }
287 w = httptest.NewRecorder()
288 params.Set("redirect_uri", "https://test.secondbit.org/wrong")
289 req.URL.RawQuery = params.Encode()
290 GetAuthorizationCodeHandler(w, req, testContext)
291 if w.Code != http.StatusBadRequest {
292 t.Errorf("Expected status code to be %d, got %d", http.StatusBadRequest, w.Code)
293 }
294 if w.Body.String() != "The redirect_uri specified is not valid." {
295 t.Errorf(`Expected output to be "%s", got "%s" instead.`, "The redirect_uri specified is not valid.", w.Body.String())
296 }
297 endpoint2 := Endpoint{
298 ID: uuid.NewID(),
299 ClientID: client.ID,
300 URI: "https://test.secondbit.org/redirect",
301 Added: time.Now(),
302 }
303 err = testContext.AddEndpoints(client.ID, []Endpoint{endpoint2})
304 if err != nil {
305 t.Fatal("Can't store endpoint:", err)
306 }
307 w = httptest.NewRecorder()
308 params.Set("redirect_uri", "")
309 req.URL.RawQuery = params.Encode()
310 GetAuthorizationCodeHandler(w, req, testContext)
311 if w.Code != http.StatusBadRequest {
312 t.Errorf("Expected status code to be %d, got %d", http.StatusBadRequest, w.Code)
313 }
314 if w.Body.String() != "The redirect_uri specified is not valid." {
315 t.Errorf(`Expected output to be "%s", got "%s" instead.`, "The redirect_uri specified is not valid.", w.Body.String())
316 }
317 w = httptest.NewRecorder()
318 params.Set("redirect_uri", "://not a URL")
319 req.URL.RawQuery = params.Encode()
320 GetAuthorizationCodeHandler(w, req, testContext)
321 if w.Code != http.StatusBadRequest {
322 t.Errorf("Expected status code to be %d, got %d", http.StatusBadRequest, w.Code)
323 }
324 if w.Body.String() != "The redirect_uri specified is not valid." {
325 t.Errorf(`Expected output to be "%s", got "%s" instead.`, "The redirect_uri specified is not valid.", w.Body.String())
326 }
327 }
329 func TestGetAuthorizationCodeCodeInvalidResponseType(t *testing.T) {
330 t.Parallel()
331 store := NewMemstore()
332 testContext := Context{
333 template: template.Must(template.New(getAuthorizationCodeTemplateName).Parse("{{ .error }}")),
334 clients: store,
335 authCodes: store,
336 profiles: store,
337 tokens: store,
338 sessions: store,
339 }
340 client := Client{
341 ID: uuid.NewID(),
342 Secret: "super secret!",
343 OwnerID: uuid.NewID(),
344 Name: "My test client",
345 Logo: "https://secondbit.org/logo.png",
346 Website: "https://secondbit.org",
347 Type: "public",
348 }
349 endpoint := Endpoint{
350 ID: uuid.NewID(),
351 ClientID: client.ID,
352 URI: "https://test.secondbit.org/redirect",
353 Added: time.Now(),
354 }
355 err := testContext.SaveClient(client)
356 if err != nil {
357 t.Fatal("Can't store client:", err)
358 }
359 err = testContext.AddEndpoints(client.ID, []Endpoint{endpoint})
360 if err != nil {
361 t.Fatal("Can't store endpoint:", err)
362 }
363 session := Session{
364 ID: "testsession",
365 Active: true,
366 }
367 err = testContext.CreateSession(session)
368 if err != nil {
369 t.Fatal("Can't store session:", err)
370 }
371 req, err := http.NewRequest("GET", "https://test.auth.secondbit.org/oauth2/grant", nil)
372 if err != nil {
373 t.Fatal("Can't build request:", err)
374 }
375 cookie := &http.Cookie{
376 Name: authCookieName,
377 Value: session.ID,
378 }
379 req.AddCookie(cookie)
380 params := url.Values{}
381 params.Set("response_type", "totally not code")
382 params.Set("client_id", client.ID.String())
383 params.Set("redirect_uri", endpoint.URI)
384 params.Set("scope", "testscope")
385 params.Set("state", "my super secure state string")
386 req.URL.RawQuery = params.Encode()
387 w := httptest.NewRecorder()
388 GetAuthorizationCodeHandler(w, req, testContext)
389 if w.Code != http.StatusFound {
390 t.Errorf("Expected status code to be %d, got %d", http.StatusFound, w.Code)
391 }
392 redirectedTo := w.Header().Get("Location")
393 red, err := url.Parse(redirectedTo)
394 if err != nil {
395 t.Fatalf("Being redirected to a non-URL (%s) threw error: %s\n", redirectedTo, err)
396 }
397 if red.Query().Get("error") != "invalid_request" {
398 t.Errorf(`Expected error param in redirect URL to be "%s", got "%s"`, "invalid_request", red.Query().Get("error"))
399 }
400 stripParam("error", red)
401 if red.Query().Get("state") != params.Get("state") {
402 t.Errorf(`Expected state param in redirect URL to be "%s", got "%s"`, params.Get("state"), red.Query().Get("state"))
403 }
404 stripParam("state", red)
405 if red.String() != endpoint.URI {
406 t.Errorf(`Expected redirect URL to be "%s", got "%s"`, endpoint.URI, red.String())
407 }
408 stripParam("response_type", req.URL)
409 w = httptest.NewRecorder()
410 GetAuthorizationCodeHandler(w, req, testContext)
411 if w.Code != http.StatusFound {
412 t.Errorf("Expected status code to be %d, got %d", http.StatusFound, w.Code)
413 }
414 redirectedTo = w.Header().Get("Location")
415 red, err = url.Parse(redirectedTo)
416 if err != nil {
417 t.Fatalf("Being redirected to a non-URL (%s) threw error: %s\n", redirectedTo, err)
418 }
419 if red.Query().Get("error") != "invalid_request" {
420 t.Errorf(`Expected error param in redirect URL to be "%s", got "%s"`, "invalid_request", red.Query().Get("error"))
421 }
422 stripParam("error", red)
423 if red.Query().Get("state") != params.Get("state") {
424 t.Errorf(`Expected state param in redirect URL to be "%s", got "%s"`, params.Get("state"), red.Query().Get("state"))
425 }
426 stripParam("state", red)
427 if red.String() != endpoint.URI {
428 t.Errorf(`Expected redirect URL to be "%s", got "%s"`, endpoint.URI, red.String())
429 }
430 }
432 func TestGetAuthorizationCodeCodeDenied(t *testing.T) {
433 t.Parallel()
434 store := NewMemstore()
435 testContext := Context{
436 template: template.Must(template.New(getAuthorizationCodeTemplateName).Parse("{{ .error }}")),
437 clients: store,
438 authCodes: store,
439 profiles: store,
440 tokens: store,
441 sessions: store,
442 }
443 client := Client{
444 ID: uuid.NewID(),
445 Secret: "super secret!",
446 OwnerID: uuid.NewID(),
447 Name: "My test client",
448 Logo: "https://secondbit.org/logo.png",
449 Website: "https://secondbit.org",
450 Type: "public",
451 }
452 endpoint := Endpoint{
453 ID: uuid.NewID(),
454 ClientID: client.ID,
455 URI: "https://test.secondbit.org/redirect",
456 Added: time.Now(),
457 }
458 err := testContext.SaveClient(client)
459 if err != nil {
460 t.Fatal("Can't store client:", err)
461 }
462 err = testContext.AddEndpoints(client.ID, []Endpoint{endpoint})
463 if err != nil {
464 t.Fatal("Can't store endpoint:", err)
465 }
466 session := Session{
467 ID: "testsession",
468 Active: true,
469 }
470 err = testContext.CreateSession(session)
471 if err != nil {
472 t.Fatal("Can't store session:", err)
473 }
474 req, err := http.NewRequest("GET", "https://test.auth.secondbit.org/oauth2/grant", nil)
475 if err != nil {
476 t.Fatal("Can't build request:", err)
477 }
478 cookie := &http.Cookie{
479 Name: authCookieName,
480 Value: session.ID,
481 }
482 req.AddCookie(cookie)
483 params := url.Values{}
484 params.Set("response_type", "code")
485 params.Set("client_id", client.ID.String())
486 params.Set("redirect_uri", endpoint.URI)
487 params.Set("scope", "testscope")
488 params.Set("state", "my super secure state string")
489 data := url.Values{}
490 data.Set("grant", "denied")
491 req.URL.RawQuery = params.Encode()
492 req.Body = ioutil.NopCloser(bytes.NewBufferString(data.Encode()))
493 req.Method = "POST"
494 w := httptest.NewRecorder()
495 GetAuthorizationCodeHandler(w, req, testContext)
496 if w.Code != http.StatusFound {
497 t.Errorf("Expected status code to be %d, got %d", http.StatusFound, w.Code)
498 }
499 redirectedTo := w.Header().Get("Location")
500 red, err := url.Parse(redirectedTo)
501 if err != nil {
502 t.Fatalf("Being redirected to a non-URL (%s) threw error: %s\n", redirectedTo, err)
503 }
504 if red.Query().Get("error") != "access_denied" {
505 t.Errorf(`Expected error param in redirect URL to be "%s", got "%s"`, "access_denied", red.Query().Get("error"))
506 }
507 stripParam("error", red)
508 if red.Query().Get("state") != params.Get("state") {
509 t.Errorf(`Expected state param in redirect URL to be "%s", got "%s"`, params.Get("state"), red.Query().Get("state"))
510 }
511 stripParam("state", red)
512 if red.String() != endpoint.URI {
513 t.Errorf(`Expected redirect URL to be "%s", got "%s"`, endpoint.URI, red.String())
514 }
515 }
517 func TestGetAuthorizationCodeCodeLoginRedirect(t *testing.T) {
518 t.Parallel()
519 req, err := http.NewRequest("GET", "https://test.auth.secondbit.org/oauth2/grant", nil)
520 if err != nil {
521 t.Fatal("Can't build request:", err)
522 }
523 w := httptest.NewRecorder()
524 GetAuthorizationCodeHandler(w, req, Context{template: template.Must(template.New(getAuthorizationCodeTemplateName).Parse("{{ .internal_error }}"))})
525 if w.Code != http.StatusInternalServerError {
526 t.Errorf("Expected status code to be %d, got %d", http.StatusInternalServerError, w.Code)
527 }
528 expectation := "Missing login URL."
529 if w.Body.String() != expectation {
530 t.Errorf(`Expected body to be "%s", got "%s"`, expectation, w.Body.String())
531 }
532 uri, err := url.Parse("https://client.secondbit.org/")
533 if err != nil {
534 t.Error("Unexpected error", err)
535 }
536 testContext := Context{
537 loginURI: uri,
538 }
539 w = httptest.NewRecorder()
540 GetAuthorizationCodeHandler(w, req, testContext)
541 if w.Code != http.StatusFound {
542 t.Errorf("Expected status code to be %d, got %d", http.StatusFound, w.Code)
543 }
544 redirectedTo := w.Header().Get("Location")
545 expectation = "https://client.secondbit.org/?from=https%3A%2F%2Ftest.auth.secondbit.org%2Foauth2%2Fgrant"
546 if redirectedTo != expectation {
547 t.Errorf("Expected to be redirected to '%s', was redirected to '%s'", expectation, redirectedTo)
548 }
549 }
551 func TestCheckCookie(t *testing.T) {
552 t.Parallel()
553 req, err := http.NewRequest("GET", "https://auth.secondbit.org", nil)
554 if err != nil {
555 t.Error("Unexpected error creating base request:", err)
556 }
557 store := NewMemstore()
558 testContext := Context{
559 sessions: store,
560 }
561 session, err := checkCookie(req, testContext)
562 if err != ErrNoSession {
563 t.Errorf("Expected ErrNoSession, got %s", err)
564 }
565 session = Session{
566 ID: "testsession",
567 Active: true,
568 }
569 err = testContext.CreateSession(session)
570 if err != nil {
571 t.Error("Unexpected error persisting session:", err)
572 }
573 invalidSession := Session{
574 ID: "testsession2",
575 Active: false,
576 }
577 err = testContext.CreateSession(invalidSession)
578 if err != nil {
579 t.Error("Unexpected error persisting session:", err)
580 }
581 result, err := checkCookie(req, testContext)
582 if err != ErrNoSession {
583 t.Errorf("Expected ErrNoSession, got %s", err)
584 }
585 req.AddCookie(&http.Cookie{
586 Name: "wrongcookie",
587 Value: "wrong value",
588 })
589 result, err = checkCookie(req, testContext)
590 if err != ErrNoSession {
591 t.Error("Expected ErrNoSession, got", err)
592 }
593 req, err = http.NewRequest("GET", "https://auth.secondbit.org", nil)
594 if err != nil {
595 t.Error("Unexpected error creating base request:", err)
596 }
597 req.AddCookie(&http.Cookie{
598 Name: "Stillwrongcookie",
599 Value: session.ID,
600 })
601 result, err = checkCookie(req, testContext)
602 if err != ErrNoSession {
603 t.Error("Expected ErrNoSession, got", err)
604 }
605 req, err = http.NewRequest("GET", "https://auth.secondbit.org", nil)
606 if err != nil {
607 t.Error("Unexpected error creating base request:", err)
608 }
609 req.AddCookie(&http.Cookie{
610 Name: authCookieName,
611 Value: "wrong value",
612 })
613 result, err = checkCookie(req, testContext)
614 if err != ErrInvalidSession {
615 t.Error("Expected ErrInvalidSession, got", err)
616 }
617 req, err = http.NewRequest("GET", "https://auth.secondbit.org", nil)
618 if err != nil {
619 t.Error("Unexpected error creating base request:", err)
620 }
621 req.AddCookie(&http.Cookie{
622 Name: authCookieName,
623 Value: invalidSession.ID,
624 })
625 result, err = checkCookie(req, testContext)
626 if err != ErrInvalidSession {
627 t.Error("Expected ErrInvalidSession, got", err)
628 }
629 req, err = http.NewRequest("GET", "https://auth.secondbit.org", nil)
630 if err != nil {
631 t.Error("Unexpected error creating base request:", err)
632 }
633 req.AddCookie(&http.Cookie{
634 Name: authCookieName,
635 Value: session.ID,
636 })
637 result, err = checkCookie(req, testContext)
638 if err != nil {
639 t.Error("Unexpected error:", err)
640 }
641 success, field, expectation, outcome := compareSessions(session, result)
642 if !success {
643 t.Errorf(`Expected field %s to be %v, but got %v`, field, expectation, outcome)
644 }
645 }
647 func TestBuildLoginRedirect(t *testing.T) {
648 t.Parallel()
649 req, err := http.NewRequest("GET", "https://client.secondbit.org/my/awesome/path?has=query¶ms=to&screw=this&all=up", nil)
650 if err != nil {
651 t.Error("Unexpected error creating base request:", err)
652 }
653 result := buildLoginRedirect(req, Context{})
654 if result != "" {
655 t.Error("Expected empty string as the result, got", result)
656 }
657 uri, err := url.Parse("https://auth.secondbit.org/login?query=string&other=param")
658 if err != nil {
659 t.Error("Unexpected error parsing URL:", err)
660 }
661 c := Context{loginURI: uri}
662 result = buildLoginRedirect(req, c)
663 expectation := "https://auth.secondbit.org/login?from=https%3A%2F%2Fclient.secondbit.org%2Fmy%2Fawesome%2Fpath%3Fhas%3Dquery%26params%3Dto%26screw%3Dthis%26all%3Dup&other=param&query=string"
664 if result != expectation {
665 t.Errorf(`Expected result string to be "%s", was "%s"`, expectation, result)
666 }
667 }
669 func TestAuthenticateHelper(t *testing.T) {
670 t.Parallel()
671 store := NewMemstore()
672 context := Context{
673 profiles: store,
674 }
675 profile := Profile{
676 ID: uuid.NewID(),
677 Name: "Test User",
678 Passphrase: "f3a4ac4f1d657b2e6e776d24213e39406d50a87a52691a2a78891425af1271d0",
679 Iterations: 1,
680 Salt: "d82d92cfa8bfb5a08270ebbf39a3710d24b352b937fcc8959ebcb40384cc616b",
681 PassphraseScheme: 1,
682 Compromised: false,
683 LockedUntil: time.Time{},
684 PassphraseReset: "",
685 PassphraseResetCreated: time.Time{},
686 Created: time.Now(),
687 LastSeen: time.Time{},
688 }
689 login := Login{
690 Type: "email",
691 Value: "test@example.com",
692 ProfileID: profile.ID,
693 Created: time.Now(),
694 LastUsed: time.Time{},
695 }
696 err := context.SaveProfile(profile)
697 if err != nil {
698 t.Error("Error saving profile:", err)
699 }
700 err = context.AddLogin(login)
701 if err != nil {
702 t.Error("Error adding login:", err)
703 }
704 response, err := authenticate("test@example.com", "mysecurepassphrase", context)
705 if err != nil {
706 t.Error("Unexpected error:", err)
707 }
708 success, field, expectation, result := compareProfiles(profile, response)
709 if !success {
710 t.Errorf(`Expected field %s to be "%v", got "%v"`, field, expectation, result)
711 }
712 response, err = authenticate("test2@example.com", "mysecurepassphrase", context)
713 if err != ErrIncorrectAuth {
714 t.Error("Expected ErrIncorrectAuth, got", err)
715 }
716 response, err = authenticate("test@example.com", "not the right password", context)
717 if err != ErrIncorrectAuth {
718 t.Error("Expected ErrIncorrectAuth, got", err)
719 }
720 scheme := 1000
721 phrase := "doesn't really matter, the scheme doesn't exist"
722 change := ProfileChange{
723 PassphraseScheme: &scheme,
724 Passphrase: &phrase,
725 }
726 err = context.UpdateProfile(profile.ID, change)
727 if err != nil {
728 t.Error("Unexpected error:", err)
729 }
730 response, err = authenticate("test@example.com", "not the right password", context)
731 if err != ErrInvalidPassphraseScheme {
732 t.Error("Expected ErrIncorrectAuth, got", err)
733 }
734 }
736 func TestGetTokenHandler(t *testing.T) {
737 t.Parallel()
738 store := NewMemstore()
739 context := Context{
740 clients: store,
741 authCodes: store,
742 tokens: store,
743 }
744 client := Client{
745 ID: uuid.NewID(),
746 Secret: "sometimes I feel like I don't know what I'm doing",
747 OwnerID: uuid.NewID(),
748 Name: "A Super Awesome Client!",
749 Logo: "https://logos.secondbit.org/client.png",
750 Website: "https://client.secondbit.org/",
751 Type: "confidential",
752 }
753 authCode := AuthorizationCode{
754 Code: "testcode",
755 Created: time.Now(),
756 ExpiresIn: 600,
757 ClientID: client.ID,
758 Scope: "testscope",
759 RedirectURI: "https://client.secondbit.org/",
760 State: "teststate",
761 ProfileID: uuid.NewID(),
762 }
763 err := context.SaveAuthorizationCode(authCode)
764 if err != nil {
765 t.Error("Error saving auth code:", err)
766 }
767 err = context.SaveClient(client)
768 if err != nil {
769 t.Error("Error saving client:", err)
770 }
771 data := url.Values{}
772 data.Set("grant_type", "authorization_code")
773 data.Set("code", authCode.Code)
774 data.Set("redirect_uri", authCode.RedirectURI)
775 body := bytes.NewBufferString(data.Encode())
776 req, err := http.NewRequest("POST", "https://auth.secondbit.org/", ioutil.NopCloser(body))
777 if err != nil {
778 t.Error("Error constructing request:", err)
779 }
780 req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
781 req.SetBasicAuth(client.ID.String(), client.Secret)
782 w := httptest.NewRecorder()
783 GetTokenHandler(w, req, context)
784 resp := tokenResponse{}
785 err = json.Unmarshal(w.Body.Bytes(), &resp)
786 if err != nil {
787 t.Error("Error unmarshalling response:", err)
788 t.Error("Response:", w.Body.String())
789 }
790 if resp.AccessToken == "" {
791 t.Error("Got blank access token back")
792 }
793 if resp.RefreshToken == "" {
794 t.Error("Got blank refresh token back")
795 }
796 if resp.TokenType == "" {
797 t.Error("Got blank token type back")
798 }
799 if resp.ExpiresIn == 0 {
800 t.Error("Got blank expires in back")
801 }
802 tokens, err := context.GetTokensByProfileID(authCode.ProfileID, 1, 0)
803 if err != nil {
804 t.Error("Error retrieving token:", err)
805 }
806 if len(tokens) != 1 {
807 t.Fatalf("Expected %d tokens, got %d", 1, len(tokens))
808 }
809 if tokens[0].AccessToken != resp.AccessToken {
810 t.Errorf(`Expected access token to be "%s", got "%s"`, tokens[0].AccessToken, resp.AccessToken)
811 }
812 if tokens[0].RefreshToken != resp.RefreshToken {
813 t.Errorf(`Expected refresh token to be "%s", got "%s"`, tokens[0].RefreshToken, resp.RefreshToken)
814 }
815 if tokens[0].ExpiresIn != resp.ExpiresIn {
816 t.Errorf(`Expected expires in to be %d, got %d`, tokens[0].ExpiresIn, resp.ExpiresIn)
817 }
818 if tokens[0].TokenType != resp.TokenType {
819 t.Errorf(`Expected token type to be %s, got %s`, tokens[0].TokenType, resp.TokenType)
820 }
821 }