oidctest

Documentation

Overview

Package oidctest provides a minimal, configurable OIDC issuer for tests (discovery, jwks, device authorization, and token endpoints backed by a real RSA-signed JWT), shared across internal/oidc and internal/authflow.

Index

• Constants
• type MockIssuer
  • func NewMockIssuer(t *testing.T) *MockIssuer
  • func (m *MockIssuer) AssertionJTIs() []string
  • func (m *MockIssuer) Issuer() string
  • func (m *MockIssuer) LastTokenExchangeRequest() url.Values
  • func (m *MockIssuer) RefreshCallCount() int

Constants

const ClientID = "test-client"

ClientID is the audience baked into mock-issued id_tokens; tests that verify an id_token must Discover using this as their client ID.

const MockAuthCode = "mock-auth-code"

MockAuthCode is the fixed authorization code the mock's browser simulation hands back to a loopback callback in authcode+PKCE tests.

Types

type MockIssuer

type MockIssuer struct {

	// Configurable behavior. Set these fields before the first request
	// (the mock has no synchronization around reading them).
	IssuerOverride                string // non-empty simulates a mismatched "issuer" claim
	NoDeviceEndpoint              bool
	GrantTypesSupported           []string // nil = field omitted from discovery doc
	CodeChallengeMethodsSupported []string // nil = field omitted
	PendingPolls                  int      // authorization_pending responses before success
	DeviceIntervalSeconds         int64
	DeviceExpiresInSeconds        int64
	Audience                      string
	IncludeIDToken                bool
	RefreshErr                    string        // non-empty: refresh_token grant always fails with this error
	RefreshDelay                  time.Duration // artificial latency, to widen a rotation-race window in tests
	OmitRefreshToken              bool
	AuthCodeErr                   string // non-empty: authorization_code grant always fails with this error
	OmitDeviceExpiresIn           bool   // non-compliant with RFC 8628 §3.2, but some issuers do this
	// TokenExchangeErr, if non-empty, makes the RFC 8693 token-exchange
	// grant always fail with this error code.
	TokenExchangeErr string
	// IssuedTokenType is echoed back as the token-exchange response's
	// issued_token_type; defaults to the access_token URN when empty.
	IssuedTokenType string
	// NonceForAuthCode is embedded as the id_token's nonce claim on the
	// authorization_code grant response; this mock has no server-side
	// session state binding it to the authorization request automatically,
	// so tests set it directly.
	NonceForAuthCode string

	// RequireClientAuth, if non-empty ("client_secret_basic",
	// "client_secret_post", or "private_key_jwt"), makes handleToken
	// reject any token-endpoint request that doesn't authenticate with
	// that exact method. Empty (the default) is this mock's original,
	// permissive behavior: no client authentication is checked.
	RequireClientAuth    string
	ExpectedClientSecret string
	// ExpectedAssertionKey verifies a private_key_jwt client_assertion's
	// signature; required when RequireClientAuth == "private_key_jwt".
	ExpectedAssertionKey crypto.PublicKey
	// contains filtered or unexported fields
}

MockIssuer is a minimal, configurable OIDC issuer.

func NewMockIssuer

func NewMockIssuer(t *testing.T) *MockIssuer

NewMockIssuer starts an httptest server and registers t.Cleanup to close it. Configure the returned MockIssuer's exported fields, then call Issuer() to get its URL before starting a flow.

func (*MockIssuer) AssertionJTIs

func (m *MockIssuer) AssertionJTIs() []string

AssertionJTIs returns the jti claim of every private_key_jwt client assertion handleToken has successfully verified so far, in call order -- used to assert freshness (no two calls reuse a jti).

func (*MockIssuer) Issuer

func (m *MockIssuer) Issuer() string

Issuer returns the mock server's base URL, usable as the OIDC issuer.

func (*MockIssuer) LastTokenExchangeRequest

func (m *MockIssuer) LastTokenExchangeRequest() url.Values

LastTokenExchangeRequest returns the form values of the most recent token-exchange request handleTokenExchange has seen, or nil if none yet.

func (*MockIssuer) RefreshCallCount

func (m *MockIssuer) RefreshCallCount() int

RefreshCallCount returns how many times the refresh_token grant handler has been invoked so far.