fixup! fixup! fixup! Further pursue of perfection.

2026-10-17 04:37:48 +00:00 · 2025-09-05 13:57:54 +01:00
parent 2c902eaafb
commit e267cb3a6f
17 changed files with 7751 additions and 13 deletions
@@ -0,0 +1,695 @@
+package providers
+
+import (
+	"errors"
+	"fmt"
+	"net/url"
+	"runtime"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+// mockSession implements the Session interface for testing
+type mockSession struct {
+	idToken       string
+	accessToken   string
+	refreshToken  string
+	authenticated bool
+}
+
+func (m *mockSession) GetIDToken() string {
+	return m.idToken
+}
+
+func (m *mockSession) GetAccessToken() string {
+	return m.accessToken
+}
+
+func (m *mockSession) GetRefreshToken() string {
+	return m.refreshToken
+}
+
+func (m *mockSession) GetAuthenticated() bool {
+	return m.authenticated
+}
+
+// mockTokenVerifier implements TokenVerifier for testing
+type mockTokenVerifier struct {
+	shouldFail    bool
+	expiredTokens map[string]bool
+}
+
+func (m *mockTokenVerifier) VerifyToken(token string) error {
+	if m.shouldFail {
+		return errors.New("token verification failed")
+	}
+	if m.expiredTokens != nil && m.expiredTokens[token] {
+		return errors.New("token has expired")
+	}
+	return nil
+}
+
+// mockTokenCache implements TokenCache for testing
+type mockTokenCache struct {
+	data map[string]map[string]interface{}
+}
+
+func (m *mockTokenCache) Get(key string) (map[string]interface{}, bool) {
+	if m.data == nil {
+		return nil, false
+	}
+	claims, exists := m.data[key]
+	return claims, exists
+}
+
+func TestNewAzureProvider(t *testing.T) {
+	provider := NewAzureProvider()
+
+	if provider == nil {
+		t.Fatal("expected non-nil Azure provider")
+	}
+
+	if provider.BaseProvider == nil {
+		t.Fatal("expected non-nil BaseProvider")
+	}
+}
+
+func TestAzureProvider_GetType(t *testing.T) {
+	provider := NewAzureProvider()
+	providerType := provider.GetType()
+
+	if providerType != ProviderTypeAzure {
+		t.Errorf("expected provider type %d, got %d", ProviderTypeAzure, providerType)
+	}
+}
+
+func TestAzureProvider_GetCapabilities(t *testing.T) {
+	provider := NewAzureProvider()
+	capabilities := provider.GetCapabilities()
+
+	expectedCapabilities := ProviderCapabilities{
+		SupportsRefreshTokens:      true,
+		RequiresOfflineAccessScope: true,
+		PreferredTokenValidation:   "access",
+	}
+
+	if capabilities.SupportsRefreshTokens != expectedCapabilities.SupportsRefreshTokens {
+		t.Errorf("expected SupportsRefreshTokens %t, got %t", expectedCapabilities.SupportsRefreshTokens, capabilities.SupportsRefreshTokens)
+	}
+
+	if capabilities.RequiresOfflineAccessScope != expectedCapabilities.RequiresOfflineAccessScope {
+		t.Errorf("expected RequiresOfflineAccessScope %t, got %t", expectedCapabilities.RequiresOfflineAccessScope, capabilities.RequiresOfflineAccessScope)
+	}
+
+	if capabilities.PreferredTokenValidation != expectedCapabilities.PreferredTokenValidation {
+		t.Errorf("expected PreferredTokenValidation %q, got %q", expectedCapabilities.PreferredTokenValidation, capabilities.PreferredTokenValidation)
+	}
+}
+
+func TestAzureProvider_BuildAuthParams(t *testing.T) {
+	provider := NewAzureProvider()
+
+	tests := []struct {
+		name                string
+		baseParams          url.Values
+		scopes              []string
+		expectOfflineAccess bool
+		expectResponseMode  bool
+	}{
+		{
+			name:                "basic params with offline_access scope",
+			baseParams:          url.Values{"client_id": []string{"test-client"}},
+			scopes:              []string{"openid", "offline_access", "email"},
+			expectOfflineAccess: true,
+			expectResponseMode:  true,
+		},
+		{
+			name:                "basic params without offline_access scope",
+			baseParams:          url.Values{"client_id": []string{"test-client"}},
+			scopes:              []string{"openid", "email"},
+			expectOfflineAccess: true, // Should be added automatically
+			expectResponseMode:  true,
+		},
+		{
+			name:                "empty scopes",
+			baseParams:          url.Values{},
+			scopes:              []string{},
+			expectOfflineAccess: true, // Should be added automatically
+			expectResponseMode:  true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			authParams, err := provider.BuildAuthParams(tt.baseParams, tt.scopes)
+
+			if err != nil {
+				t.Errorf("unexpected error: %v", err)
+				return
+			}
+
+			if authParams == nil {
+				t.Fatal("expected non-nil auth params")
+			}
+
+			// Check response_mode is set
+			if tt.expectResponseMode {
+				responseMode := authParams.URLValues.Get("response_mode")
+				if responseMode != "query" {
+					t.Errorf("expected response_mode 'query', got %q", responseMode)
+				}
+			}
+
+			// Check offline_access scope
+			if tt.expectOfflineAccess {
+				hasOfflineAccess := false
+				for _, scope := range authParams.Scopes {
+					if scope == "offline_access" {
+						hasOfflineAccess = true
+						break
+					}
+				}
+				if !hasOfflineAccess {
+					t.Error("expected offline_access scope to be present")
+				}
+			}
+
+			// Verify other parameters are preserved
+			for key, values := range tt.baseParams {
+				if key == "response_mode" {
+					continue // This gets overridden
+				}
+				paramValues := authParams.URLValues[key]
+				if len(paramValues) != len(values) {
+					t.Errorf("expected %d values for param %s, got %d", len(values), key, len(paramValues))
+				}
+			}
+		})
+	}
+}
+
+func TestAzureProvider_ValidateTokens(t *testing.T) {
+	provider := NewAzureProvider()
+
+	tests := []struct {
+		name               string
+		session            *mockSession
+		verifier           *mockTokenVerifier
+		cache              *mockTokenCache
+		refreshGracePeriod time.Duration
+		expectedResult     *ValidationResult
+		expectError        bool
+	}{
+		{
+			name: "unauthenticated with refresh token",
+			session: &mockSession{
+				authenticated: false,
+				refreshToken:  "refresh-token",
+			},
+			verifier: &mockTokenVerifier{},
+			cache:    &mockTokenCache{},
+			expectedResult: &ValidationResult{
+				NeedsRefresh: true,
+			},
+		},
+		{
+			name: "unauthenticated without refresh token",
+			session: &mockSession{
+				authenticated: false,
+			},
+			verifier: &mockTokenVerifier{},
+			cache:    &mockTokenCache{},
+			expectedResult: &ValidationResult{
+				IsExpired: true,
+			},
+		},
+		{
+			name: "authenticated with valid JWT access token",
+			session: &mockSession{
+				authenticated: true,
+				accessToken:   "header.payload.signature",
+			},
+			verifier: &mockTokenVerifier{},
+			cache: &mockTokenCache{
+				data: map[string]map[string]interface{}{
+					"header.payload.signature": {
+						"exp": float64(time.Now().Add(time.Hour).Unix()),
+					},
+				},
+			},
+			expectedResult: &ValidationResult{
+				Authenticated: true,
+			},
+		},
+		{
+			name: "authenticated with invalid access token but valid ID token",
+			session: &mockSession{
+				authenticated: true,
+				accessToken:   "header.payload.signature",
+				idToken:       "id.token.here",
+			},
+			verifier: &mockTokenVerifier{shouldFail: true},
+			cache: &mockTokenCache{
+				data: map[string]map[string]interface{}{
+					"id.token.here": {
+						"exp": float64(time.Now().Add(time.Hour).Unix()),
+					},
+				},
+			},
+			expectedResult: &ValidationResult{
+				Authenticated: true,
+			},
+		},
+		{
+			name: "authenticated with opaque access token",
+			session: &mockSession{
+				authenticated: true,
+				accessToken:   "opaque-token-no-dots",
+			},
+			verifier: &mockTokenVerifier{},
+			cache:    &mockTokenCache{},
+			expectedResult: &ValidationResult{
+				Authenticated: true,
+			},
+		},
+		{
+			name: "authenticated with ID token only",
+			session: &mockSession{
+				authenticated: true,
+				idToken:       "id.token.here",
+			},
+			verifier: &mockTokenVerifier{},
+			cache: &mockTokenCache{
+				data: map[string]map[string]interface{}{
+					"id.token.here": {
+						"exp": float64(time.Now().Add(time.Hour).Unix()),
+					},
+				},
+			},
+			expectedResult: &ValidationResult{
+				Authenticated: true,
+			},
+		},
+		{
+			name: "expired ID token with refresh token",
+			session: &mockSession{
+				authenticated: true,
+				idToken:       "expired.token.here",
+				refreshToken:  "refresh-token",
+			},
+			verifier: &mockTokenVerifier{
+				expiredTokens: map[string]bool{
+					"expired.token.here": true,
+				},
+			},
+			cache: &mockTokenCache{},
+			expectedResult: &ValidationResult{
+				NeedsRefresh: true,
+			},
+		},
+		{
+			name: "authenticated but no tokens",
+			session: &mockSession{
+				authenticated: true,
+				refreshToken:  "refresh-token",
+			},
+			verifier: &mockTokenVerifier{},
+			cache:    &mockTokenCache{},
+			expectedResult: &ValidationResult{
+				NeedsRefresh: true,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := provider.ValidateTokens(tt.session, tt.verifier, tt.cache, tt.refreshGracePeriod)
+
+			if tt.expectError {
+				if err == nil {
+					t.Error("expected error but got none")
+				}
+				return
+			}
+
+			if err != nil {
+				t.Errorf("unexpected error: %v", err)
+				return
+			}
+
+			if result == nil {
+				t.Fatal("expected non-nil result")
+			}
+
+			if result.Authenticated != tt.expectedResult.Authenticated {
+				t.Errorf("expected Authenticated %t, got %t", tt.expectedResult.Authenticated, result.Authenticated)
+			}
+
+			if result.NeedsRefresh != tt.expectedResult.NeedsRefresh {
+				t.Errorf("expected NeedsRefresh %t, got %t", tt.expectedResult.NeedsRefresh, result.NeedsRefresh)
+			}
+
+			if result.IsExpired != tt.expectedResult.IsExpired {
+				t.Errorf("expected IsExpired %t, got %t", tt.expectedResult.IsExpired, result.IsExpired)
+			}
+		})
+	}
+}
+
+func TestAzureProvider_ValidateConfig(t *testing.T) {
+	provider := NewAzureProvider()
+
+	// Azure provider uses BaseProvider's ValidateConfig which always returns nil
+	err := provider.ValidateConfig()
+	if err != nil {
+		t.Errorf("unexpected error from ValidateConfig: %v", err)
+	}
+}
+
+func TestAzureProvider_HandleTokenRefresh(t *testing.T) {
+	provider := NewAzureProvider()
+
+	// Test that HandleTokenRefresh doesn't fail
+	tokenData := &TokenResult{
+		IDToken:      "id-token",
+		AccessToken:  "access-token",
+		RefreshToken: "refresh-token",
+	}
+
+	err := provider.HandleTokenRefresh(tokenData)
+	if err != nil {
+		t.Errorf("unexpected error from HandleTokenRefresh: %v", err)
+	}
+}
+
+func TestAzureProvider_ConcurrentAccess(t *testing.T) {
+	provider := NewAzureProvider()
+
+	// Track initial goroutine count for memory safety
+	initialGoroutines := runtime.NumGoroutine()
+
+	const numGoroutines = 50
+	const numOperationsPerGoroutine = 10
+
+	var wg sync.WaitGroup
+	wg.Add(numGoroutines)
+
+	// Test concurrent access to provider methods
+	for i := 0; i < numGoroutines; i++ {
+		go func(workerID int) {
+			defer wg.Done()
+
+			session := &mockSession{
+				authenticated: true,
+				accessToken:   fmt.Sprintf("access-token-%d", workerID),
+				idToken:       fmt.Sprintf("id-token-%d", workerID),
+				refreshToken:  fmt.Sprintf("refresh-token-%d", workerID),
+			}
+
+			verifier := &mockTokenVerifier{}
+			cache := &mockTokenCache{
+				data: map[string]map[string]interface{}{
+					fmt.Sprintf("access-token-%d", workerID): {
+						"exp": float64(time.Now().Add(time.Hour).Unix()),
+					},
+					fmt.Sprintf("id-token-%d", workerID): {
+						"exp": float64(time.Now().Add(time.Hour).Unix()),
+					},
+				},
+			}
+
+			for j := 0; j < numOperationsPerGoroutine; j++ {
+				// Test GetType
+				if provider.GetType() != ProviderTypeAzure {
+					t.Errorf("worker %d: expected Azure provider type", workerID)
+					return
+				}
+
+				// Test GetCapabilities
+				capabilities := provider.GetCapabilities()
+				if !capabilities.SupportsRefreshTokens {
+					t.Errorf("worker %d: expected refresh token support", workerID)
+					return
+				}
+
+				// Test ValidateTokens
+				result, err := provider.ValidateTokens(session, verifier, cache, time.Minute)
+				if err != nil {
+					t.Errorf("worker %d: unexpected error in ValidateTokens: %v", workerID, err)
+					return
+				}
+				if !result.Authenticated {
+					t.Errorf("worker %d: expected authenticated result", workerID)
+					return
+				}
+
+				// Test BuildAuthParams
+				baseParams := url.Values{"client_id": []string{fmt.Sprintf("client-%d", workerID)}}
+				scopes := []string{"openid", "email"}
+				authParams, err := provider.BuildAuthParams(baseParams, scopes)
+				if err != nil {
+					t.Errorf("worker %d: unexpected error in BuildAuthParams: %v", workerID, err)
+					return
+				}
+				if authParams == nil {
+					t.Errorf("worker %d: expected non-nil auth params", workerID)
+					return
+				}
+
+				// Test ValidateConfig
+				err = provider.ValidateConfig()
+				if err != nil {
+					t.Errorf("worker %d: unexpected error in ValidateConfig: %v", workerID, err)
+					return
+				}
+			}
+		}(i)
+	}
+
+	wg.Wait()
+
+	// Check for potential goroutine leaks - allow some tolerance for test framework overhead
+	finalGoroutines := runtime.NumGoroutine()
+	if finalGoroutines > initialGoroutines+5 {
+		t.Errorf("potential goroutine leak: started with %d goroutines, ended with %d", initialGoroutines, finalGoroutines)
+	}
+}
+
+func TestAzureProvider_MemorySafety(t *testing.T) {
+	const numIterations = 1000
+
+	initialGoroutines := runtime.NumGoroutine()
+
+	for i := 0; i < numIterations; i++ {
+		provider := NewAzureProvider()
+
+		session := &mockSession{
+			authenticated: true,
+			accessToken:   fmt.Sprintf("access-token-%d.payload.signature", i),
+			idToken:       fmt.Sprintf("id-token-%d.payload.signature", i),
+			refreshToken:  fmt.Sprintf("refresh-token-%d", i),
+		}
+
+		verifier := &mockTokenVerifier{}
+		cache := &mockTokenCache{
+			data: map[string]map[string]interface{}{
+				fmt.Sprintf("access-token-%d.payload.signature", i): {
+					"exp": float64(time.Now().Add(time.Hour).Unix()),
+				},
+			},
+		}
+
+		// Exercise all provider methods
+		_ = provider.GetType()
+		_ = provider.GetCapabilities()
+		_, _ = provider.ValidateTokens(session, verifier, cache, time.Minute)
+		_, _ = provider.BuildAuthParams(url.Values{}, []string{"openid"})
+		_ = provider.ValidateConfig()
+		_ = provider.HandleTokenRefresh(&TokenResult{})
+	}
+
+	// Force garbage collection
+	runtime.GC()
+	runtime.GC()
+
+	finalGoroutines := runtime.NumGoroutine()
+	if finalGoroutines > initialGoroutines+5 {
+		t.Errorf("potential goroutine leak: started with %d goroutines, ended with %d", initialGoroutines, finalGoroutines)
+	}
+}
+
+func TestAzureProvider_EdgeCases(t *testing.T) {
+	provider := NewAzureProvider()
+
+	t.Run("nil session", func(t *testing.T) {
+		defer func() {
+			if r := recover(); r != nil {
+				// Expected behavior for nil session
+				t.Logf("Recovered from expected panic: %v", r)
+			}
+		}()
+
+		verifier := &mockTokenVerifier{}
+		cache := &mockTokenCache{}
+		_, err := provider.ValidateTokens(nil, verifier, cache, time.Minute)
+		if err == nil {
+			t.Error("expected error with nil session")
+		}
+	})
+
+	t.Run("nil verifier", func(t *testing.T) {
+		defer func() {
+			if r := recover(); r != nil {
+				t.Logf("Recovered from expected panic: %v", r)
+			}
+		}()
+
+		session := &mockSession{authenticated: true, idToken: "test.token.here"}
+		cache := &mockTokenCache{}
+		_, err := provider.ValidateTokens(session, nil, cache, time.Minute)
+		if err == nil {
+			t.Error("expected error with nil verifier")
+		}
+	})
+
+	t.Run("nil cache", func(t *testing.T) {
+		defer func() {
+			if r := recover(); r != nil {
+				t.Logf("Recovered from expected panic with nil cache: %v", r)
+			}
+		}()
+		session := &mockSession{authenticated: true, accessToken: "test.token.here"}
+		verifier := &mockTokenVerifier{}
+		_, err := provider.ValidateTokens(session, verifier, nil, time.Minute)
+		if err == nil {
+			t.Error("expected error with nil cache")
+		}
+	})
+
+	t.Run("empty tokens", func(t *testing.T) {
+		session := &mockSession{
+			authenticated: true,
+			accessToken:   "",
+			idToken:       "",
+			refreshToken:  "",
+		}
+		verifier := &mockTokenVerifier{}
+		cache := &mockTokenCache{}
+		result, err := provider.ValidateTokens(session, verifier, cache, time.Minute)
+		if err != nil {
+			t.Errorf("unexpected error with empty tokens: %v", err)
+		}
+		if !result.IsExpired {
+			t.Error("expected IsExpired=true for empty tokens without refresh token")
+		}
+	})
+
+	t.Run("malformed JWT tokens", func(t *testing.T) {
+		malformedTokens := []string{
+			"not.enough.parts",
+			"too.many.parts.in.this.token",
+			"",
+			"single-part-token",
+		}
+
+		for _, token := range malformedTokens {
+			session := &mockSession{
+				authenticated: true,
+				accessToken:   token,
+				refreshToken:  "refresh-token",
+			}
+			verifier := &mockTokenVerifier{}
+			cache := &mockTokenCache{}
+			result, err := provider.ValidateTokens(session, verifier, cache, time.Minute)
+			if err != nil {
+				t.Errorf("unexpected error with malformed token %q: %v", token, err)
+			}
+			if result == nil {
+				t.Errorf("expected non-nil result for malformed token %q", token)
+			}
+		}
+	})
+
+	t.Run("very long tokens", func(t *testing.T) {
+		longToken := strings.Repeat("a", 10000) + "." + strings.Repeat("b", 10000) + "." + strings.Repeat("c", 10000)
+		session := &mockSession{
+			authenticated: true,
+			accessToken:   longToken,
+			refreshToken:  "refresh-token",
+		}
+		verifier := &mockTokenVerifier{}
+		cache := &mockTokenCache{
+			data: map[string]map[string]interface{}{
+				longToken: {
+					"exp": float64(time.Now().Add(time.Hour).Unix()),
+				},
+			},
+		}
+		result, err := provider.ValidateTokens(session, verifier, cache, time.Minute)
+		if err != nil {
+			t.Errorf("unexpected error with very long token: %v", err)
+		}
+		if result == nil {
+			t.Error("expected non-nil result with very long token")
+		}
+	})
+}
+
+// Benchmark tests for performance validation
+func BenchmarkAzureProvider_GetType(b *testing.B) {
+	provider := NewAzureProvider()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		provider.GetType()
+	}
+}
+
+func BenchmarkAzureProvider_GetCapabilities(b *testing.B) {
+	provider := NewAzureProvider()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		provider.GetCapabilities()
+	}
+}
+
+func BenchmarkAzureProvider_BuildAuthParams(b *testing.B) {
+	provider := NewAzureProvider()
+	baseParams := url.Values{"client_id": []string{"test-client"}}
+	scopes := []string{"openid", "email", "profile"}
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_, err := provider.BuildAuthParams(baseParams, scopes)
+		if err != nil {
+			b.Fatalf("unexpected error: %v", err)
+		}
+	}
+}
+
+func BenchmarkAzureProvider_ValidateTokens(b *testing.B) {
+	provider := NewAzureProvider()
+	session := &mockSession{
+		authenticated: true,
+		accessToken:   "header.payload.signature",
+		idToken:       "id.token.here",
+		refreshToken:  "refresh-token",
+	}
+	verifier := &mockTokenVerifier{}
+	cache := &mockTokenCache{
+		data: map[string]map[string]interface{}{
+			"header.payload.signature": {
+				"exp": float64(time.Now().Add(time.Hour).Unix()),
+			},
+		},
+	}
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_, err := provider.ValidateTokens(session, verifier, cache, time.Minute)
+		if err != nil {
+			b.Fatalf("unexpected error: %v", err)
+		}
+	}
+}