R80: req secret for introspection, pool conn on panic

review_r80_test.go

@@ -0,0 +1,43 @@
+package traefikoidc
+
+import (
+	"strings"
+	"testing"
+)
+
+// TestIntrospectionRequiresClientSecret is a regression: Config.Validate allowed
+// requireTokenIntrospection together with clientAuthMethod=private_key_jwt and no
+// client secret, but the introspection path always authenticates via
+// client_secret_basic (SetBasicAuth in token_introspection.go) — so the dead
+// config passed validation yet every introspection sent empty Basic credentials
+// and failed. Validate must reject it.
+func TestIntrospectionRequiresClientSecret(t *testing.T) {
+	mk := func() *Config {
+		c := CreateConfig()
+		c.ProviderURL = "https://provider.example.com"
+		c.ClientID = "test-client"
+		c.SessionEncryptionKey = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+		c.CallbackURL = "/callback"
+		c.RequireTokenIntrospection = true
+		c.ClientAuthMethod = "private_key_jwt"
+		c.ClientAssertionPrivateKey = "-----BEGIN PRIVATE KEY-----\nMIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg"
+		c.ClientAssertionKeyID = "key-id-1"
+		return c
+	}
+
+	// OLD behavior: no client secret -> Validate still passed, introspection dead.
+	noSecret := mk()
+	noSecret.ClientSecret = ""
+	if err := noSecret.Validate(); err == nil {
+		t.Fatalf("expected Validate to require clientSecret when introspection is enabled")
+	} else if !strings.Contains(err.Error(), "clientSecret is required when requireTokenIntrospection") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	// With a secret the config is valid.
+	withSecret := mk()
+	withSecret.ClientSecret = "secret"
+	if err := withSecret.Validate(); err != nil {
+		t.Fatalf("expected Validate to pass with a client secret, got: %v", err)
+	}
+}