deno.land / x / oauth4webapi@v1.2.2 / test / device_flow.test.ts
device_flow.test.ts
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701import anyTest, { type TestFn } from 'ava'import setup, { type Context, teardown, issuer, endpoint, client, getResponse, UA,} from './_setup.js'import * as jose from 'jose'import * as lib from '../src/index.js'
const test = anyTest as TestFn<Context & { es256: CryptoKeyPair; rs256: CryptoKeyPair }>
test.before(setup)test.after(teardown)
test.before(async (t) => { t.context.es256 = await lib.generateKeyPair('ES256') t.context.rs256 = await lib.generateKeyPair('RS256')
t.context .intercept({ path: '/jwks', method: 'GET', }) .reply(200, { keys: [ await jose.exportJWK(t.context.es256.publicKey), await jose.exportJWK(t.context.rs256.publicKey), ], })})
const tClient: lib.Client = { ...client, token_endpoint_auth_method: 'none' }
test('deviceAuthorizationRequest()', async (t) => { await t.throwsAsync(lib.deviceAuthorizationRequest(issuer, tClient, new URLSearchParams()), { message: '"as.device_authorization_endpoint" must be a string', })
await t.throwsAsync(lib.deviceAuthorizationRequest(issuer, tClient, <any>null), { message: '"parameters" must be an instance of URLSearchParams', })
const tIssuer: lib.AuthorizationServer = { ...issuer, device_authorization_endpoint: endpoint('device-1'), }
t.context .intercept({ path: '/device-1', method: 'POST', headers: { accept: 'application/json', 'user-agent': UA, }, body(body) { return new URLSearchParams(body).get('client_id') === client.client_id }, }) .reply(200, '')
await t.notThrowsAsync(lib.deviceAuthorizationRequest(tIssuer, tClient, new URLSearchParams()))})
test('deviceAuthorizationRequest() w/ Custom Headers', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, device_authorization_endpoint: endpoint('device-headers'), }
t.context .intercept({ path: '/device-headers', method: 'POST', headers: { accept: 'application/json', 'user-agent': 'foo', foo: 'bar', }, }) .reply(200, '')
await t.notThrowsAsync( lib.deviceAuthorizationRequest(tIssuer, tClient, new URLSearchParams(), { headers: new Headers([ ['accept', 'will be overwritten'], ['user-agent', 'foo'], ['foo', 'bar'], ]), }), )})
test('processDeviceAuthorizationResponse()', async (t) => { await t.throwsAsync(lib.processDeviceAuthorizationResponse(issuer, client, <any>null), { message: '"response" must be an instance of Response', }) await t.throwsAsync( lib.processDeviceAuthorizationResponse(issuer, client, getResponse('', { status: 404 })), { message: '"response" is not a conform Device Authorization Endpoint response', }, ) await t.throwsAsync( lib.processDeviceAuthorizationResponse(issuer, client, getResponse('{"', { status: 200 })), { message: 'failed to parse "response" body as JSON', }, ) await t.throwsAsync( lib.processDeviceAuthorizationResponse(issuer, client, getResponse('null', { status: 200 })), { message: '"response" body must be a top level object', }, ) await t.throwsAsync( lib.processDeviceAuthorizationResponse(issuer, client, getResponse('[]', { status: 200 })), { message: '"response" body must be a top level object', }, )
const validResponse = { device_code: 'device_code', user_code: 'user_code', verification_uri: 'verification_uri', expires_in: 300, verification_uri_complete: 'verification_uri_complete', interval: 5, }
t.deepEqual( await lib.processDeviceAuthorizationResponse( issuer, client, getResponse(JSON.stringify(validResponse), { status: 200 }), ), validResponse, )
await t.notThrowsAsync( lib.processDeviceAuthorizationResponse( issuer, client, getResponse(JSON.stringify({ ...validResponse, verification_uri_complete: undefined }), { status: 200, }), ), )
await t.notThrowsAsync( lib.processDeviceAuthorizationResponse( issuer, client, getResponse(JSON.stringify({ ...validResponse, interval: undefined }), { status: 200 }), ), )
await t.throwsAsync( lib.processDeviceAuthorizationResponse( issuer, client, getResponse(JSON.stringify({ ...validResponse, device_code: undefined }), { status: 200 }), ), { message: '"response" body "device_code" property must be a non-empty string', }, )
await t.throwsAsync( lib.processDeviceAuthorizationResponse( issuer, client, getResponse(JSON.stringify({ ...validResponse, user_code: undefined }), { status: 200 }), ), { message: '"response" body "user_code" property must be a non-empty string', }, )
await t.throwsAsync( lib.processDeviceAuthorizationResponse( issuer, client, getResponse(JSON.stringify({ ...validResponse, verification_uri: undefined }), { status: 200, }), ), { message: '"response" body "verification_uri" property must be a non-empty string', }, )
await t.throwsAsync( lib.processDeviceAuthorizationResponse( issuer, client, getResponse(JSON.stringify({ ...validResponse, expires_in: undefined }), { status: 200 }), ), { message: '"response" body "expires_in" property must be a positive number', }, )
await t.throwsAsync( lib.processDeviceAuthorizationResponse( issuer, client, getResponse(JSON.stringify({ ...validResponse, verification_uri_complete: null }), { status: 200, }), ), { message: '"response" body "verification_uri_complete" property must be a non-empty string', }, )
await t.throwsAsync( lib.processDeviceAuthorizationResponse( issuer, client, getResponse(JSON.stringify({ ...validResponse, interval: null }), { status: 200 }), ), { message: '"response" body "interval" property must be a positive number', }, )})
test('deviceCodeGrantRequest()', async (t) => { await t.throwsAsync(lib.deviceCodeGrantRequest(issuer, tClient, 'device_code'), { message: '"as.token_endpoint" must be a string', })
await t.throwsAsync(lib.deviceCodeGrantRequest(issuer, tClient, <any>null), { message: '"deviceCode" must be a non-empty string', })
const tIssuer: lib.AuthorizationServer = { ...issuer, token_endpoint: endpoint('token-1'), }
t.context .intercept({ path: '/token-1', method: 'POST', headers: { accept: 'application/json', }, body(body) { const params = new URLSearchParams(body) return ( params.get('grant_type') === 'urn:ietf:params:oauth:grant-type:device_code' && params.get('device_code') === 'device_code' ) }, }) .reply(200, { access_token: 'token', token_type: 'Bearer' })
await t.notThrowsAsync(lib.deviceCodeGrantRequest(tIssuer, tClient, 'device_code'))})
test('deviceCodeGrantRequest() w/ Extra Parameters', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, token_endpoint: endpoint('token-2'), }
t.context .intercept({ path: '/token-2', method: 'POST', body(body) { const params = new URLSearchParams(body) return params.get('resource') === 'urn:example:resource' }, }) .reply(200, { access_token: 'token', token_type: 'Bearer' })
await t.notThrowsAsync( lib.deviceCodeGrantRequest(tIssuer, tClient, 'device_code', { additionalParameters: new URLSearchParams('resource=urn:example:resource'), }), )})
test('deviceCodeGrantRequest() w/ Custom Headers', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, token_endpoint: endpoint('token-headers'), }
t.context .intercept({ path: '/token-headers', method: 'POST', headers: { accept: 'application/json', 'user-agent': 'foo', foo: 'bar', }, }) .reply(200, { access_token: 'token', token_type: 'Bearer' })
await t.notThrowsAsync( lib.deviceCodeGrantRequest(tIssuer, tClient, 'device_code', { headers: new Headers([ ['accept', 'will be overwritten'], ['user-agent', 'foo'], ['foo', 'bar'], ]), }), )})
test('deviceCodeGrantRequest() w/ DPoP', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, token_endpoint: endpoint('token-3'), }
t.context .intercept({ path: '/token-3', method: 'POST', headers: { dpop: /.+/, }, }) .reply(200, { access_token: 'token', token_type: 'DPoP' })
const DPoP = await lib.generateKeyPair('ES256') await t.notThrowsAsync(lib.deviceCodeGrantRequest(tIssuer, tClient, 'device_code', { DPoP }))})
test('processDeviceCodeResponse() without ID Tokens', async (t) => { await t.throwsAsync(lib.processDeviceCodeResponse(issuer, client, <any>null), { message: '"response" must be an instance of Response', }) await t.throwsAsync( lib.processDeviceCodeResponse(issuer, client, getResponse('', { status: 404 })), { message: '"response" is not a conform Token Endpoint response', }, ) await t.throwsAsync(lib.processDeviceCodeResponse(issuer, client, getResponse('{"')), { message: 'failed to parse "response" body as JSON', }) await t.throwsAsync(lib.processDeviceCodeResponse(issuer, client, getResponse('null')), { message: '"response" body must be a top level object', }) await t.throwsAsync(lib.processDeviceCodeResponse(issuer, client, getResponse('[]')), { message: '"response" body must be a top level object', }) await t.throwsAsync( lib.processDeviceCodeResponse( issuer, client, getResponse(JSON.stringify({ token_type: 'Bearer' })), ), { message: '"response" body "access_token" property must be a non-empty string', }, ) await t.throwsAsync( lib.processDeviceCodeResponse( issuer, client, getResponse(JSON.stringify({ access_token: 'token' })), ), { message: '"response" body "token_type" property must be a non-empty string', }, ) await t.throwsAsync( lib.processDeviceCodeResponse( issuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', expires_in: new Date().toUTCString(), }), ), ), { message: '"response" body "expires_in" property must be a positive number', }, ) await t.throwsAsync( lib.processDeviceCodeResponse( issuer, client, getResponse(JSON.stringify({ access_token: 'token', token_type: 'Bearer', scope: null })), ), { message: '"response" body "scope" property must be a string', }, ) await t.throwsAsync( lib.processDeviceCodeResponse( issuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', refresh_token: null }), ), ), { message: '"response" body "refresh_token" property must be a non-empty string', }, ) await t.throwsAsync( lib.processDeviceCodeResponse( issuer, client, getResponse(JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: null })), ), { message: '"response" body "id_token" property must be a non-empty string', }, )
t.deepEqual( await lib.processDeviceCodeResponse( issuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', expires_in: 60, scope: 'api:read', refresh_token: 'refresh_token', }), ), ), { access_token: 'token', token_type: 'bearer', expires_in: 60, scope: 'api:read', refresh_token: 'refresh_token', }, )
t.true( lib.isOAuth2Error( await lib.processDeviceCodeResponse( issuer, client, getResponse(JSON.stringify({ error: 'invalid_grant' }), { status: 400 }), ), ), )
t.false( lib.isOAuth2Error( await lib.processDeviceCodeResponse( issuer, client, getResponse(JSON.stringify({ access_token: 'token', token_type: 'Bearer' })), ), ), )})
test('processDeviceCodeResponse() with an ID Token (alg signalled)', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, jwks_uri: endpoint('jwks') } await t.throwsAsync( lib.processDeviceCodeResponse( issuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: 'id_token' }), ), ), { message: '"as.jwks_uri" must be a string', }, )
await t.notThrowsAsync( lib .processDeviceCodeResponse( { ...tIssuer, id_token_signing_alg_values_supported: ['ES256'] }, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({}) .setProtectedHeader({ alg: 'ES256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.es256.privateKey), }), ), ) .then(async (result) => { if (lib.isOAuth2Error(result)) { t.fail() } else { t.assert(lib.getValidatedIdTokenClaims(result)) t.throws(() => lib.getValidatedIdTokenClaims({ ...result }), { name: 'TypeError', message: '"ref" was already garbage collected or did not resolve from the proper sources', }) } }), )})
test('processDeviceCodeResponse() with an ID Token (alg specified)', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, jwks_uri: endpoint('jwks') }
await t.notThrowsAsync( lib.processDeviceCodeResponse( tIssuer, { ...client, id_token_signed_response_alg: 'ES256' }, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({}) .setProtectedHeader({ alg: 'ES256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.es256.privateKey), }), ), ), )})
test('processDeviceCodeResponse() with an ID Token (alg default)', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, jwks_uri: endpoint('jwks') }
await t.notThrowsAsync( lib.processDeviceCodeResponse( tIssuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({}) .setProtectedHeader({ alg: 'RS256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.rs256.privateKey), }), ), ), )})
test('processDeviceCodeResponse() with an ID Token (alg mismatches)', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, jwks_uri: endpoint('jwks') }
await t.throwsAsync( lib.processDeviceCodeResponse( tIssuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({}) .setProtectedHeader({ alg: 'ES256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.es256.privateKey), }), ), ), { message: 'unexpected JWT "alg" header parameter' }, )
await t.throwsAsync( lib.processDeviceCodeResponse( { ...tIssuer, id_token_signing_alg_values_supported: ['RS256'], }, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({}) .setProtectedHeader({ alg: 'ES256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.es256.privateKey), }), ), ), { message: 'unexpected JWT "alg" header parameter' }, )
await t.throwsAsync( lib.processDeviceCodeResponse( tIssuer, { ...client, id_token_signed_response_alg: 'RS256', }, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({}) .setProtectedHeader({ alg: 'ES256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.es256.privateKey), }), ), ), { message: 'unexpected JWT "alg" header parameter' }, )})
test('processDeviceCodeResponse() with an ID Token w/ at_hash', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, jwks_uri: endpoint('jwks') }
await t.notThrowsAsync( lib.processDeviceCodeResponse( tIssuer, client, getResponse( JSON.stringify({ access_token: 'YmJiZTAwYmYtMzgyOC00NzhkLTkyOTItNjJjNDM3MGYzOWIy9sFhvH8K_x8UIHj1osisS57f5DduL-ar_qw5jl3lthwpMjm283aVMQXDmoqqqydDSqJfbhptzw8rUVwkuQbolw', token_type: 'Bearer', id_token: await new jose.SignJWT({ at_hash: 'x7vk7f6BvQj0jQHYFIk4ag', }) .setProtectedHeader({ alg: 'RS256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.rs256.privateKey), }), ), ), )
await t.throwsAsync( lib.processDeviceCodeResponse( tIssuer, client, getResponse( JSON.stringify({ access_token: 'YmJiZTAwYmYtMzgyOC00NzhkLTkyOTItNjJjNDM3MGYzOWIy9sFhvH8K_x8UIHj1osisS57f5DduL-ar_qw5jl3lthwpMjm283aVMQXDmoqqqydDSqJfbhptzw8rUVwkuQbolw', token_type: 'Bearer', id_token: await new jose.SignJWT({ at_hash: 'x7vk7f6BvQj0jQHYFIk4ag-invalid', }) .setProtectedHeader({ alg: 'RS256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.rs256.privateKey), }), ), ), { message: 'unexpected ID Token "at_hash" (access token hash) claim value' }, )})
oauth4webapi
Version Info
2 years ago
