github.com/wanliu/go-oauth2-server@v0.0.0-20180817021415-f928fa1580df/oauth/grant_type_authorization_code_test.go (about) 1 package oauth_test 2 3 import ( 4 "net/http" 5 "net/http/httptest" 6 "net/url" 7 "time" 8 9 "github.com/RichardKnop/uuid" 10 "github.com/stretchr/testify/assert" 11 "github.com/wanliu/go-oauth2-server/models" 12 "github.com/wanliu/go-oauth2-server/oauth" 13 "github.com/wanliu/go-oauth2-server/oauth/tokentypes" 14 "github.com/wanliu/go-oauth2-server/test-util" 15 "github.com/wanliu/go-oauth2-server/util" 16 ) 17 18 func (suite *OauthTestSuite) TestAuthorizationCodeGrantEmptyNotFound() { 19 // Prepare a request 20 r, err := http.NewRequest("POST", "http://1.2.3.4/v1/oauth/tokens", nil) 21 assert.NoError(suite.T(), err, "Request setup should not get an error") 22 r.SetBasicAuth("test_client_1", "test_secret") 23 r.PostForm = url.Values{ 24 "grant_type": {"authorization_code"}, 25 "code": {""}, 26 } 27 28 // Serve the request 29 w := httptest.NewRecorder() 30 suite.router.ServeHTTP(w, r) 31 32 // Check the response 33 testutil.TestResponseForError( 34 suite.T(), 35 w, 36 oauth.ErrAuthorizationCodeNotFound.Error(), 37 404, 38 ) 39 } 40 41 func (suite *OauthTestSuite) TestAuthorizationCodeGrantBogusNotFound() { 42 // Prepare a request 43 r, err := http.NewRequest("POST", "http://1.2.3.4/v1/oauth/tokens", nil) 44 assert.NoError(suite.T(), err, "Request setup should not get an error") 45 r.SetBasicAuth("test_client_1", "test_secret") 46 r.PostForm = url.Values{ 47 "grant_type": {"authorization_code"}, 48 "code": {"bogus"}, 49 } 50 51 // Serve the request 52 w := httptest.NewRecorder() 53 suite.router.ServeHTTP(w, r) 54 55 // Check the response 56 testutil.TestResponseForError( 57 suite.T(), 58 w, 59 oauth.ErrAuthorizationCodeNotFound.Error(), 60 404, 61 ) 62 } 63 64 func (suite *OauthTestSuite) TestAuthorizationCodeGrantExpired() { 65 // Insert a test authorization code 66 err := suite.db.Create(&models.OauthAuthorizationCode{ 67 MyGormModel: models.MyGormModel{ 68 ID: uuid.New(), 69 CreatedAt: time.Now().UTC(), 70 }, 71 Code: "test_code", 72 ExpiresAt: time.Now().UTC().Add(-10 * time.Second), 73 Client: suite.clients[0], 74 User: suite.users[0], 75 RedirectURI: util.StringOrNull("https://www.example.com"), 76 Scope: "read_write", 77 }).Error 78 assert.NoError(suite.T(), err, "Inserting test data failed") 79 80 // Prepare a request 81 r, err := http.NewRequest("POST", "http://1.2.3.4/v1/oauth/tokens", nil) 82 assert.NoError(suite.T(), err, "Request setup should not get an error") 83 r.SetBasicAuth("test_client_1", "test_secret") 84 r.PostForm = url.Values{ 85 "grant_type": {"authorization_code"}, 86 "code": {"test_code"}, 87 "redirect_uri": {"https://www.example.com"}, 88 } 89 90 // Serve the request 91 w := httptest.NewRecorder() 92 suite.router.ServeHTTP(w, r) 93 94 // Check the response 95 testutil.TestResponseForError( 96 suite.T(), 97 w, 98 oauth.ErrAuthorizationCodeExpired.Error(), 99 400, 100 ) 101 } 102 103 func (suite *OauthTestSuite) TestAuthorizationCodeGrantInvalidRedirectURI() { 104 // Insert a test authorization code 105 err := suite.db.Create(&models.OauthAuthorizationCode{ 106 MyGormModel: models.MyGormModel{ 107 ID: uuid.New(), 108 CreatedAt: time.Now().UTC(), 109 }, 110 Code: "test_code", 111 ExpiresAt: time.Now().UTC().Add(+10 * time.Second), 112 Client: suite.clients[0], 113 User: suite.users[0], 114 RedirectURI: util.StringOrNull("https://www.example.com"), 115 Scope: "read_write", 116 }).Error 117 assert.NoError(suite.T(), err, "Inserting test data failed") 118 119 // Prepare a request 120 r, err := http.NewRequest("POST", "http://1.2.3.4/v1/oauth/tokens", nil) 121 assert.NoError(suite.T(), err, "Request setup should not get an error") 122 r.SetBasicAuth("test_client_1", "test_secret") 123 r.PostForm = url.Values{ 124 "grant_type": {"authorization_code"}, 125 "code": {"test_code"}, 126 "redirect_uri": {"https://bogus"}, 127 } 128 129 // Serve the request 130 w := httptest.NewRecorder() 131 suite.router.ServeHTTP(w, r) 132 133 // Check the response 134 testutil.TestResponseForError( 135 suite.T(), 136 w, 137 oauth.ErrInvalidRedirectURI.Error(), 138 400, 139 ) 140 } 141 142 func (suite *OauthTestSuite) TestAuthorizationCodeGrant() { 143 // Insert a test authorization code 144 err := suite.db.Create(&models.OauthAuthorizationCode{ 145 MyGormModel: models.MyGormModel{ 146 ID: uuid.New(), 147 CreatedAt: time.Now().UTC(), 148 }, 149 Code: "test_code", 150 ExpiresAt: time.Now().UTC().Add(+10 * time.Second), 151 Client: suite.clients[0], 152 User: suite.users[0], 153 RedirectURI: util.StringOrNull("https://www.example.com"), 154 Scope: "read_write", 155 }).Error 156 assert.NoError(suite.T(), err, "Inserting test data failed") 157 158 // Prepare a request 159 r, err := http.NewRequest("POST", "http://1.2.3.4/v1/oauth/tokens", nil) 160 assert.NoError(suite.T(), err, "Request setup should not get an error") 161 r.SetBasicAuth("test_client_1", "test_secret") 162 r.PostForm = url.Values{ 163 "grant_type": {"authorization_code"}, 164 "code": {"test_code"}, 165 "redirect_uri": {"https://www.example.com"}, 166 } 167 168 // Serve the request 169 w := httptest.NewRecorder() 170 suite.router.ServeHTTP(w, r) 171 172 // Fetch data 173 accessToken, refreshToken := new(models.OauthAccessToken), new(models.OauthRefreshToken) 174 assert.False(suite.T(), models.OauthAccessTokenPreload(suite.db). 175 Last(accessToken).RecordNotFound()) 176 assert.False(suite.T(), models.OauthRefreshTokenPreload(suite.db). 177 Last(refreshToken).RecordNotFound()) 178 179 // Check the response 180 expected := &oauth.AccessTokenResponse{ 181 UserID: accessToken.User.MetaUserID, 182 AccessToken: accessToken.Token, 183 ExpiresIn: 3600, 184 TokenType: tokentypes.Bearer, 185 Scope: "read_write", 186 RefreshToken: refreshToken.Token, 187 } 188 testutil.TestResponseObject(suite.T(), w, expected, 200) 189 190 // The authorization code should get deleted after use 191 assert.True(suite.T(), suite.db.Unscoped(). 192 First(new(models.OauthAuthorizationCode)).RecordNotFound()) 193 }