monkee.ch/monkeeShark
1
0
Fork 0
Code Pull requests Activity
monkeeShark/packages/backend/test/e2e/oauth.ts

891 lines
27 KiB
TypeScript
Raw Normal View History

tmp
2023-04-02 19:59:38 +00:00
process.env.NODE_ENV = 'test';
import * as assert from 'assert';
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
import { AuthorizationCode, type AuthorizationTokenConfig } from 'simple-oauth2';
tmp
2023-04-02 19:59:38 +00:00
import pkceChallenge from 'pkce-challenge';
import { JSDOM } from 'jsdom';
concurrent flow test
2023-04-10 18:29:11 +00:00
import * as misskey from 'misskey-js';
import Fastify, { type FastifyInstance } from 'fastify';
strict redirection uri
2023-04-10 12:49:18 +00:00
import { port, relativeFetch, signup, startServer } from '../utils.js';
import type { INestApplicationContext } from '@nestjs/common';
tmp
2023-04-02 19:59:38 +00:00
server metadata test
2023-04-10 08:17:41 +00:00
const host = `http://127.0.0.1:${port}`;
a bit more tests
2023-04-03 20:32:12 +00:00
const clientPort = port + 1;
const redirect_uri = `http://127.0.0.1:${clientPort}/redirect`;
reduce any using OAuthErrorResponse
2023-04-16 13:51:52 +00:00
interface OAuthErrorResponse {
use errorHandler()
2023-04-15 21:15:37 +00:00
error: string;
reduce any using OAuthErrorResponse
2023-04-16 13:51:52 +00:00
error_description: string;
use errorHandler()
2023-04-15 21:15:37 +00:00
}
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
interface AuthorizationParamsExtended {
redirect_uri: string;
scope: string | string[];
state: string;
code_challenge?: string;
code_challenge_method?: string;
}
interface AuthorizationTokenConfigExtended extends AuthorizationTokenConfig {
code_verifier: string;
}
a bit more tests
2023-04-03 20:32:12 +00:00
function getClient(): AuthorizationCode<'client_id'> {
return new AuthorizationCode({
client: {
id: `http://127.0.0.1:${clientPort}/`,
upgrade to pkce-challenge@4
2023-05-11 21:09:24 +00:00
secret: '',
a bit more tests
2023-04-03 20:32:12 +00:00
},
auth: {
server metadata test
2023-04-10 08:17:41 +00:00
tokenHost: host,
a bit more tests
2023-04-03 20:32:12 +00:00
tokenPath: '/oauth/token',
authorizePath: '/oauth/authorize',
},
options: {
authorizationMethod: 'body',
},
});
}
more discovery test
2023-04-10 15:48:45 +00:00
function getMeta(html: string): { transactionId: string | undefined, clientName: string | undefined } {
a bit more tests
2023-04-03 20:32:12 +00:00
const fragment = JSDOM.fragment(html);
strict redirection uri
2023-04-10 12:49:18 +00:00
return {
transactionId: fragment.querySelector<HTMLMetaElement>('meta[name="misskey:oauth:transaction-id"]')?.content,
clientName: fragment.querySelector<HTMLMetaElement>('meta[name="misskey:oauth:client-name"]')?.content,
};
a bit more tests
2023-04-03 20:32:12 +00:00
}
use MemoryKVCache for oauth store
2023-06-03 22:16:51 +00:00
function fetchDecision(transactionId: string, user: misskey.entities.MeSignup, { cancel }: { cancel?: boolean } = {}): Promise<Response> {
server metadata test
2023-04-10 08:17:41 +00:00
return fetch(new URL('/oauth/decision', host), {
a bit more tests
2023-04-03 20:32:12 +00:00
method: 'post',
body: new URLSearchParams({
transaction_id: transactionId!,
login_token: user.token,
cancel: cancel ? 'cancel' : '',
}),
redirect: 'manual',
headers: {
'content-type': 'application/x-www-form-urlencoded',
},
});
}
concurrent flow test
2023-04-10 18:29:11 +00:00
async function fetchDecisionFromResponse(response: Response, user: misskey.entities.MeSignup, { cancel }: { cancel?: boolean } = {}): Promise<Response> {
strict redirection uri
2023-04-10 12:49:18 +00:00
const { transactionId } = getMeta(await response.text());
a bit more tests
2023-04-03 20:32:12 +00:00
use MemoryKVCache for oauth store
2023-06-03 22:16:51 +00:00
return await fetchDecision(transactionId!, user, { cancel });
a bit more tests
2023-04-03 20:32:12 +00:00
}
tmp
2023-04-02 19:59:38 +00:00
describe('OAuth', () => {
let app: INestApplicationContext;
strict redirection uri
2023-04-10 12:49:18 +00:00
let fastify: FastifyInstance;
tmp
2023-04-02 19:59:38 +00:00
concurrent flow test
2023-04-10 18:29:11 +00:00
let alice: misskey.entities.MeSignup;
let bob: misskey.entities.MeSignup;
tmp
2023-04-02 19:59:38 +00:00
beforeAll(async () => {
app = await startServer();
more discovery test
2023-04-10 15:48:45 +00:00
alice = await signup({ username: 'alice' });
concurrent flow test
2023-04-10 18:29:11 +00:00
bob = await signup({ username: 'bob' });
more discovery test
2023-04-10 15:48:45 +00:00
}, 1000 * 60 * 2);
beforeEach(async () => {
process.env.MISSKEY_TEST_DISALLOW_LOOPBACK = '';
strict redirection uri
2023-04-10 12:49:18 +00:00
fastify = Fastify();
fastify.get('/', async (request, reply) => {
reply.send(`
<!DOCTYPE html>
<link rel="redirect_uri" href="/redirect" />
<div class="h-app"><div class="p-name">Misklient
`);
});
client info discovery test
2023-04-10 14:26:04 +00:00
await fastify.listen({ port: clientPort });
more discovery test
2023-04-10 15:48:45 +00:00
});
tmp
2023-04-02 19:59:38 +00:00
afterAll(async () => {
await app.close();
more discovery test
2023-04-10 15:48:45 +00:00
});
afterEach(async () => {
strict redirection uri
2023-04-10 12:49:18 +00:00
await fastify.close();
tmp
2023-04-02 19:59:38 +00:00
});
test('Full flow', async () => {
upgrade to pkce-challenge@4
2023-05-11 21:09:24 +00:00
const { code_challenge, code_verifier } = await pkceChallenge(128);
tmp
2023-04-02 19:59:38 +00:00
a bit more tests
2023-04-03 20:32:12 +00:00
const client = getClient();
tmp
2023-04-02 19:59:38 +00:00
a bit more tests
2023-04-03 20:32:12 +00:00
const response = await fetch(client.authorizeURL({
tmp
2023-04-02 19:59:38 +00:00
redirect_uri,
scope: 'write:notes',
state: 'state',
code_challenge,
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
tmp
2023-04-02 19:59:38 +00:00
assert.strictEqual(response.status, 200);
strict redirection uri
2023-04-10 12:49:18 +00:00
const meta = getMeta(await response.text());
assert.strictEqual(typeof meta.transactionId, 'string');
more discovery test
2023-04-10 15:48:45 +00:00
assert.strictEqual(meta.clientName, 'Misklient');
tmp
2023-04-02 19:59:38 +00:00
use MemoryKVCache for oauth store
2023-06-03 22:16:51 +00:00
const decisionResponse = await fetchDecision(meta.transactionId!, alice);
tmp
2023-04-02 19:59:38 +00:00
assert.strictEqual(decisionResponse.status, 302);
assert.ok(decisionResponse.headers.has('location'));
const location = new URL(decisionResponse.headers.get('location')!);
assert.strictEqual(location.origin + location.pathname, redirect_uri);
assert.ok(location.searchParams.has('code'));
assert.strictEqual(location.searchParams.get('state'), 'state');
iss parameter test
2023-04-09 16:49:58 +00:00
assert.strictEqual(location.searchParams.get('iss'), 'http://misskey.local'); // RFC 9207
tmp
2023-04-02 19:59:38 +00:00
const token = await client.getToken({
code: location.searchParams.get('code')!,
redirect_uri,
code_verifier,
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationTokenConfigExtended);
tmp
2023-04-02 19:59:38 +00:00
assert.strictEqual(typeof token.token.access_token, 'string');
assert.strictEqual(token.token.token_type, 'Bearer');
return scope in token response
2023-04-09 19:21:10 +00:00
assert.strictEqual(token.token.scope, 'write:notes');
resolve conflicts
2023-04-07 08:06:07 +00:00
const createResponse = await relativeFetch('api/notes/create', {
method: 'POST',
headers: {
Authorization: `Bearer ${token.token.access_token}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({ text: 'test' }),
});
assert.strictEqual(createResponse.status, 200);
const createResponseBody: any = await createResponse.json();
assert.strictEqual(createResponseBody.createdNote.text, 'test');
tmp
2023-04-02 19:59:38 +00:00
});
a bit more tests
2023-04-03 20:32:12 +00:00
concurrent flow test
2023-04-10 18:29:11 +00:00
test('Two concurrent flows', async () => {
const client = getClient();
upgrade to pkce-challenge@4
2023-05-11 21:09:24 +00:00
const pkceAlice = await pkceChallenge(128);
const pkceBob = await pkceChallenge(128);
concurrent flow test
2023-04-10 18:29:11 +00:00
const responseAlice = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes',
state: 'state',
code_challenge: pkceAlice.code_challenge,
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
concurrent flow test
2023-04-10 18:29:11 +00:00
assert.strictEqual(responseAlice.status, 200);
const responseBob = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes',
state: 'state',
code_challenge: pkceBob.code_challenge,
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
concurrent flow test
2023-04-10 18:29:11 +00:00
assert.strictEqual(responseBob.status, 200);
const decisionResponseAlice = await fetchDecisionFromResponse(responseAlice, alice);
assert.strictEqual(decisionResponseAlice.status, 302);
const decisionResponseBob = await fetchDecisionFromResponse(responseBob, bob);
assert.strictEqual(decisionResponseBob.status, 302);
const locationAlice = new URL(decisionResponseAlice.headers.get('location')!);
assert.ok(locationAlice.searchParams.has('code'));
const locationBob = new URL(decisionResponseBob.headers.get('location')!);
assert.ok(locationBob.searchParams.has('code'));
const tokenAlice = await client.getToken({
code: locationAlice.searchParams.get('code')!,
redirect_uri,
code_verifier: pkceAlice.code_verifier,
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationTokenConfigExtended);
concurrent flow test
2023-04-10 18:29:11 +00:00
const tokenBob = await client.getToken({
code: locationBob.searchParams.get('code')!,
redirect_uri,
code_verifier: pkceBob.code_verifier,
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationTokenConfigExtended);
concurrent flow test
2023-04-10 18:29:11 +00:00
const createResponseAlice = await relativeFetch('api/notes/create', {
method: 'POST',
headers: {
Authorization: `Bearer ${tokenAlice.token.access_token}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({ text: 'test' }),
});
assert.strictEqual(createResponseAlice.status, 200);
const createResponseBob = await relativeFetch('api/notes/create', {
method: 'POST',
headers: {
Authorization: `Bearer ${tokenBob.token.access_token}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({ text: 'test' }),
});
assert.strictEqual(createResponseAlice.status, 200);
const createResponseBodyAlice = await createResponseAlice.json() as { createdNote: misskey.entities.Note };
assert.strictEqual(createResponseBodyAlice.createdNote.user.username, 'alice');
const createResponseBodyBob = await createResponseBob.json() as { createdNote: misskey.entities.Note };
assert.strictEqual(createResponseBodyBob.createdNote.user.username, 'bob');
});
PKCE verification test
2023-04-08 13:52:43 +00:00
describe('PKCE', () => {
test('Require PKCE', async () => {
const client = getClient();
test comment
2023-04-08 14:03:20 +00:00
// Pattern 1: No PKCE fields at all
PKCE verification test
2023-04-08 13:52:43 +00:00
let response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes',
state: 'state',
}));
use errorHandler()
2023-04-15 21:15:37 +00:00
assert.strictEqual(response.status, 400);
reduce any using OAuthErrorResponse
2023-04-16 13:51:52 +00:00
assert.strictEqual((await response.json() as OAuthErrorResponse).error, 'invalid_request');
PKCE verification test
2023-04-08 13:52:43 +00:00
test comment
2023-04-08 14:03:20 +00:00
// Pattern 2: Only code_challenge
PKCE verification test
2023-04-08 13:52:43 +00:00
response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes',
state: 'state',
code_challenge: 'code',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
use errorHandler()
2023-04-15 21:15:37 +00:00
assert.strictEqual(response.status, 400);
reduce any using OAuthErrorResponse
2023-04-16 13:51:52 +00:00
assert.strictEqual((await response.json() as OAuthErrorResponse).error, 'invalid_request');
PKCE verification test
2023-04-08 13:52:43 +00:00
test comment
2023-04-08 14:03:20 +00:00
// Pattern 2: Only code_challenge_method
PKCE verification test
2023-04-08 13:52:43 +00:00
response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes',
state: 'state',
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
use errorHandler()
2023-04-15 21:15:37 +00:00
assert.strictEqual(response.status, 400);
reduce any using OAuthErrorResponse
2023-04-16 13:51:52 +00:00
assert.strictEqual((await response.json() as OAuthErrorResponse).error, 'invalid_request');
PKCE verification test
2023-04-08 13:52:43 +00:00
test comment
2023-04-08 14:03:20 +00:00
// Pattern 3: Unsupported code_challenge_method
PKCE verification test
2023-04-08 13:52:43 +00:00
response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes',
state: 'state',
code_challenge: 'code',
code_challenge_method: 'SSSS',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
use errorHandler()
2023-04-15 21:15:37 +00:00
assert.strictEqual(response.status, 400);
reduce any using OAuthErrorResponse
2023-04-16 13:51:52 +00:00
assert.strictEqual((await response.json() as OAuthErrorResponse).error, 'invalid_request');
PKCE verification test
2023-04-08 13:52:43 +00:00
});
a bit more tests
2023-04-03 20:32:12 +00:00
upgrade to pkce-challenge@4
2023-05-11 21:09:24 +00:00
// TODO: Use precomputed challenge/verifier set for this one for deterministic test
PKCE verification test
2023-04-08 13:52:43 +00:00
test('Verify PKCE', async () => {
upgrade to pkce-challenge@4
2023-05-11 21:09:24 +00:00
const { code_challenge, code_verifier } = await pkceChallenge(128);
PKCE verification test
2023-04-08 13:52:43 +00:00
const client = getClient();
const response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes',
state: 'state',
code_challenge,
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
PKCE verification test
2023-04-08 13:52:43 +00:00
assert.strictEqual(response.status, 200);
const decisionResponse = await fetchDecisionFromResponse(response, alice);
assert.strictEqual(decisionResponse.status, 302);
const code = new URL(decisionResponse.headers.get('location')!).searchParams.get('code')!;
assert.ok(!!code);
// Pattern 1: code followed by some junk code
await assert.rejects(client.getToken({
code,
redirect_uri,
code_verifier: code_verifier + 'x',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationTokenConfigExtended));
PKCE verification test
2023-04-08 13:52:43 +00:00
concurrent flow test
2023-04-10 18:29:11 +00:00
// TODO: The following patterns may fail only because of pattern 1's failure. Let's split them.
PKCE verification test
2023-04-08 13:52:43 +00:00
// Pattern 2: clipped code
await assert.rejects(client.getToken({
code,
redirect_uri,
code_verifier: code_verifier.slice(0, 80),
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationTokenConfigExtended));
PKCE verification test
2023-04-08 13:52:43 +00:00
// Pattern 3: Some part of code is replaced
await assert.rejects(client.getToken({
code,
redirect_uri,
code_verifier: code_verifier.slice(0, -10) + 'x'.repeat(10),
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationTokenConfigExtended));
PKCE verification test
2023-04-08 13:52:43 +00:00
todo
2023-04-17 07:26:45 +00:00
// TODO: pattern 4: no code_verifier
PKCE verification test
2023-04-08 13:52:43 +00:00
// And now the code is invalidated by the previous failures
await assert.rejects(client.getToken({
code,
redirect_uri,
code_verifier,
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationTokenConfigExtended));
PKCE verification test
2023-04-08 13:52:43 +00:00
});
a bit more tests
2023-04-03 20:32:12 +00:00
});
test('Cancellation', async () => {
const client = getClient();
const response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes',
state: 'state',
code_challenge: 'code',
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
a bit more tests
2023-04-03 20:32:12 +00:00
assert.strictEqual(response.status, 200);
const decisionResponse = await fetchDecisionFromResponse(response, alice, { cancel: true });
PKCE verification test
2023-04-08 13:52:43 +00:00
assert.strictEqual(decisionResponse.status, 302);
a bit more tests
2023-04-03 20:32:12 +00:00
const location = new URL(decisionResponse.headers.get('location')!);
assert.ok(!location.searchParams.has('code'));
assert.ok(location.searchParams.has('error'));
});
todos
2023-04-05 18:47:12 +00:00
scope test
2023-04-08 18:31:18 +00:00
describe('Scope', () => {
test('Missing scope', async () => {
const client = getClient();
const response = await fetch(client.authorizeURL({
redirect_uri,
state: 'state',
code_challenge: 'code',
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
scope test
2023-04-08 18:31:18 +00:00
use errorHandler()
2023-04-15 21:15:37 +00:00
assert.strictEqual(response.status, 400);
reduce any using OAuthErrorResponse
2023-04-16 13:51:52 +00:00
assert.strictEqual((await response.json() as OAuthErrorResponse).error, 'invalid_scope');
scope test
2023-04-08 18:31:18 +00:00
});
todos
2023-04-05 18:47:12 +00:00
scope test
2023-04-08 18:31:18 +00:00
test('Empty scope', async () => {
const client = getClient();
const response = await fetch(client.authorizeURL({
redirect_uri,
scope: '',
state: 'state',
code_challenge: 'code',
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
scope test
2023-04-08 18:31:18 +00:00
use errorHandler()
2023-04-15 21:15:37 +00:00
assert.strictEqual(response.status, 400);
reduce any using OAuthErrorResponse
2023-04-16 13:51:52 +00:00
assert.strictEqual((await response.json() as OAuthErrorResponse).error, 'invalid_scope');
scope test
2023-04-08 18:31:18 +00:00
});
test('Unknown scopes', async () => {
const client = getClient();
const response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'test:unknown test:unknown2',
state: 'state',
code_challenge: 'code',
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
scope test
2023-04-08 18:31:18 +00:00
use errorHandler()
2023-04-15 21:15:37 +00:00
assert.strictEqual(response.status, 400);
reduce any using OAuthErrorResponse
2023-04-16 13:51:52 +00:00
assert.strictEqual((await response.json() as OAuthErrorResponse).error, 'invalid_scope');
scope test
2023-04-08 18:31:18 +00:00
});
test('Partially known scopes', async () => {
upgrade to pkce-challenge@4
2023-05-11 21:09:24 +00:00
const { code_challenge, code_verifier } = await pkceChallenge(128);
return scope in token response
2023-04-09 19:21:10 +00:00
scope test
2023-04-08 18:31:18 +00:00
const client = getClient();
const response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes test:unknown test:unknown2',
state: 'state',
return scope in token response
2023-04-09 19:21:10 +00:00
code_challenge,
scope test
2023-04-08 18:31:18 +00:00
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
scope test
2023-04-08 18:31:18 +00:00
// Just get the known scope for this case for backward compatibility
assert.strictEqual(response.status, 200);
return scope in token response
2023-04-09 19:21:10 +00:00
const decisionResponse = await fetchDecisionFromResponse(response, alice);
assert.strictEqual(decisionResponse.status, 302);
const location = new URL(decisionResponse.headers.get('location')!);
assert.ok(location.searchParams.has('code'));
const code = new URL(decisionResponse.headers.get('location')!).searchParams.get('code')!;
assert.ok(!!code);
const token = await client.getToken({
code,
redirect_uri,
code_verifier,
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationTokenConfigExtended);
return scope in token response
2023-04-09 19:21:10 +00:00
// OAuth2 requires returning `scope` in the token response if the resulting scope is different than the requested one
// (Although Misskey always return scope, which is also fine)
assert.strictEqual(token.token.scope, 'write:notes');
scope test
2023-04-08 18:31:18 +00:00
});
test('Known scopes', async () => {
const client = getClient();
const response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes read:account',
state: 'state',
code_challenge: 'code',
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
scope test
2023-04-08 18:31:18 +00:00
assert.strictEqual(response.status, 200);
});
return scope in token response
2023-04-09 19:21:10 +00:00
test('Duplicated scopes', async () => {
upgrade to pkce-challenge@4
2023-05-11 21:09:24 +00:00
const { code_challenge, code_verifier } = await pkceChallenge(128);
return scope in token response
2023-04-09 19:21:10 +00:00
const client = getClient();
const response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes write:notes read:account read:account',
state: 'state',
code_challenge,
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
return scope in token response
2023-04-09 19:21:10 +00:00
assert.strictEqual(response.status, 200);
const decisionResponse = await fetchDecisionFromResponse(response, alice);
assert.strictEqual(decisionResponse.status, 302);
const location = new URL(decisionResponse.headers.get('location')!);
assert.ok(location.searchParams.has('code'));
const code = new URL(decisionResponse.headers.get('location')!).searchParams.get('code')!;
assert.ok(!!code);
const token = await client.getToken({
code,
redirect_uri,
code_verifier,
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationTokenConfigExtended);
return scope in token response
2023-04-09 19:21:10 +00:00
assert.strictEqual(token.token.scope, 'write:notes read:account');
});
test('Scope check by API', async () => {
upgrade to pkce-challenge@4
2023-05-11 21:09:24 +00:00
const { code_challenge, code_verifier } = await pkceChallenge(128);
return scope in token response
2023-04-09 19:21:10 +00:00
const client = getClient();
const response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'read:account',
state: 'state',
code_challenge,
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
return scope in token response
2023-04-09 19:21:10 +00:00
assert.strictEqual(response.status, 200);
header test
2023-04-09 12:01:44 +00:00
return scope in token response
2023-04-09 19:21:10 +00:00
const decisionResponse = await fetchDecisionFromResponse(response, alice);
assert.strictEqual(decisionResponse.status, 302);
const location = new URL(decisionResponse.headers.get('location')!);
assert.ok(location.searchParams.has('code'));
const token = await client.getToken({
code: location.searchParams.get('code')!,
redirect_uri,
code_verifier,
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationTokenConfigExtended);
return scope in token response
2023-04-09 19:21:10 +00:00
assert.strictEqual(typeof token.token.access_token, 'string');
const createResponse = await relativeFetch('api/notes/create', {
method: 'POST',
headers: {
Authorization: `Bearer ${token.token.access_token}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({ text: 'test' }),
});
// XXX: PERMISSION_DENIED is not using kind: 'permission' and gives 400 instead of 403
assert.strictEqual(createResponse.status, 400);
});
header test
2023-04-09 12:01:44 +00:00
});
test('Authorization header', async () => {
upgrade to pkce-challenge@4
2023-05-11 21:09:24 +00:00
const { code_challenge, code_verifier } = await pkceChallenge(128);
header test
2023-04-09 12:01:44 +00:00
const client = getClient();
const response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes',
state: 'state',
code_challenge,
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
header test
2023-04-09 12:01:44 +00:00
assert.strictEqual(response.status, 200);
const decisionResponse = await fetchDecisionFromResponse(response, alice);
assert.strictEqual(decisionResponse.status, 302);
const location = new URL(decisionResponse.headers.get('location')!);
assert.ok(location.searchParams.has('code'));
const token = await client.getToken({
code: location.searchParams.get('code')!,
redirect_uri,
code_verifier,
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationTokenConfigExtended);
header test
2023-04-09 12:01:44 +00:00
// Pattern 1: No preceding "Bearer "
let createResponse = await relativeFetch('api/notes/create', {
method: 'POST',
headers: {
Authorization: token.token.access_token as string,
'Content-Type': 'application/json',
},
body: JSON.stringify({ text: 'test' }),
});
assert.strictEqual(createResponse.status, 401);
// Pattern 2: Incorrect token
createResponse = await relativeFetch('api/notes/create', {
method: 'POST',
headers: {
Authorization: `Bearer ${(token.token.access_token as string).slice(0, -1)}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({ text: 'test' }),
});
// RFC 6750 section 3.1 says 401 but it's SHOULD not MUST. 403 should be okay for now.
assert.strictEqual(createResponse.status, 403);
// TODO: error code (invalid_token)
scope test
2023-04-08 18:31:18 +00:00
});
redirection test
2023-04-09 14:43:19 +00:00
describe('Redirection', () => {
test('Invalid redirect_uri at authorization endpoint', async () => {
const client = getClient();
const response = await fetch(client.authorizeURL({
redirect_uri: 'http://127.0.0.2/',
scope: 'write:notes',
state: 'state',
code_challenge: 'code',
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
use errorHandler()
2023-04-15 21:15:37 +00:00
assert.strictEqual(response.status, 400);
reduce any using OAuthErrorResponse
2023-04-16 13:51:52 +00:00
assert.strictEqual((await response.json() as OAuthErrorResponse).error, 'invalid_request');
redirection test
2023-04-09 14:43:19 +00:00
});
strict redirection uri
2023-04-10 12:49:18 +00:00
test('Invalid redirect_uri including the valid one at authorization endpoint', async () => {
const client = getClient();
const response = await fetch(client.authorizeURL({
redirect_uri: 'http://127.0.0.1/redirection',
scope: 'write:notes',
state: 'state',
code_challenge: 'code',
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
use errorHandler()
2023-04-15 21:15:37 +00:00
assert.strictEqual(response.status, 400);
reduce any using OAuthErrorResponse
2023-04-16 13:51:52 +00:00
assert.strictEqual((await response.json() as OAuthErrorResponse).error, 'invalid_request');
strict redirection uri
2023-04-10 12:49:18 +00:00
});
iss parameter test
2023-04-09 16:49:58 +00:00
test('No redirect_uri at authorization endpoint', async () => {
const client = getClient();
const response = await fetch(client.authorizeURL({
scope: 'write:notes',
state: 'state',
code_challenge: 'code',
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
use errorHandler()
2023-04-15 21:15:37 +00:00
assert.strictEqual(response.status, 400);
reduce any using OAuthErrorResponse
2023-04-16 13:51:52 +00:00
assert.strictEqual((await response.json() as OAuthErrorResponse).error, 'invalid_request');
iss parameter test
2023-04-09 16:49:58 +00:00
});
redirection test
2023-04-09 14:43:19 +00:00
test('Invalid redirect_uri at token endpoint', async () => {
upgrade to pkce-challenge@4
2023-05-11 21:09:24 +00:00
const { code_challenge, code_verifier } = await pkceChallenge(128);
redirection test
2023-04-09 14:43:19 +00:00
const client = getClient();
const response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes',
state: 'state',
code_challenge,
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
redirection test
2023-04-09 14:43:19 +00:00
assert.strictEqual(response.status, 200);
const decisionResponse = await fetchDecisionFromResponse(response, alice);
assert.strictEqual(decisionResponse.status, 302);
const location = new URL(decisionResponse.headers.get('location')!);
assert.ok(location.searchParams.has('code'));
await assert.rejects(client.getToken({
code: location.searchParams.get('code')!,
redirect_uri: 'http://127.0.0.2/',
code_verifier,
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationTokenConfigExtended));
redirection test
2023-04-09 14:43:19 +00:00
});
strict redirection uri
2023-04-10 12:49:18 +00:00
test('Invalid redirect_uri including the valid one at token endpoint', async () => {
upgrade to pkce-challenge@4
2023-05-11 21:09:24 +00:00
const { code_challenge, code_verifier } = await pkceChallenge(128);
iss parameter test
2023-04-09 16:49:58 +00:00
const client = getClient();
const response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes',
state: 'state',
code_challenge,
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
iss parameter test
2023-04-09 16:49:58 +00:00
assert.strictEqual(response.status, 200);
const decisionResponse = await fetchDecisionFromResponse(response, alice);
assert.strictEqual(decisionResponse.status, 302);
const location = new URL(decisionResponse.headers.get('location')!);
assert.ok(location.searchParams.has('code'));
await assert.rejects(client.getToken({
code: location.searchParams.get('code')!,
strict redirection uri
2023-04-10 12:49:18 +00:00
redirect_uri: 'http://127.0.0.1/redirection',
iss parameter test
2023-04-09 16:49:58 +00:00
code_verifier,
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationTokenConfigExtended));
iss parameter test
2023-04-09 16:49:58 +00:00
});
strict redirection uri
2023-04-10 12:49:18 +00:00
test('No redirect_uri at token endpoint', async () => {
upgrade to pkce-challenge@4
2023-05-11 21:09:24 +00:00
const { code_challenge, code_verifier } = await pkceChallenge(128);
strict redirection uri
2023-04-10 12:49:18 +00:00
const client = getClient();
const response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes',
state: 'state',
code_challenge,
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
strict redirection uri
2023-04-10 12:49:18 +00:00
assert.strictEqual(response.status, 200);
const decisionResponse = await fetchDecisionFromResponse(response, alice);
assert.strictEqual(decisionResponse.status, 302);
const location = new URL(decisionResponse.headers.get('location')!);
assert.ok(location.searchParams.has('code'));
await assert.rejects(client.getToken({
code: location.searchParams.get('code')!,
code_verifier,
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationTokenConfigExtended));
strict redirection uri
2023-04-10 12:49:18 +00:00
});
redirection test
2023-04-09 14:43:19 +00:00
});
server metadata test
2023-04-10 08:17:41 +00:00
test('Server metadata', async () => {
const response = await fetch(new URL('.well-known/oauth-authorization-server', host));
assert.strictEqual(response.status, 200);
const body = await response.json();
assert.strictEqual(body.issuer, 'http://misskey.local');
assert.ok(body.scopes_supported.includes('write:notes'));
});
todos
2023-04-05 18:47:12 +00:00
client info discovery test
2023-04-10 14:26:04 +00:00
describe('Client Information Discovery', () => {
more discovery test
2023-04-10 15:48:45 +00:00
describe('Redirection', () => {
test('Read HTTP header', async () => {
await fastify.close();
fastify = Fastify();
fastify.get('/', async (request, reply) => {
reply.header('Link', '</redirect>; rel="redirect_uri"');
reply.send(`
client info discovery test
2023-04-10 14:26:04 +00:00
<!DOCTYPE html>
<div class="h-app"><div class="p-name">Misklient
`);
more discovery test
2023-04-10 15:48:45 +00:00
});
await fastify.listen({ port: clientPort });
const client = getClient();
const response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes',
state: 'state',
code_challenge: 'code',
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
more discovery test
2023-04-10 15:48:45 +00:00
assert.strictEqual(response.status, 200);
client info discovery test
2023-04-10 14:26:04 +00:00
});
more discovery test
2023-04-10 15:48:45 +00:00
test('Mixed links', async () => {
await fastify.close();
client info discovery test
2023-04-10 14:26:04 +00:00
more discovery test
2023-04-10 15:48:45 +00:00
fastify = Fastify();
fastify.get('/', async (request, reply) => {
reply.header('Link', '</redirect>; rel="redirect_uri"');
reply.send(`
client info discovery test
2023-04-10 14:26:04 +00:00
<!DOCTYPE html>
<link rel="redirect_uri" href="/redirect2" />
<div class="h-app"><div class="p-name">Misklient
`);
more discovery test
2023-04-10 15:48:45 +00:00
});
await fastify.listen({ port: clientPort });
const client = getClient();
const response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes',
state: 'state',
code_challenge: 'code',
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
more discovery test
2023-04-10 15:48:45 +00:00
assert.strictEqual(response.status, 200);
client info discovery test
2023-04-10 14:26:04 +00:00
});
more discovery test
2023-04-10 15:48:45 +00:00
test('Multiple items in Link header', async () => {
await fastify.close();
client info discovery test
2023-04-10 14:26:04 +00:00
more discovery test
2023-04-10 15:48:45 +00:00
fastify = Fastify();
fastify.get('/', async (request, reply) => {
reply.header('Link', '</redirect2>; rel="redirect_uri",</redirect>; rel="redirect_uri"');
reply.send(`
client info discovery test
2023-04-10 14:26:04 +00:00
<!DOCTYPE html>
<div class="h-app"><div class="p-name">Misklient
`);
more discovery test
2023-04-10 15:48:45 +00:00
});
await fastify.listen({ port: clientPort });
const client = getClient();
const response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes',
state: 'state',
code_challenge: 'code',
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
more discovery test
2023-04-10 15:48:45 +00:00
assert.strictEqual(response.status, 200);
client info discovery test
2023-04-10 14:26:04 +00:00
});
more discovery test
2023-04-10 15:48:45 +00:00
test('Multiple items in HTML', async () => {
await fastify.close();
client info discovery test
2023-04-10 14:26:04 +00:00
more discovery test
2023-04-10 15:48:45 +00:00
fastify = Fastify();
fastify.get('/', async (request, reply) => {
reply.send(`
client info discovery test
2023-04-10 14:26:04 +00:00
<!DOCTYPE html>
<link rel="redirect_uri" href="/redirect2" />
<link rel="redirect_uri" href="/redirect" />
<div class="h-app"><div class="p-name">Misklient
`);
more discovery test
2023-04-10 15:48:45 +00:00
});
await fastify.listen({ port: clientPort });
const client = getClient();
const response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes',
state: 'state',
code_challenge: 'code',
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
more discovery test
2023-04-10 15:48:45 +00:00
assert.strictEqual(response.status, 200);
client info discovery test
2023-04-10 14:26:04 +00:00
});
more discovery test
2023-04-10 15:48:45 +00:00
test('No item', async () => {
await fastify.close();
client info discovery test
2023-04-10 14:26:04 +00:00
more discovery test
2023-04-10 15:48:45 +00:00
fastify = Fastify();
fastify.get('/', async (request, reply) => {
reply.send(`
<!DOCTYPE html>
<div class="h-app"><div class="p-name">Misklient
`);
});
await fastify.listen({ port: clientPort });
const client = getClient();
const response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes',
state: 'state',
code_challenge: 'code',
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
use errorHandler()
2023-04-15 21:15:37 +00:00
assert.strictEqual(response.status, 400);
reduce any using OAuthErrorResponse
2023-04-16 13:51:52 +00:00
assert.strictEqual((await response.json() as OAuthErrorResponse).error, 'invalid_request');
more discovery test
2023-04-10 15:48:45 +00:00
});
});
test('Disallow loopback', async () => {
process.env.MISSKEY_TEST_DISALLOW_LOOPBACK = '1';
const client = getClient();
client info discovery test
2023-04-10 14:26:04 +00:00
const response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes',
state: 'state',
code_challenge: 'code',
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
use errorHandler()
2023-04-15 21:15:37 +00:00
assert.strictEqual(response.status, 400);
reduce any using OAuthErrorResponse
2023-04-16 13:51:52 +00:00
assert.strictEqual((await response.json() as OAuthErrorResponse).error, 'invalid_request');
client info discovery test
2023-04-10 14:26:04 +00:00
});
more discovery test
2023-04-10 15:48:45 +00:00
test('Missing name', async () => {
client info discovery test
2023-04-10 14:26:04 +00:00
await fastify.close();
fastify = Fastify();
fastify.get('/', async (request, reply) => {
more discovery test
2023-04-10 15:48:45 +00:00
reply.header('Link', '</redirect>; rel="redirect_uri"');
reply.send();
client info discovery test
2023-04-10 14:26:04 +00:00
});
await fastify.listen({ port: clientPort });
const client = getClient();
const response = await fetch(client.authorizeURL({
redirect_uri,
scope: 'write:notes',
state: 'state',
code_challenge: 'code',
code_challenge_method: 'S256',
reduce type errors with pkce params
2023-04-16 14:03:14 +00:00
} as AuthorizationParamsExtended));
more discovery test
2023-04-10 15:48:45 +00:00
assert.strictEqual(response.status, 200);
assert.strictEqual(getMeta(await response.text()).clientName, `http://127.0.0.1:${clientPort}/`);
client info discovery test
2023-04-10 14:26:04 +00:00
});
});
use errorHandler()
2023-04-15 21:15:37 +00:00
// TODO: Invalid decision endpoint parameters
merge authorization validation logic
2023-04-16 13:43:32 +00:00
// TODO: Unknown OAuth endpoint
todo
2023-04-17 07:26:45 +00:00
// TODO: successful token exchange should invalidate the grant token (spec?)
tmp
2023-04-02 19:59:38 +00:00
});
Copy permalink