diff options
Diffstat (limited to 'app/controllers/sessions/controller_test.go')
| -rw-r--r-- | app/controllers/sessions/controller_test.go | 29 |
1 files changed, 24 insertions, 5 deletions
diff --git a/app/controllers/sessions/controller_test.go b/app/controllers/sessions/controller_test.go index 05f642b..c0c1de2 100644 --- a/app/controllers/sessions/controller_test.go +++ b/app/controllers/sessions/controller_test.go @@ -15,6 +15,7 @@ import ( xcfg "gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/app/cfg" "gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/app/domain" "gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/oidc" + "gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/pls" "gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/test" "gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/web/cookie" ) @@ -85,25 +86,43 @@ func TestSessions(t *testing.T) { assert.Equal(t, "/dashboard", w.Header().Get("Location")) }) }) - - t.Run("with an expired authenicated session", func(t *testing.T) {}) }) t.Run("GET /session/callback", func(t *testing.T) { - t.Run("with an invalid csrf token", func(t *testing.T) {}) + t.Run("with an invalid csrf token", func(t *testing.T) { + user := mockoidc.DefaultUser() + code := srv.CreateAuthorizationCodeFor(user) + nonce := pls.GenerateRandomHex(32) + + r, w := test.RequestResponse( + "GET", + "/session/callback?code="+code+"&state=invalid", + test.WithCookie(cookie.New("oauth_state", nonce, time.Now().Add(10*time.Minute))), + ) + + mux.ServeHTTP(w, r) + + require.Equal(t, http.StatusBadRequest, w.Code) + }) + t.Run("with an invalid authorization code grant", func(t *testing.T) { r, w := test.RequestResponse("GET", "/session/callback?code=invalid") mux.ServeHTTP(w, r) - assert.Equal(t, http.StatusInternalServerError, w.Code) + assert.Equal(t, http.StatusBadRequest, w.Code) }) t.Run("with a valid authorization code grant", func(t *testing.T) { user := mockoidc.DefaultUser() code := srv.CreateAuthorizationCodeFor(user) + nonce := pls.GenerateRandomHex(32) - r, w := test.RequestResponse("GET", "/session/callback?code="+code) + r, w := test.RequestResponse( + "GET", + "/session/callback?code="+code+"&state="+nonce, + test.WithCookie(cookie.New("oauth_state", nonce, time.Now().Add(10*time.Minute))), + ) mux.ServeHTTP(w, r) |