@@ -391,10 +391,12 @@ func TestValidateTokenValidToken(t *testing.T) {
391391}
392392
393393type ProcessCookieTest struct {
394− opts *Options
395− proxy *OauthProxy
396− rw *httptest.ResponseRecorder
397− req *http.Request
394+ opts *Options
395+ proxy *OauthProxy
396+ rw *httptest.ResponseRecorder
397+ req *http.Request
398+ backend *httptest.Server
399+ response_code int
398400}
399401
400402func NewProcessCookieTest() *ProcessCookieTest {
@@ -405,6 +407,8 @@ func NewProcessCookieTest() *ProcessCookieTest {
405407 pc_test.opts.CookieSecret = "foobar"
406408 pc_test.opts.ClientID = "bazquux"
407409 pc_test.opts.ClientSecret = "xyzzyplugh"
410+ pc_test.opts.PassAccessToken = true
411+ pc_test.opts.CookieSecret = "0123456789abcdef"
408412 pc_test.opts.Validate()
409413
410414 pc_test.proxy = NewOauthProxy(pc_test.opts, func(email string) bool {
@@ -416,12 +420,32 @@ func NewProcessCookieTest() *ProcessCookieTest {
416420 return &pc_test
417421}
418422
419−func (p *ProcessCookieTest) MakeCookie(value string) *http.Cookie {
420− return p.proxy.MakeCookie(p.req, value, p.opts.CookieExpire)
423+func (p *ProcessCookieTest) InstantiateBackend() {
424+ p.backend = httptest.NewServer(
425+ http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
426+ w.WriteHeader(p.response_code)
427+ }))
428+ backend_url, _ := url.Parse(p.backend.URL)
429+ p.proxy.oauthValidateUrl = &url.URL{
430+ Scheme: "http",
431+ Host: backend_url.Host,
432+ Path: "/oauth/tokeninfo",
433+ }
434+ p.response_code = 200
435+}
436+
437+func (p *ProcessCookieTest) Close() {
438+ p.backend.Close()
439+}
440+
441+func (p *ProcessCookieTest) MakeCookie(value, access_token string) *http.Cookie {
442+ cookie_value, _ := buildCookieValue(
443+ value, p.proxy.AesCipher, access_token)
444+ return p.proxy.MakeCookie(p.req, cookie_value, p.opts.CookieExpire)
421445}
422446
423−func (p *ProcessCookieTest) AddCookie(value string) {
424− p.req.AddCookie(p.MakeCookie(value))
447+func (p *ProcessCookieTest) AddCookie(value, access_token string) {
448+ p.req.AddCookie(p.MakeCookie(value, access_token))
425449}
426450
427451func (p *ProcessCookieTest) ProcessCookie() (email, user, access_token string, ok bool) {
@@ -430,11 +454,13 @@ func (p *ProcessCookieTest) ProcessCookie() (email, user, access_token string, o
430454
431455func TestProcessCookie(t *testing.T) {
432456 pc_test := NewProcessCookieTest()
433− pc_test.AddCookie("michael.bland@gsa.gov")
434− email, user, _, ok := pc_test.ProcessCookie()
457+
458+ pc_test.AddCookie("michael.bland@gsa.gov", "my_access_token")
459+ email, user, access_token, ok := pc_test.ProcessCookie()
435460 assert.Equal(t, true, ok)
436461 assert.Equal(t, "michael.bland@gsa.gov", email)
437462 assert.Equal(t, "michael.bland", user)
463+ assert.Equal(t, "my_access_token", access_token)
438464}
439465
440466func TestProcessCookieNoCookieError(t *testing.T) {
@@ -445,7 +471,10 @@ func TestProcessCookieNoCookieError(t *testing.T) {
445471
446472func TestProcessCookieRefreshNotSet(t *testing.T) {
447473 pc_test := NewProcessCookieTest()
448− cookie := pc_test.MakeCookie("michael.bland@gsa.gov")
474+ pc_test.InstantiateBackend()
475+ defer pc_test.Close()
476+
477+ cookie := pc_test.MakeCookie("michael.bland@gsa.gov", "")
449478 cookie.Expires = time.Now().Add(time.Duration(23) * time.Hour)
450479 pc_test.req.AddCookie(cookie)
451480
@@ -456,7 +485,10 @@ func TestProcessCookieRefreshNotSet(t *testing.T) {
456485
457486func TestProcessCookieRefresh(t *testing.T) {
458487 pc_test := NewProcessCookieTest()
459− cookie := pc_test.MakeCookie("michael.bland@gsa.gov")
488+ pc_test.InstantiateBackend()
489+ defer pc_test.Close()
490+
491+ cookie := pc_test.MakeCookie("michael.bland@gsa.gov", "my_access_token")
460492 cookie.Expires = time.Now().Add(time.Duration(23) * time.Hour)
461493 pc_test.req.AddCookie(cookie)
462494
@@ -465,3 +497,19 @@ func TestProcessCookieRefresh(t *testing.T) {
465497 assert.Equal(t, true, ok)
466498 assert.NotEqual(t, []string(nil), pc_test.rw.HeaderMap["Set-Cookie"])
467499}
500+
501+func TestProcessCookieFailIfRefreshSetAndTokenNoLongerValid(t *testing.T) {
502+ pc_test := NewProcessCookieTest()
503+ pc_test.InstantiateBackend()
504+ defer pc_test.Close()
505+ pc_test.response_code = 401
506+
507+ cookie := pc_test.MakeCookie("michael.bland@gsa.gov", "my_access_token")
508+ cookie.Expires = time.Now().Add(time.Duration(23) * time.Hour)
509+ pc_test.req.AddCookie(cookie)
510+
511+ pc_test.proxy.CookieRefresh = time.Duration(24) * time.Hour
512+ _, _, _, ok := pc_test.ProcessCookie()
513+ assert.Equal(t, false, ok)
514+ assert.Equal(t, []string(nil), pc_test.rw.HeaderMap["Set-Cookie"])
515+}