diff --git a/pkg/openid/client/client_redirect_test.go b/pkg/openid/client/client_redirect_test.go new file mode 100644 index 0000000..4854a9a --- /dev/null +++ b/pkg/openid/client/client_redirect_test.go @@ -0,0 +1,39 @@ +package client_test + +import ( + "context" + "net/http" + "net/http/httptest" + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + "github.com/nais/wonderwall/pkg/mock" +) + +// The token and pushed authorization endpoints receive client credentials, so a redirect +// must not be followed; doing so would forward the credentials to another host. +func TestClient_RefusesRedirect(t *testing.T) { + redirected := false + target := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + redirected = true + w.WriteHeader(http.StatusOK) + })) + defer target.Close() + + redirector := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + http.Redirect(w, r, target.URL, http.StatusTemporaryRedirect) + })) + defer redirector.Close() + + openidConfig := mock.NewTestConfiguration(mock.Config()) + openidConfig.TestProvider.SetTokenEndpoint(redirector.URL) + + _, err := newTestClientWithConfig(openidConfig). + RefreshGrant(context.Background(), "some-refresh-token", "", "") + + require.Error(t, err) + assert.ErrorContains(t, err, "refusing to follow redirect") + assert.False(t, redirected, "the redirect target must not be reached") +} diff --git a/pkg/openid/config/provider_fetch_test.go b/pkg/openid/config/provider_fetch_test.go new file mode 100644 index 0000000..904fe17 --- /dev/null +++ b/pkg/openid/config/provider_fetch_test.go @@ -0,0 +1,42 @@ +package config_test + +import ( + "context" + "net/http" + "net/http/httptest" + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + "github.com/nais/wonderwall/pkg/mock" + openidconfig "github.com/nais/wonderwall/pkg/openid/config" +) + +func TestNewProviderConfig_NonOK(t *testing.T) { + for _, statusCode := range []int{http.StatusNotFound, http.StatusInternalServerError} { + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.WriteHeader(statusCode) + _, _ = w.Write([]byte("not a metadata document")) + })) + defer server.Close() + + cfg := mock.Config() + cfg.OpenID.WellKnownURL = server.URL + + _, err := openidconfig.NewProviderConfig(context.Background(), cfg) + require.Error(t, err) + assert.ErrorContains(t, err, "responded with HTTP") + } +} + +func TestNewProviderConfig_CancelledContext(t *testing.T) { + cfg := mock.Config() + cfg.OpenID.WellKnownURL = "http://localhost:0/.well-known/openid-configuration" + + ctx, cancel := context.WithCancel(context.Background()) + cancel() + + _, err := openidconfig.NewProviderConfig(ctx, cfg) + assert.Error(t, err) +}