git.iko.soy/typeable/oauth2-proxy
on v2.1 help sign in
typeable/oauth2-proxy/providers/google_test.go
181 lines 5.3 kB history raw
1package providers
3import (
4 "encoding/base64"
5 "encoding/json"
6 "net/http"
7 "net/http/httptest"
8 "net/url"
9 "testing"
11 "github.com/bmizerany/assert"
14func newRedeemServer(body []byte) (*url.URL, *httptest.Server) {
15 s := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
16 rw.Write(body)
17 }))
18 u, _ := url.Parse(s.URL)
19 return u, s
22func newGoogleProvider() *GoogleProvider {
23 return NewGoogleProvider(
24 &ProviderData{
25 ProviderName: "",
26 LoginURL: &url.URL{},
27 RedeemURL: &url.URL{},
28 ProfileURL: &url.URL{},
29 ValidateURL: &url.URL{},
30 Scope: ""})
33func TestGoogleProviderDefaults(t *testing.T) {
34 p := newGoogleProvider()
35 assert.NotEqual(t, nil, p)
36 assert.Equal(t, "Google", p.Data().ProviderName)
37 assert.Equal(t, "https://accounts.google.com/o/oauth2/auth?access_type=offline",
38 p.Data().LoginURL.String())
39 assert.Equal(t, "https://www.googleapis.com/oauth2/v3/token",
40 p.Data().RedeemURL.String())
41 assert.Equal(t, "https://www.googleapis.com/oauth2/v1/tokeninfo",
42 p.Data().ValidateURL.String())
43 assert.Equal(t, "", p.Data().ProfileURL.String())
44 assert.Equal(t, "profile email", p.Data().Scope)
47func TestGoogleProviderOverrides(t *testing.T) {
48 p := NewGoogleProvider(
49 &ProviderData{
50 LoginURL: &url.URL{
51 Scheme: "https",
52 Host: "example.com",
53 Path: "/oauth/auth"},
54 RedeemURL: &url.URL{
55 Scheme: "https",
56 Host: "example.com",
57 Path: "/oauth/token"},
58 ProfileURL: &url.URL{
59 Scheme: "https",
60 Host: "example.com",
61 Path: "/oauth/profile"},
62 ValidateURL: &url.URL{
63 Scheme: "https",
64 Host: "example.com",
65 Path: "/oauth/tokeninfo"},
66 Scope: "profile"})
67 assert.NotEqual(t, nil, p)
68 assert.Equal(t, "Google", p.Data().ProviderName)
69 assert.Equal(t, "https://example.com/oauth/auth",
70 p.Data().LoginURL.String())
71 assert.Equal(t, "https://example.com/oauth/token",
72 p.Data().RedeemURL.String())
73 assert.Equal(t, "https://example.com/oauth/profile",
74 p.Data().ProfileURL.String())
75 assert.Equal(t, "https://example.com/oauth/tokeninfo",
76 p.Data().ValidateURL.String())
77 assert.Equal(t, "profile", p.Data().Scope)
80type redeemResponse struct {
81 AccessToken string `json:"access_token"`
82 RefreshToken string `json:"refresh_token"`
83 ExpiresIn int64 `json:"expires_in"`
84 IdToken string `json:"id_token"`
87func TestGoogleProviderGetEmailAddress(t *testing.T) {
88 p := newGoogleProvider()
89 body, err := json.Marshal(redeemResponse{
90 AccessToken: "a1234",
91 ExpiresIn: 10,
92 RefreshToken: "refresh12345",
93 IdToken: "ignored prefix." + base64.URLEncoding.EncodeToString([]byte(`{"email": "michael.bland@gsa.gov", "email_verified":true}`)),
94 })
95 assert.Equal(t, nil, err)
96 var server *httptest.Server
97 p.RedeemURL, server = newRedeemServer(body)
98 defer server.Close()
100 session, err := p.Redeem("http://redirect/", "code1234")
101 assert.Equal(t, nil, err)
102 assert.NotEqual(t, session, nil)
103 assert.Equal(t, "michael.bland@gsa.gov", session.Email)
104 assert.Equal(t, "a1234", session.AccessToken)
105 assert.Equal(t, "refresh12345", session.RefreshToken)
108func TestGoogleProviderValidateGroup(t *testing.T) {
109 p := newGoogleProvider()
110 p.GroupValidator = func(email string) bool {
111 return email == "michael.bland@gsa.gov"
112 }
113 assert.Equal(t, true, p.ValidateGroup("michael.bland@gsa.gov"))
114 p.GroupValidator = func(email string) bool {
115 return email != "michael.bland@gsa.gov"
116 }
117 assert.Equal(t, false, p.ValidateGroup("michael.bland@gsa.gov"))
120func TestGoogleProviderWithoutValidateGroup(t *testing.T) {
121 p := newGoogleProvider()
122 assert.Equal(t, true, p.ValidateGroup("michael.bland@gsa.gov"))
125//
126func TestGoogleProviderGetEmailAddressInvalidEncoding(t *testing.T) {
127 p := newGoogleProvider()
128 body, err := json.Marshal(redeemResponse{
129 AccessToken: "a1234",
130 IdToken: "ignored prefix." + `{"email": "michael.bland@gsa.gov"}`,
131 })
132 assert.Equal(t, nil, err)
133 var server *httptest.Server
134 p.RedeemURL, server = newRedeemServer(body)
135 defer server.Close()
137 session, err := p.Redeem("http://redirect/", "code1234")
138 assert.NotEqual(t, nil, err)
139 if session != nil {
140 t.Errorf("expect nill session %#v", session)
141 }
144func TestGoogleProviderGetEmailAddressInvalidJson(t *testing.T) {
145 p := newGoogleProvider()
147 body, err := json.Marshal(redeemResponse{
148 AccessToken: "a1234",
149 IdToken: "ignored prefix." + base64.URLEncoding.EncodeToString([]byte(`{"email": michael.bland@gsa.gov}`)),
150 })
151 assert.Equal(t, nil, err)
152 var server *httptest.Server
153 p.RedeemURL, server = newRedeemServer(body)
154 defer server.Close()
156 session, err := p.Redeem("http://redirect/", "code1234")
157 assert.NotEqual(t, nil, err)
158 if session != nil {
159 t.Errorf("expect nill session %#v", session)
160 }
164func TestGoogleProviderGetEmailAddressEmailMissing(t *testing.T) {
165 p := newGoogleProvider()
166 body, err := json.Marshal(redeemResponse{
167 AccessToken: "a1234",
168 IdToken: "ignored prefix." + base64.URLEncoding.EncodeToString([]byte(`{"not_email": "missing"}`)),
169 })
170 assert.Equal(t, nil, err)
171 var server *httptest.Server
172 p.RedeemURL, server = newRedeemServer(body)
173 defer server.Close()
175 session, err := p.Redeem("http://redirect/", "code1234")
176 assert.NotEqual(t, nil, err)
177 if session != nil {
178 t.Errorf("expect nill session %#v", session)
179 }