test: cover the hardened provider fetch and client redirect policy

Verified that the redirect test fails without the CheckRedirect policy: without it the redirect is followed and the target is reached.
2026-08-19 11:06:17 +00:00 · 2026-07-28 12:52:45 +02:00
parent b99a00479d
commit 070a4127ae
2 changed files with 81 additions and 0 deletions
@@ -0,0 +1,39 @@
+package client_test
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/nais/wonderwall/pkg/mock"
+)
+
+// The token and pushed authorization endpoints receive client credentials, so a redirect
+// must not be followed; doing so would forward the credentials to another host.
+func TestClient_RefusesRedirect(t *testing.T) {
+	redirected := false
+	target := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		redirected = true
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer target.Close()
+
+	redirector := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, target.URL, http.StatusTemporaryRedirect)
+	}))
+	defer redirector.Close()
+
+	openidConfig := mock.NewTestConfiguration(mock.Config())
+	openidConfig.TestProvider.SetTokenEndpoint(redirector.URL)
+
+	_, err := newTestClientWithConfig(openidConfig).
+		RefreshGrant(context.Background(), "some-refresh-token", "", "")
+
+	require.Error(t, err)
+	assert.ErrorContains(t, err, "refusing to follow redirect")
+	assert.False(t, redirected, "the redirect target must not be reached")
+}
@@ -0,0 +1,42 @@
+package config_test
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/nais/wonderwall/pkg/mock"
+	openidconfig "github.com/nais/wonderwall/pkg/openid/config"
+)
+
+func TestNewProviderConfig_NonOK(t *testing.T) {
+	for _, statusCode := range []int{http.StatusNotFound, http.StatusInternalServerError} {
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.WriteHeader(statusCode)
+			_, _ = w.Write([]byte("<html>not a metadata document</html>"))
+		}))
+		defer server.Close()
+
+		cfg := mock.Config()
+		cfg.OpenID.WellKnownURL = server.URL
+
+		_, err := openidconfig.NewProviderConfig(context.Background(), cfg)
+		require.Error(t, err)
+		assert.ErrorContains(t, err, "responded with HTTP")
+	}
+}
+
+func TestNewProviderConfig_CancelledContext(t *testing.T) {
+	cfg := mock.Config()
+	cfg.OpenID.WellKnownURL = "http://localhost:0/.well-known/openid-configuration"
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	_, err := openidconfig.NewProviderConfig(ctx, cfg)
+	assert.Error(t, err)
+}