jason
395f0e2029
Some checks failed
Check Maintainer Edits Enabled / check-maintainer-edits (pull_request) Has been cancelled
Check Maintainer Edits Enabled / check-maintainer-edits-internal (pull_request) Has been cancelled
Docker Build and Push to GHCR / build-and-push (pull_request) Has been cancelled
Ruff / ruff (pull_request) Has been cancelled
119 lines
3.6 KiB
Python
119 lines
3.6 KiB
Python
"""Regression tests for OAuth PKCE flow wiring."""
|
|
|
|
import os
|
|
import sys
|
|
from unittest.mock import patch
|
|
|
|
|
|
sys.path.insert(0, os.path.abspath(os.path.join(os.path.dirname(__file__), "../..")))
|
|
|
|
from auth.google_auth import create_oauth_flow # noqa: E402
|
|
|
|
|
|
DUMMY_CLIENT_CONFIG = {
|
|
"web": {
|
|
"client_id": "dummy-client-id.apps.googleusercontent.com",
|
|
"client_secret": "dummy-secret",
|
|
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
|
|
"token_uri": "https://oauth2.googleapis.com/token",
|
|
}
|
|
}
|
|
|
|
|
|
def test_create_oauth_flow_autogenerates_verifier_when_missing():
|
|
expected_flow = object()
|
|
with (
|
|
patch(
|
|
"auth.google_auth.load_client_secrets_from_env",
|
|
return_value=DUMMY_CLIENT_CONFIG,
|
|
),
|
|
patch(
|
|
"auth.google_auth.Flow.from_client_config",
|
|
return_value=expected_flow,
|
|
) as mock_from_client_config,
|
|
):
|
|
flow = create_oauth_flow(
|
|
scopes=["openid"],
|
|
redirect_uri="http://localhost/callback",
|
|
state="oauth-state-1",
|
|
)
|
|
|
|
assert flow is expected_flow
|
|
args, kwargs = mock_from_client_config.call_args
|
|
assert args[0] == DUMMY_CLIENT_CONFIG
|
|
assert kwargs["autogenerate_code_verifier"] is True
|
|
assert "code_verifier" not in kwargs
|
|
|
|
|
|
def test_create_oauth_flow_preserves_callback_verifier():
|
|
expected_flow = object()
|
|
with (
|
|
patch(
|
|
"auth.google_auth.load_client_secrets_from_env",
|
|
return_value=DUMMY_CLIENT_CONFIG,
|
|
),
|
|
patch(
|
|
"auth.google_auth.Flow.from_client_config",
|
|
return_value=expected_flow,
|
|
) as mock_from_client_config,
|
|
):
|
|
flow = create_oauth_flow(
|
|
scopes=["openid"],
|
|
redirect_uri="http://localhost/callback",
|
|
state="oauth-state-2",
|
|
code_verifier="saved-verifier",
|
|
)
|
|
|
|
assert flow is expected_flow
|
|
args, kwargs = mock_from_client_config.call_args
|
|
assert args[0] == DUMMY_CLIENT_CONFIG
|
|
assert kwargs["code_verifier"] == "saved-verifier"
|
|
assert kwargs["autogenerate_code_verifier"] is False
|
|
|
|
|
|
def test_create_oauth_flow_file_config_still_enables_pkce():
|
|
expected_flow = object()
|
|
with (
|
|
patch("auth.google_auth.load_client_secrets_from_env", return_value=None),
|
|
patch("auth.google_auth.os.path.exists", return_value=True),
|
|
patch(
|
|
"auth.google_auth.Flow.from_client_secrets_file",
|
|
return_value=expected_flow,
|
|
) as mock_from_file,
|
|
):
|
|
flow = create_oauth_flow(
|
|
scopes=["openid"],
|
|
redirect_uri="http://localhost/callback",
|
|
state="oauth-state-3",
|
|
)
|
|
|
|
assert flow is expected_flow
|
|
_args, kwargs = mock_from_file.call_args
|
|
assert kwargs["autogenerate_code_verifier"] is True
|
|
assert "code_verifier" not in kwargs
|
|
|
|
|
|
def test_create_oauth_flow_allows_disabling_autogenerate_without_verifier():
|
|
expected_flow = object()
|
|
with (
|
|
patch(
|
|
"auth.google_auth.load_client_secrets_from_env",
|
|
return_value=DUMMY_CLIENT_CONFIG,
|
|
),
|
|
patch(
|
|
"auth.google_auth.Flow.from_client_config",
|
|
return_value=expected_flow,
|
|
) as mock_from_client_config,
|
|
):
|
|
flow = create_oauth_flow(
|
|
scopes=["openid"],
|
|
redirect_uri="http://localhost/callback",
|
|
state="oauth-state-4",
|
|
autogenerate_code_verifier=False,
|
|
)
|
|
|
|
assert flow is expected_flow
|
|
_args, kwargs = mock_from_client_config.call_args
|
|
assert kwargs["autogenerate_code_verifier"] is False
|
|
assert "code_verifier" not in kwargs
|