github/pocket-id
1
0
Fork 0
mirror of https://github.com/pocket-id/pocket-id.git synced 2026-08-24 21:17:31 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
main
pocket-id/backend/internal/oidc/cimd_test.go
T

735 lines
30 KiB
Go
Raw Permalink Blame History

package oidc
import (
"context"
"errors"
"net/http"
"strings"
"testing"
"time"
"github.com/ory/fosite"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"gorm.io/gorm"
"github.com/pocket-id/pocket-id/backend/internal/model"
datatype "github.com/pocket-id/pocket-id/backend/internal/model/types"
testutils "github.com/pocket-id/pocket-id/backend/internal/utils/testing"
)
func TestBuildClientFromMetadata(t *testing.T) {
const id = "https://app.example.com/oauth/client"
t.Run("public client maps to PKCE", func(t *testing.T) {
doc := &fosite.ClientMetadataDocument{
ClientID: id,
ClientName: "Example App",
RedirectURIs: []string{"https://app.example.com/callback"},
PostLogoutRedirectURIs: []string{"https://app.example.com/logout"},
TokenEndpointAuthMethod: "none",
}
c, err := buildClientFromMetadata(doc, id)
require.NoError(t, err)
assert.Equal(t, id, c.ID)
assert.Equal(t, "Example App", c.Name)
assert.True(t, c.IsPublic)
assert.True(t, c.PkceEnabled)
assert.True(t, c.IsMetadataDocument())
assert.Equal(t, []string{"https://app.example.com/callback"}, []string(c.CallbackURLs))
assert.Equal(t, []string{"https://app.example.com/logout"}, []string(c.LogoutCallbackURLs))
assert.Equal(t, []string{"authorization_code"}, []string(c.MetadataGrantTypes))
assert.Empty(t, c.Credentials.FederatedIdentities)
assert.Equal(t, model.DefaultAccessTokenDurationMinutes, c.AccessTokenDurationMinutes)
assert.Equal(t, model.DefaultRefreshTokenDurationMinutes, c.RefreshTokenDurationMinutes)
})
t.Run("authenticated clients are rejected", func(t *testing.T) {
for _, m := range []string{"private_key_jwt", "client_secret_basic", "client_secret_post", "client_secret_jwt"} { //nolint:gosec // G101 false positive: authentication method names, not credentials
doc := &fosite.ClientMetadataDocument{ClientID: id, TokenEndpointAuthMethod: m}
_, err := buildClientFromMetadata(doc, id)
require.Errorf(t, err, "method %q", m)
}
})
t.Run("unsupported grant types are dropped", func(t *testing.T) {
doc := &fosite.ClientMetadataDocument{
ClientID: id,
RedirectURIs: []string{"https://app.example.com/callback"},
TokenEndpointAuthMethod: "none",
GrantTypes: []string{"authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:jwt-bearer"},
}
c, err := buildClientFromMetadata(doc, id)
require.NoError(t, err)
assert.Equal(t, []string{"authorization_code", "refresh_token"}, []string(c.MetadataGrantTypes))
})
t.Run("documents without a supported initiating grant are rejected", func(t *testing.T) {
doc := &fosite.ClientMetadataDocument{
ClientID: id,
RedirectURIs: []string{"https://app.example.com/callback"},
TokenEndpointAuthMethod: "none",
GrantTypes: []string{"refresh_token", "urn:ietf:params:oauth:grant-type:jwt-bearer"},
}
_, err := buildClientFromMetadata(doc, id)
require.ErrorIs(t, err, errInitiatingGrantRequired)
})
t.Run("name falls back to the client ID host", func(t *testing.T) {
c, err := buildClientFromMetadata(&fosite.ClientMetadataDocument{ClientID: id, TokenEndpointAuthMethod: "none"}, id)
require.NoError(t, err)
assert.Equal(t, "app.example.com", c.Name)
})
}
func TestCIMDPolicyValidate(t *testing.T) {
policy := cimdPolicy{}
for _, test := range []struct {
name string
grantTypes []string
responseTypes []string
wantError string
}{
{name: "defaults are supported"},
{name: "authorization code and refresh token are supported", grantTypes: []string{"authorization_code", "refresh_token"}},
{name: "device code is supported", grantTypes: []string{string(fosite.GrantTypeDeviceCode)}},
{name: "unsupported grant types are ignored", grantTypes: []string{"authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:jwt-bearer"}},
{name: "client credentials cannot initiate authorization", grantTypes: []string{"client_credentials"}, wantError: "must enable"},
{name: "refresh token cannot initiate authorization", grantTypes: []string{"refresh_token"}, wantError: "must enable"},
{name: "implicit response is rejected", grantTypes: []string{"authorization_code"}, responseTypes: []string{"token"}, wantError: "unsupported response_type"},
} {
t.Run(test.name, func(t *testing.T) {
err := policy.ValidateCIMDClient(t.Context(), &fosite.ClientMetadataDocument{
TokenEndpointAuthMethod: "none",
GrantTypes: test.grantTypes,
ResponseTypes: test.responseTypes,
})
if test.wantError == "" {
require.NoError(t, err)
return
}
require.ErrorContains(t, err, test.wantError)
})
}
t.Run("omitted authentication method is rejected", func(t *testing.T) {
err := policy.ValidateCIMDClient(t.Context(), &fosite.ClientMetadataDocument{})
require.ErrorContains(t, err, "token_endpoint_auth_method")
})
}
func TestMetadataClientChanges(t *testing.T) {
base := model.OidcClient{
Name: "App",
CallbackURLs: datatype.StringList{"https://app/cb"},
LogoutCallbackURLs: datatype.StringList{"https://app/lo"},
IsPublic: true,
}
t.Run("no changes", func(t *testing.T) {
assert.Empty(t, metadataClientChanges(base, base))
})
t.Run("redirect_uris change", func(t *testing.T) {
next := base
next.CallbackURLs = datatype.StringList{"https://app/other"}
assert.Equal(t, []string{"redirect_uris"}, metadataClientChanges(base, next))
})
t.Run("auth method change", func(t *testing.T) {
next := base
next.IsPublic = false
got := metadataClientChanges(base, next)
assert.Contains(t, got, "token_endpoint_auth_method")
})
t.Run("grant types change", func(t *testing.T) {
next := base
next.MetadataGrantTypes = datatype.StringList{"authorization_code", "refresh_token"}
assert.Contains(t, metadataClientChanges(base, next), "grant_types")
})
}
func TestRefreshMetadataClient(t *testing.T) {
const id = "https://8.8.8.8/oauth/client"
body := `{"client_id":"https://8.8.8.8/oauth/client","client_name":"App","redirect_uris":["https://app/cb"],"token_endpoint_auth_method":"none"}`
t.Run("empty allowlist", func(t *testing.T) {
s := newMetadataStore(t, nil, func() []string { return nil })
_, err := s.RefreshMetadataClient(t.Context(), id)
require.Error(t, err)
})
t.Run("non-URL id", func(t *testing.T) {
s := newMetadataStore(t, nil)
_, err := s.RefreshMetadataClient(t.Context(), "not-a-url")
require.Error(t, err)
})
t.Run("unknown client yields not found", func(t *testing.T) {
s := newMetadataStore(t, nil)
_, err := s.RefreshMetadataClient(t.Context(), id)
require.ErrorIs(t, err, gorm.ErrRecordNotFound)
})
t.Run("non-metadata client is rejected", func(t *testing.T) {
s := newMetadataStore(t, nil)
seed := model.OidcClient{Base: model.Base{ID: id}, Name: "Standard"}
require.NoError(t, s.db.Create(&seed).Error)
_, err := s.RefreshMetadataClient(t.Context(), id)
require.Error(t, err)
require.NotErrorIs(t, err, gorm.ErrRecordNotFound)
})
t.Run("forces re-fetch even when cache is fresh", func(t *testing.T) {
resp := testutils.NewMockResponse(http.StatusOK, body) //nolint:bodyclose // mock response, no real body
s := newMetadataStore(t, map[string]*http.Response{id: resp})
fresh := datatype.DateTime(time.Now().Add(time.Hour))
seed := model.OidcClient{
Base: model.Base{ID: id},
Name: "Old",
IsPublic: true,
PkceEnabled: true,
ClientType: model.OidcClientTypeCIMD,
MetadataExpiresAt: &fresh,
AccessTokenDurationMinutes: 2 * 60,
RefreshTokenDurationMinutes: 7 * 24 * 60,
}
require.NoError(t, s.db.Create(&seed).Error)
// A normal lookup still returns the cached value.
fc, err := s.GetClient(t.Context(), id)
require.NoError(t, err)
assert.Equal(t, "Old", fc.(Client).Name)
// A forced refresh re-fetches and updates the cached client.
c, err := s.RefreshMetadataClient(t.Context(), id)
require.NoError(t, err)
assert.Equal(t, "App", c.Name)
assert.True(t, c.IsMetadataDocument())
assert.Equal(t, int64(2*60), c.AccessTokenDurationMinutes)
assert.Equal(t, int64(7*24*60), c.RefreshTokenDurationMinutes)
})
}
type metadataStore struct {
*Store
resolver *cimdClientResolver
}
func (s *metadataStore) GetClient(ctx context.Context, id string) (fosite.Client, error) {
client, err := s.resolver.ResolveClient(ctx, id, s.Store.GetClient)
if err == nil {
return client, nil
}
if errors.Is(err, fosite.ErrNotFound) {
return nil, fosite.ErrNotFound
}
if fosite.LooksLikeCIMDURL(id) {
return nil, fosite.ErrInvalidClient.WithHint("The client metadata document could not be resolved.").WithWrap(err).WithDebug(err.Error())
}
return nil, err
}
func (s *metadataStore) RefreshMetadataClient(ctx context.Context, id string) (model.OidcClient, error) {
return s.resolver.RefreshMetadataClient(ctx, id)
}
func newMetadataStore(t *testing.T, responses map[string]*http.Response, allowlists ...func() []string) *metadataStore {
t.Helper()
getAllowlist := func() []string { return []string{"*"} }
if len(allowlists) > 0 {
getAllowlist = allowlists[0]
}
store := NewStore(testutils.NewDatabaseForTest(t), nil)
return &metadataStore{
Store: store,
resolver: newCIMDClientResolver(store, cimdResolverConfig{
getURLAllowlist: getAllowlist,
transport: &testutils.MockRoundTripper{Responses: responses},
}),
}
}
func TestGetClient_CIMDURLAllowlist(t *testing.T) {
const id = "https://8.8.8.8/oauth/client"
body := `{"client_id":"https://8.8.8.8/oauth/client","client_name":"App","redirect_uris":["https://app/cb"],"token_endpoint_auth_method":"none"}`
t.Run("empty allowlist denies without fetching", func(t *testing.T) {
resp := testutils.NewMockResponse(http.StatusOK, body) //nolint:bodyclose // mock response, no real body
s := newMetadataStore(t, map[string]*http.Response{id: resp},
func() []string { return nil },
)
_, err := s.GetClient(t.Context(), id)
require.ErrorIs(t, err, fosite.ErrInvalidClient)
var count int64
require.NoError(t, s.db.Model(&model.OidcClient{}).Where("id = ?", id).Count(&count).Error)
assert.Equal(t, int64(0), count)
})
t.Run("non-matching allowlist denies", func(t *testing.T) {
resp := testutils.NewMockResponse(http.StatusOK, body) //nolint:bodyclose // mock response, no real body
s := newMetadataStore(t, map[string]*http.Response{id: resp},
func() []string { return []string{"https://other.example.com/**"} },
)
_, err := s.GetClient(t.Context(), id)
require.ErrorIs(t, err, fosite.ErrInvalidClient)
})
t.Run("matching allowlist allows", func(t *testing.T) {
resp := testutils.NewMockResponse(http.StatusOK, body) //nolint:bodyclose // mock response, no real body
s := newMetadataStore(t, map[string]*http.Response{id: resp},
func() []string { return []string{"https://8.8.8.8/**"} },
)
fc, err := s.GetClient(t.Context(), id)
require.NoError(t, err)
assert.Equal(t, id, fc.(Client).ID)
})
t.Run("refresh denied when not allowlisted", func(t *testing.T) {
resp := testutils.NewMockResponse(http.StatusOK, body) //nolint:bodyclose // mock response, no real body
s := newMetadataStore(t, map[string]*http.Response{id: resp},
func() []string { return nil },
)
_, err := s.RefreshMetadataClient(t.Context(), id)
require.Error(t, err)
})
}
func TestGetClient_MetadataDocument(t *testing.T) {
const id = "https://8.8.8.8/oauth/client"
body := `{"client_id":"https://8.8.8.8/oauth/client","client_name":"App","redirect_uris":["https://app/cb"],"token_endpoint_auth_method":"none"}`
t.Run("non-URL id falls through to the database", func(t *testing.T) {
s := newMetadataStore(t, nil)
_, err := s.GetClient(t.Context(), "does-not-exist")
require.ErrorIs(t, err, fosite.ErrNotFound)
})
t.Run("allowlist changes apply without rebuilding the store", func(t *testing.T) {
allowlist := []string(nil)
resp := testutils.NewMockResponse(http.StatusOK, body) //nolint:bodyclose // mock response, no real body
s := newMetadataStore(t, map[string]*http.Response{id: resp},
func() []string { return allowlist },
)
_, err := s.GetClient(t.Context(), id)
require.ErrorIs(t, err, fosite.ErrInvalidClient)
allowlist = []string{"https://8.8.8.8/**"}
fc, err := s.GetClient(t.Context(), id)
require.NoError(t, err)
assert.Equal(t, id, fc.(Client).ID)
allowlist = nil
_, err = s.GetClient(t.Context(), id)
require.ErrorIs(t, err, fosite.ErrInvalidClient)
})
t.Run("pre-registered URL client takes precedence", func(t *testing.T) {
resp := testutils.NewMockResponse(http.StatusOK, body) //nolint:bodyclose // mock response, no real body
s := newMetadataStore(t, map[string]*http.Response{id: resp},
func() []string { return nil },
)
seed := model.OidcClient{Base: model.Base{ID: id}, Name: "Standard"}
require.NoError(t, s.db.Create(&seed).Error)
resolved, err := s.GetClient(t.Context(), id)
require.NoError(t, err)
assert.Equal(t, "Standard", resolved.(Client).Name)
stored, err := s.firstClientByID(t.Context(), id)
require.NoError(t, err)
assert.Equal(t, "Standard", stored.Name)
assert.False(t, stored.IsMetadataDocument())
})
t.Run("no-store metadata is rejected and not persisted", func(t *testing.T) {
resp := testutils.NewMockResponse(http.StatusOK, body) //nolint:bodyclose // mock response, no real body
resp.Header.Set("Cache-Control", "no-store")
s := newMetadataStore(t, map[string]*http.Response{id: resp})
_, err := s.GetClient(t.Context(), id)
require.ErrorIs(t, err, fosite.ErrInvalidClient)
var count int64
require.NoError(t, s.db.Model(&model.OidcClient{}).Where("id = ?", id).Count(&count).Error)
assert.Zero(t, count)
})
t.Run("private_key_jwt metadata is rejected and not persisted", func(t *testing.T) {
privateKeyBody := `{"client_id":"https://8.8.8.8/oauth/client","redirect_uris":["https://app/cb"],"token_endpoint_auth_method":"private_key_jwt","jwks_uri":"https://8.8.4.4/jwks"}` //nolint:gosec // G101 false positive: authentication method name, not a credential
resp := testutils.NewMockResponse(http.StatusOK, privateKeyBody) //nolint:bodyclose // mock response, no real body
s := newMetadataStore(t, map[string]*http.Response{id: resp})
_, err := s.GetClient(t.Context(), id)
require.ErrorIs(t, err, fosite.ErrInvalidClient)
var count int64
require.NoError(t, s.db.Model(&model.OidcClient{}).Where("id = ?", id).Count(&count).Error)
assert.Zero(t, count)
})
t.Run("cached authenticated metadata client is rejected", func(t *testing.T) {
s := newMetadataStore(t, nil)
fresh := datatype.DateTime(time.Now().Add(time.Hour))
seed := model.OidcClient{
Base: model.Base{ID: id},
ClientType: model.OidcClientTypeCIMD,
MetadataExpiresAt: &fresh,
Credentials: model.OidcClientCredentials{FederatedIdentities: []model.OidcClientFederatedIdentity{{
Issuer: id,
JWKS: "https://8.8.4.4/jwks",
}}},
}
require.NoError(t, s.db.Create(&seed).Error)
_, err := s.GetClient(t.Context(), id)
require.ErrorIs(t, err, fosite.ErrInvalidClient)
})
t.Run("cached authenticated metadata client is replaced when the document becomes public", func(t *testing.T) {
resp := testutils.NewMockResponse(http.StatusOK, body) //nolint:bodyclose // mock response, no real body
s := newMetadataStore(t, map[string]*http.Response{id: resp})
fresh := datatype.DateTime(time.Now().Add(time.Hour))
seed := model.OidcClient{
Base: model.Base{ID: id},
ClientType: model.OidcClientTypeCIMD,
MetadataExpiresAt: &fresh,
Credentials: model.OidcClientCredentials{FederatedIdentities: []model.OidcClientFederatedIdentity{{
Issuer: id,
JWKS: "https://8.8.4.4/jwks",
}}},
}
require.NoError(t, s.db.Create(&seed).Error)
resolved, err := s.GetClient(t.Context(), id)
require.NoError(t, err)
client := resolved.(Client)
assert.True(t, client.OidcClient.IsPublic)
assert.True(t, client.PkceEnabled)
assert.Empty(t, client.Credentials.FederatedIdentities)
})
t.Run("fetches, upserts, and reuses the cache", func(t *testing.T) {
resp := testutils.NewMockResponse(http.StatusOK, body) //nolint:bodyclose // mock response, no real body
resp.Header.Set("Cache-Control", "max-age=600")
s := newMetadataStore(t, map[string]*http.Response{id: resp})
fc, err := s.GetClient(t.Context(), id)
require.NoError(t, err)
c := fc.(Client).OidcClient
assert.Equal(t, id, c.ID)
assert.True(t, c.IsMetadataDocument())
assert.True(t, c.IsPublic)
require.NotNil(t, c.MetadataExpiresAt)
var count int64
require.NoError(t, s.db.Model(&model.OidcClient{}).Where("id = ?", id).Count(&count).Error)
assert.Equal(t, int64(1), count)
fc2, err := s.GetClient(t.Context(), id)
require.NoError(t, err)
assert.Equal(t, "App", fc2.(Client).Name)
})
// A display-only change must not cost the user their consent
t.Run("refetch when stale preserves consent", func(t *testing.T) {
resp := testutils.NewMockResponse(http.StatusOK, body) //nolint:bodyclose // mock response, no real body
s := newMetadataStore(t, map[string]*http.Response{id: resp})
stale := datatype.DateTime(time.Now().Add(-time.Hour))
seed := model.OidcClient{
Base: model.Base{ID: id}, Name: "Old", IsPublic: true, PkceEnabled: true,
ClientType: model.OidcClientTypeCIMD,
CallbackURLs: datatype.StringList{"https://app/cb"},
MetadataExpiresAt: &stale,
}
require.NoError(t, s.db.Create(&seed).Error)
require.NoError(t, s.db.Exec(
"INSERT INTO user_authorized_oidc_clients (client_id, user_id, scope, last_used_at) VALUES (?, ?, ?, ?)",
id, "user-1", "openid", time.Now()).Error)
fc, err := s.GetClient(t.Context(), id)
require.NoError(t, err)
assert.Equal(t, "App", fc.(Client).Name)
var consent int64
require.NoError(t, s.db.Table("user_authorized_oidc_clients").
Where("client_id = ?", id).Count(&consent).Error)
assert.Equal(t, int64(1), consent)
})
// Whoever controls the document could otherwise repoint an already-consented user's authorization code at a URL of their choosing, with no prompt
t.Run("changed redirect_uris revoke consent", func(t *testing.T) {
resp := testutils.NewMockResponse(http.StatusOK, body) //nolint:bodyclose // mock response, no real body
s := newMetadataStore(t, map[string]*http.Response{id: resp})
stale := datatype.DateTime(time.Now().Add(-time.Hour))
seed := model.OidcClient{
Base: model.Base{ID: id}, Name: "App", IsPublic: true, PkceEnabled: true,
ClientType: model.OidcClientTypeCIMD,
CallbackURLs: datatype.StringList{"https://app/previous-cb"},
MetadataExpiresAt: &stale,
}
require.NoError(t, s.db.Create(&seed).Error)
require.NoError(t, s.db.Exec(
"INSERT INTO user_authorized_oidc_clients (client_id, user_id, scope, last_used_at) VALUES (?, ?, ?, ?)",
id, "user-1", "openid", time.Now()).Error)
_, err := s.GetClient(t.Context(), id)
require.NoError(t, err)
var consent int64
require.NoError(t, s.db.Table("user_authorized_oidc_clients").
Where("client_id = ?", id).Count(&consent).Error)
assert.Zero(t, consent, "consent must not survive a redirect_uris change")
})
t.Run("failed consent revocation rolls back refreshed metadata", func(t *testing.T) {
resp := testutils.NewMockResponse(http.StatusOK, body) //nolint:bodyclose // mock response, no real body
s := newMetadataStore(t, map[string]*http.Response{id: resp})
stale := datatype.DateTime(time.Now().Add(-time.Hour))
seed := model.OidcClient{
Base: model.Base{ID: id}, Name: "App", IsPublic: true, PkceEnabled: true,
ClientType: model.OidcClientTypeCIMD,
CallbackURLs: datatype.StringList{"https://app/previous-cb"},
MetadataExpiresAt: &stale,
}
require.NoError(t, s.db.Create(&seed).Error)
require.NoError(t, s.db.Exec(
"INSERT INTO user_authorized_oidc_clients (client_id, user_id, scope, last_used_at) VALUES (?, ?, ?, ?)",
id, "user-1", "openid", time.Now()).Error)
require.NoError(t, s.db.Exec(`
CREATE TRIGGER reject_cimd_consent_delete
BEFORE DELETE ON user_authorized_oidc_clients
BEGIN
SELECT RAISE(ABORT, 'consent deletion blocked');
END;
`).Error)
_, err := s.GetClient(t.Context(), id)
require.Error(t, err)
stored, err := s.firstClientByID(t.Context(), id)
require.NoError(t, err)
assert.Equal(t, []string{"https://app/previous-cb"}, []string(stored.CallbackURLs))
var consent int64
require.NoError(t, s.db.Table("user_authorized_oidc_clients").Where("client_id = ?", id).Count(&consent).Error)
assert.Equal(t, int64(1), consent)
})
}
// Pocket ID matches administrator-registered callback URLs as wildcard patterns, so a self-asserted "*" would otherwise match every redirect URI in existence
func TestBuildClientFromMetadata_RejectsPatternRedirectURIs(t *testing.T) {
const id = "https://app.example.com/oauth/client"
unsupportedByPocketID := []string{
"*",
"https://*.example.com/cb",
"javascript:alert(1)",
}
for _, uri := range unsupportedByPocketID {
t.Run("redirect_uris "+uri, func(t *testing.T) {
doc := &fosite.ClientMetadataDocument{
ClientID: id,
RedirectURIs: []string{uri},
TokenEndpointAuthMethod: "none",
}
_, err := buildClientFromMetadata(doc, id)
require.Error(t, err)
})
}
// post_logout_redirect_uris go through the same validation
doc := &fosite.ClientMetadataDocument{
ClientID: id,
RedirectURIs: []string{"https://app.example.com/cb"},
PostLogoutRedirectURIs: []string{"*"},
TokenEndpointAuthMethod: "none",
}
_, err := buildClientFromMetadata(doc, id)
require.Error(t, err)
}
func TestMatchRedirectURI_MetadataClientExactMatchSucceeds(t *testing.T) {
metadataClient := Client{OidcClient: model.OidcClient{
Base: model.Base{ID: "https://app.example.com/oauth/client"},
ClientType: model.OidcClientTypeCIMD,
CallbackURLs: datatype.StringList{"https://app.example.com/callback"},
}}
matched, err := matchRedirectURI("https://app.example.com/callback", metadataClient)
require.NoError(t, err)
require.NotNil(t, matched)
assert.Equal(t, "https://app.example.com/callback", matched.String())
}
// A document declaring only authorization_code must not silently receive refresh_token and device_code
func TestClient_DeclaredCapabilitiesAreEnforced(t *testing.T) {
t.Run("grant types are restricted to the declaration", func(t *testing.T) {
client := Client{OidcClient: model.OidcClient{
ClientType: model.OidcClientTypeCIMD,
IsPublic: true,
MetadataGrantTypes: datatype.StringList{"authorization_code"},
}}
assert.Equal(t, fosite.Arguments{"authorization_code"}, client.GetGrantTypes())
})
t.Run("declared refresh_token is honoured", func(t *testing.T) {
client := Client{OidcClient: model.OidcClient{
ClientType: model.OidcClientTypeCIMD,
IsPublic: true,
MetadataGrantTypes: datatype.StringList{"authorization_code", "refresh_token"},
}}
assert.Equal(t, fosite.Arguments{"authorization_code", "refresh_token"}, client.GetGrantTypes())
})
t.Run("an empty declaration uses the RFC default", func(t *testing.T) {
client := Client{OidcClient: model.OidcClient{ClientType: model.OidcClientTypeCIMD, IsPublic: true}}
assert.Equal(t, fosite.Arguments{"authorization_code"}, client.GetGrantTypes())
})
t.Run("registered clients are unaffected", func(t *testing.T) {
client := Client{OidcClient: model.OidcClient{
ClientType: model.OidcClientTypeStandard,
IsPublic: true,
MetadataGrantTypes: datatype.StringList{"authorization_code"},
}}
assert.Contains(t, client.GetGrantTypes(), "refresh_token")
})
}
func TestBuildClientFromMetadata_RecordsDeclaredCapabilities(t *testing.T) {
const id = "https://app.example.com/oauth/client"
t.Run("declared values are recorded", func(t *testing.T) {
doc := &fosite.ClientMetadataDocument{
ClientID: id,
RedirectURIs: []string{"https://app.example.com/cb"},
TokenEndpointAuthMethod: "none",
GrantTypes: []string{"authorization_code", "refresh_token"},
}
client, err := buildClientFromMetadata(doc, id)
require.NoError(t, err)
assert.Equal(t, datatype.StringList{"authorization_code", "refresh_token"}, client.MetadataGrantTypes)
})
t.Run("omitted grant_types defaults to authorization_code", func(t *testing.T) {
doc := &fosite.ClientMetadataDocument{
ClientID: id,
RedirectURIs: []string{"https://app.example.com/cb"},
TokenEndpointAuthMethod: "none",
}
client, err := buildClientFromMetadata(doc, id)
require.NoError(t, err)
assert.Equal(t, datatype.StringList{"authorization_code"}, client.MetadataGrantTypes)
})
}
// The allowlist is the operator's only gate on which URLs may become clients, and it is matched with the same wildcard syntax as callback URLs
func TestCIMDURLAllowlist_HostilePatterns(t *testing.T) {
const id = "https://8.8.8.8/oauth/client"
body := `{"client_id":"https://8.8.8.8/oauth/client","client_name":"App","redirect_uris":["https://app/cb"],"token_endpoint_auth_method":"none"}`
denied := []struct {
name string
allowlist []string
}{
{"empty list denies", nil},
{"different host denies", []string{"https://other.example.com/**"}},
{"different scheme denies", []string{"http://8.8.8.8/**"}},
{"host as a path segment denies", []string{"https://evil.example/8.8.8.8/**"}},
{"prefix of the host denies", []string{"https://8.8.8.8.evil.example/**"}},
}
for _, tc := range denied {
t.Run(tc.name, func(t *testing.T) {
resp := testutils.NewMockResponse(http.StatusOK, body) //nolint:bodyclose // mock response, no real body
s := newMetadataStore(t, map[string]*http.Response{id: resp}, func() []string { return tc.allowlist })
_, err := s.GetClient(t.Context(), id)
require.ErrorIs(t, err, fosite.ErrInvalidClient)
var count int64
require.NoError(t, s.db.Model(&model.OidcClient{}).Where("id = ?", id).Count(&count).Error)
assert.Zero(t, count, "a denied client must never be persisted")
})
}
// "*" matches everything, which is the fully open configuration and the operator's choice rather than a bug
t.Run("bare wildcard allows everything", func(t *testing.T) {
resp := testutils.NewMockResponse(http.StatusOK, body) //nolint:bodyclose // mock response, no real body
s := newMetadataStore(t, map[string]*http.Response{id: resp}, func() []string { return []string{"*"} })
_, err := s.GetClient(t.Context(), id)
require.NoError(t, err)
})
}
// Section 3 constrains the Client Identifier URL, and none of these vectors may reach a fetch
func TestGetClient_HostileClientIDURLs(t *testing.T) {
hostile := []string{
"http://8.8.8.8/oauth/client", // not https
"https://8.8.8.8", // no path component
"https://user:pass@8.8.8.8/oauth/client", // userinfo
"https://8.8.8.8/oauth/client#frag", // fragment
"https://8.8.8.8/oauth/client?x=1", // query component
"https://8.8.8.8/oauth/../client", // dot segments
"https://127.0.0.1/oauth/client", // loopback
"https://169.254.169.254/latest/meta-data", // cloud metadata
}
for _, id := range hostile {
t.Run(id, func(t *testing.T) {
s := newMetadataStore(t, nil)
_, err := s.GetClient(t.Context(), id)
require.Error(t, err, "must not be accepted as a Client Identifier URL")
var count int64
require.NoError(t, s.db.Model(&model.OidcClient{}).Where("id = ?", id).Count(&count).Error)
assert.Zero(t, count)
})
}
}
// Section 5.2 forbids caching error responses or invalid documents, and section 5 requires every non-200 status to be treated as an error
func TestGetClient_MetadataFailuresAreNotPersisted(t *testing.T) {
const id = "https://8.8.8.8/oauth/client"
cases := []struct {
name string
response *http.Response
}{
{"404", testutils.NewMockResponse(http.StatusNotFound, `{}`)}, //nolint:bodyclose // mock
{"500", testutils.NewMockResponse(http.StatusInternalServerError, `{}`)}, //nolint:bodyclose // mock
{"204", testutils.NewMockResponse(http.StatusNoContent, ``)}, //nolint:bodyclose // mock
{"invalid JSON", testutils.NewMockResponse(http.StatusOK, `{not json`)}, //nolint:bodyclose // mock
{"truncated JSON", testutils.NewMockResponse(http.StatusOK, `{"client_id":`)}, //nolint:bodyclose // mock
{"empty body", testutils.NewMockResponse(http.StatusOK, ``)}, //nolint:bodyclose // mock
{"null body", testutils.NewMockResponse(http.StatusOK, `null`)}, //nolint:bodyclose // mock
{"client_id mismatch", testutils.NewMockResponse(http.StatusOK, `{"client_id":"https://evil/x"}`)}, //nolint:bodyclose // mock
{"wrong client_id type", testutils.NewMockResponse(http.StatusOK, `{"client_id":123}`)}, //nolint:bodyclose // mock
{"oversize document", testutils.NewMockResponse(http.StatusOK, `{"client_id":"https://8.8.8.8/oauth/client","padding":"`+strings.Repeat("a", 6*1024)+`"}`)}, //nolint:bodyclose // mock
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
s := newMetadataStore(t, map[string]*http.Response{id: tc.response})
_, err := s.GetClient(t.Context(), id)
require.Error(t, err)
var count int64
require.NoError(t, s.db.Model(&model.OidcClient{}).Where("id = ?", id).Count(&count).Error)
assert.Zero(t, count, "a failed or invalid document must never be cached")
})
}
t.Run("no response at all", func(t *testing.T) {
s := newMetadataStore(t, nil)
_, err := s.GetClient(t.Context(), id)
require.Error(t, err)
})
}
Reference in New Issue View Git Blame Copy Permalink