github/wonderwall
1
0
Fork 0
mirror of https://github.com/nais/wonderwall.git synced 2026-08-18 10:36:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

test: merge split test files into their package test files

Browse Source 
The redirect and provider fetch tests lived in files of their own for no
reason other than how they were added.
This commit is contained in:
Trong Huu Nguyen
2026-08-10 12:36:09 +02:00
parent c399a781b6
commit a8399a8f8f
4 changed files with 62 additions and 81 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/openid/client/client_redirect_test.go
-39
View File
@@ -1,39 +0,0 @@
package client_test
import (
"context"
"net/http"
"net/http/httptest"
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/nais/wonderwall/pkg/mock"
)
// The token and pushed authorization endpoints receive client credentials, so a redirect
// must not be followed; doing so would forward the credentials to another host.
func TestClient_RefusesRedirect(t *testing.T) {
redirected := false
target := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
redirected = true
w.WriteHeader(http.StatusOK)
}))
defer target.Close()
redirector := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
http.Redirect(w, r, target.URL, http.StatusTemporaryRedirect)
}))
defer redirector.Close()
openidConfig := mock.NewTestConfiguration(mock.Config())
openidConfig.TestProvider.SetTokenEndpoint(redirector.URL)
_, err := newTestClientWithConfig(openidConfig).
RefreshGrant(context.Background(), "some-refresh-token", "", "")
require.Error(t, err)
assert.ErrorContains(t, err, "refusing to follow redirect")
assert.False(t, redirected, "the redirect target must not be reached")
}
pkg/openid/client/client_test.go
+29
View File
@@ -1,8 +1,11 @@
package client_test
import (
"context"
"encoding/base64"
"encoding/json"
"net/http"
"net/http/httptest"
"strings"
"testing"
"time"
@@ -157,6 +160,32 @@ func TestClientAuthenticationAssertionAlgorithms(t *testing.T) {
}
}
// The token and pushed authorization endpoints receive client credentials, so a redirect
// must not be followed; doing so would forward the credentials to another host.
func TestClient_RefusesRedirect(t *testing.T) {
redirected := false
target := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
redirected = true
w.WriteHeader(http.StatusOK)
}))
defer target.Close()
redirector := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
http.Redirect(w, r, target.URL, http.StatusTemporaryRedirect)
}))
defer redirector.Close()
openidConfig := mock.NewTestConfiguration(mock.Config())
openidConfig.TestProvider.SetTokenEndpoint(redirector.URL)
_, err := newTestClientWithConfig(openidConfig).
RefreshGrant(context.Background(), "some-refresh-token", "", "")
require.Error(t, err)
assert.ErrorContains(t, err, "refusing to follow redirect")
assert.False(t, redirected, "the redirect target must not be reached")
}
// assertFlattenedAudience asserts that the raw JWT assertion has a flattened audience claim, i.e. aud is a string value.
// We do this as the jwx library only exposes the audience as a slice of strings for parsed JWTs.
func assertFlattenedAudience(t *testing.T, jwtAssertion string) {
pkg/openid/config/provider_fetch_test.go
-42
View File
@@ -1,42 +0,0 @@
package config_test
import (
"context"
"net/http"
"net/http/httptest"
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/nais/wonderwall/pkg/mock"
openidconfig "github.com/nais/wonderwall/pkg/openid/config"
)
func TestNewProviderConfig_NonOK(t *testing.T) {
for _, statusCode := range []int{http.StatusNotFound, http.StatusInternalServerError} {
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(statusCode)
_, _ = w.Write([]byte("<html>not a metadata document</html>"))
}))
defer server.Close()
cfg := mock.Config()
cfg.OpenID.WellKnownURL = server.URL
_, err := openidconfig.NewProviderConfig(context.Background(), cfg, nil)
require.Error(t, err)
assert.ErrorContains(t, err, "responded with HTTP")
}
}
func TestNewProviderConfig_CancelledContext(t *testing.T) {
cfg := mock.Config()
cfg.OpenID.WellKnownURL = "http://localhost:0/.well-known/openid-configuration"
ctx, cancel := context.WithCancel(context.Background())
cancel()
_, err := openidconfig.NewProviderConfig(ctx, cfg, nil)
assert.Error(t, err)
}
pkg/openid/config/provider_test.go
+33
View File
@@ -1,6 +1,9 @@
package config_test
import (
"context"
"net/http"
"net/http/httptest"
"testing"
"github.com/lestrrat-go/jwx/v3/jwa"
@@ -108,3 +111,33 @@ func TestProviderMetadata_ValidateClientAssertionSigningAlg(t *testing.T) {
})
}
}
func TestNewProviderConfig_NonOK(t *testing.T) {
for _, statusCode := range []int{http.StatusNotFound, http.StatusInternalServerError} {
t.Run(http.StatusText(statusCode), func(t *testing.T) {
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(statusCode)
_, _ = w.Write([]byte("<html>not a metadata document</html>"))
}))
defer server.Close()
cfg := mock.Config()
cfg.OpenID.WellKnownURL = server.URL
_, err := openidconfig.NewProviderConfig(context.Background(), cfg, nil)
require.Error(t, err)
assert.ErrorContains(t, err, "responded with HTTP")
})
}
}
func TestNewProviderConfig_CancelledContext(t *testing.T) {
cfg := mock.Config()
cfg.OpenID.WellKnownURL = "http://localhost:0/.well-known/openid-configuration"
ctx, cancel := context.WithCancel(context.Background())
cancel()
_, err := openidconfig.NewProviderConfig(ctx, cfg, nil)
assert.Error(t, err)
}