mirror of
https://github.com/lukaszraczylo/traefikoidc.git
synced 2026-10-12 04:04:26 +00:00
81 lines
2.7 KiB
Go
81 lines
2.7 KiB
Go
package traefikoidc
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"fmt"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
)
|
|
|
|
// TestRefresh_SaveFailureClearsRotatedTokens regresses the refresh path
|
|
// leaving a half-rotated session when the post-refresh Save fails: the
|
|
// IdP had already consumed the old refresh token (rotation), but the old
|
|
// code only flipped authenticated to false and kept the new rotated
|
|
// tokens in memory — so the in-memory session carried a fresh refresh
|
|
// token while flagged unauthenticated. The Save-failure branch must clear
|
|
// the rotated tokens (mirroring the SetAuthenticated-error branch).
|
|
func TestRefresh_SaveFailureClearsRotatedTokens(t *testing.T) {
|
|
sessionManager, err := NewSessionManager(
|
|
"test-encryption-key-32-bytes-long!!", false, "", "", 0, NewLogger("error"))
|
|
if err != nil {
|
|
t.Fatalf("session manager: %v", err)
|
|
}
|
|
defer sessionManager.Shutdown()
|
|
|
|
claims := map[string]any{"email": "[email protected]", "exp": float64(9999999999)}
|
|
tOidc := &TraefikOidc{
|
|
logger: NewLogger("error"),
|
|
userIdentifierClaim: "email",
|
|
sessionManager: sessionManager,
|
|
tokenExchanger: &EnhancedMockTokenExchanger{
|
|
RefreshResponse: &TokenResponse{
|
|
AccessToken: "new-access-token",
|
|
RefreshToken: "new-refresh-token",
|
|
IDToken: "new-id-token",
|
|
ExpiresIn: 3600,
|
|
},
|
|
},
|
|
tokenVerifier: &EnhancedMockTokenVerifier{Err: nil},
|
|
extractClaimsFunc: func(token string) (map[string]any, error) { return claims, nil },
|
|
}
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/protected", nil)
|
|
rw := httptest.NewRecorder()
|
|
|
|
session, err := sessionManager.GetSession(req)
|
|
if err != nil {
|
|
t.Fatalf("get session: %v", err)
|
|
}
|
|
defer session.returnToPoolSafely()
|
|
|
|
session.SetRefreshToken("initial-refresh-token")
|
|
|
|
// Bloat the session with incompressible data so the combined-cookie
|
|
// Save overflows maxCombinedChunks (10) and fails deterministically.
|
|
bloat := make([]byte, 4000)
|
|
_, _ = rand.Read(bloat)
|
|
for i := 0; i < 25; i++ {
|
|
session.mainSession.Values[fmt.Sprintf("bulk%d", i)] = string(bloat)
|
|
}
|
|
|
|
refreshed := tOidc.refreshToken(rw, req, session)
|
|
if refreshed {
|
|
t.Fatal("expected refresh to fail when the session Save fails")
|
|
}
|
|
|
|
if session.GetAuthenticated() {
|
|
t.Error("session must not be authenticated after a failed refresh Save")
|
|
}
|
|
// Rotated tokens must not linger in memory (half-rotated state).
|
|
if got := session.GetRefreshToken(); got != "" {
|
|
t.Errorf("refresh token not cleared after failed Save, got %q", got)
|
|
}
|
|
if got := session.GetAccessToken(); got != "" {
|
|
t.Errorf("access token not cleared after failed Save, got %q", got)
|
|
}
|
|
if got := session.GetIDToken(); got != "" {
|
|
t.Errorf("id token not cleared after failed Save, got %q", got)
|
|
}
|
|
}
|