From a8399a8f8ffd201cd84374fc376c03e1e58762f7 Mon Sep 17 00:00:00 2001 From: Trong Huu Nguyen Date: Mon, 10 Aug 2026 12:36:09 +0200 Subject: [PATCH] test: merge split test files into their package test files The redirect and provider fetch tests lived in files of their own for no reason other than how they were added. --- pkg/openid/client/client_redirect_test.go | 39 --------------------- pkg/openid/client/client_test.go | 29 ++++++++++++++++ pkg/openid/config/provider_fetch_test.go | 42 ----------------------- pkg/openid/config/provider_test.go | 33 ++++++++++++++++++ 4 files changed, 62 insertions(+), 81 deletions(-) delete mode 100644 pkg/openid/client/client_redirect_test.go delete mode 100644 pkg/openid/config/provider_fetch_test.go diff --git a/pkg/openid/client/client_redirect_test.go b/pkg/openid/client/client_redirect_test.go deleted file mode 100644 index 4854a9a..0000000 --- a/pkg/openid/client/client_redirect_test.go +++ /dev/null @@ -1,39 +0,0 @@ -package client_test - -import ( - "context" - "net/http" - "net/http/httptest" - "testing" - - "github.com/stretchr/testify/assert" - "github.com/stretchr/testify/require" - - "github.com/nais/wonderwall/pkg/mock" -) - -// The token and pushed authorization endpoints receive client credentials, so a redirect -// must not be followed; doing so would forward the credentials to another host. -func TestClient_RefusesRedirect(t *testing.T) { - redirected := false - target := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - redirected = true - w.WriteHeader(http.StatusOK) - })) - defer target.Close() - - redirector := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - http.Redirect(w, r, target.URL, http.StatusTemporaryRedirect) - })) - defer redirector.Close() - - openidConfig := mock.NewTestConfiguration(mock.Config()) - openidConfig.TestProvider.SetTokenEndpoint(redirector.URL) - - _, err := newTestClientWithConfig(openidConfig). - RefreshGrant(context.Background(), "some-refresh-token", "", "") - - require.Error(t, err) - assert.ErrorContains(t, err, "refusing to follow redirect") - assert.False(t, redirected, "the redirect target must not be reached") -} diff --git a/pkg/openid/client/client_test.go b/pkg/openid/client/client_test.go index 8cc9b7d..5fedb9b 100644 --- a/pkg/openid/client/client_test.go +++ b/pkg/openid/client/client_test.go @@ -1,8 +1,11 @@ package client_test import ( + "context" "encoding/base64" "encoding/json" + "net/http" + "net/http/httptest" "strings" "testing" "time" @@ -157,6 +160,32 @@ func TestClientAuthenticationAssertionAlgorithms(t *testing.T) { } } +// The token and pushed authorization endpoints receive client credentials, so a redirect +// must not be followed; doing so would forward the credentials to another host. +func TestClient_RefusesRedirect(t *testing.T) { + redirected := false + target := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + redirected = true + w.WriteHeader(http.StatusOK) + })) + defer target.Close() + + redirector := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + http.Redirect(w, r, target.URL, http.StatusTemporaryRedirect) + })) + defer redirector.Close() + + openidConfig := mock.NewTestConfiguration(mock.Config()) + openidConfig.TestProvider.SetTokenEndpoint(redirector.URL) + + _, err := newTestClientWithConfig(openidConfig). + RefreshGrant(context.Background(), "some-refresh-token", "", "") + + require.Error(t, err) + assert.ErrorContains(t, err, "refusing to follow redirect") + assert.False(t, redirected, "the redirect target must not be reached") +} + // assertFlattenedAudience asserts that the raw JWT assertion has a flattened audience claim, i.e. aud is a string value. // We do this as the jwx library only exposes the audience as a slice of strings for parsed JWTs. func assertFlattenedAudience(t *testing.T, jwtAssertion string) { diff --git a/pkg/openid/config/provider_fetch_test.go b/pkg/openid/config/provider_fetch_test.go deleted file mode 100644 index df65b1a..0000000 --- a/pkg/openid/config/provider_fetch_test.go +++ /dev/null @@ -1,42 +0,0 @@ -package config_test - -import ( - "context" - "net/http" - "net/http/httptest" - "testing" - - "github.com/stretchr/testify/assert" - "github.com/stretchr/testify/require" - - "github.com/nais/wonderwall/pkg/mock" - openidconfig "github.com/nais/wonderwall/pkg/openid/config" -) - -func TestNewProviderConfig_NonOK(t *testing.T) { - for _, statusCode := range []int{http.StatusNotFound, http.StatusInternalServerError} { - server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - w.WriteHeader(statusCode) - _, _ = w.Write([]byte("not a metadata document")) - })) - defer server.Close() - - cfg := mock.Config() - cfg.OpenID.WellKnownURL = server.URL - - _, err := openidconfig.NewProviderConfig(context.Background(), cfg, nil) - require.Error(t, err) - assert.ErrorContains(t, err, "responded with HTTP") - } -} - -func TestNewProviderConfig_CancelledContext(t *testing.T) { - cfg := mock.Config() - cfg.OpenID.WellKnownURL = "http://localhost:0/.well-known/openid-configuration" - - ctx, cancel := context.WithCancel(context.Background()) - cancel() - - _, err := openidconfig.NewProviderConfig(ctx, cfg, nil) - assert.Error(t, err) -} diff --git a/pkg/openid/config/provider_test.go b/pkg/openid/config/provider_test.go index 0eeda36..4b982a5 100644 --- a/pkg/openid/config/provider_test.go +++ b/pkg/openid/config/provider_test.go @@ -1,6 +1,9 @@ package config_test import ( + "context" + "net/http" + "net/http/httptest" "testing" "github.com/lestrrat-go/jwx/v3/jwa" @@ -108,3 +111,33 @@ func TestProviderMetadata_ValidateClientAssertionSigningAlg(t *testing.T) { }) } } + +func TestNewProviderConfig_NonOK(t *testing.T) { + for _, statusCode := range []int{http.StatusNotFound, http.StatusInternalServerError} { + t.Run(http.StatusText(statusCode), func(t *testing.T) { + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.WriteHeader(statusCode) + _, _ = w.Write([]byte("not a metadata document")) + })) + defer server.Close() + + cfg := mock.Config() + cfg.OpenID.WellKnownURL = server.URL + + _, err := openidconfig.NewProviderConfig(context.Background(), cfg, nil) + require.Error(t, err) + assert.ErrorContains(t, err, "responded with HTTP") + }) + } +} + +func TestNewProviderConfig_CancelledContext(t *testing.T) { + cfg := mock.Config() + cfg.OpenID.WellKnownURL = "http://localhost:0/.well-known/openid-configuration" + + ctx, cancel := context.WithCancel(context.Background()) + cancel() + + _, err := openidconfig.NewProviderConfig(ctx, cfg, nil) + assert.Error(t, err) +}