Function TestValidateToken

coderd/externalauth/externalauth_test.go:851–1023

(t *testing.T)

}

func TestValidateToken(t *testing.T) {
	t.Parallel()

	// These tests use httptest.NewServer to control response headers
	// (X-RateLimit-Remaining, Retry-After) that the FakeIDP's
	// WithDynamicUserInfo hook does not expose.

	newValidateConfig := func(t *testing.T, validateURL string) *externalauth.Config {
		t.Helper()
		f := promoauth.NewFactory(prometheus.NewRegistry())
		return &externalauth.Config{
			InstrumentedOAuth2Config: f.New("test-validate", &oauth2.Config{}),
			ID:                       "test-validate",
			Type:                     codersdk.EnhancedExternalAuthProviderGitHub.String(),
			ValidateURL:              validateURL,
		}
	}

	newToken := func() *oauth2.Token {
		return &oauth2.Token{
			AccessToken: "test-access-token",
			Expiry:      time.Now().Add(time.Hour),
		}
	}

	// newValidateCtx returns a context carrying a dedicated http.Client per
	// subtest. Without this, parallel subtests share http.DefaultTransport,
	// and httptest.Server.Close() calls http.DefaultTransport.CloseIdleConnections
	// which can break in-flight requests of sibling subtests.
	newValidateCtx := func(t *testing.T) context.Context {
		t.Helper()
		tp := &http.Transport{}
		t.Cleanup(tp.CloseIdleConnections)
		return oidc.ClientContext(context.Background(), &http.Client{Transport: tp})
	}

	// RateLimitRemaining: 403 with X-RateLimit-Remaining: 0 should be
	// treated as rate-limited, not as an invalid token.
	t.Run("RateLimitRemaining", func(t *testing.T) {
		t.Parallel()

		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
			w.Header().Set("X-RateLimit-Remaining", "0")
			w.Header().Set("X-RateLimit-Limit", "5000")
			w.WriteHeader(http.StatusForbidden)
		}))
		t.Cleanup(srv.Close)

		config := newValidateConfig(t, srv.URL)
		valid, user, err := config.ValidateToken(newValidateCtx(t), newToken())

		require.NoError(t, err)
		assert.True(t, valid, "rate-limited 403 should be treated as optimistically valid")
		assert.Nil(t, user)
	})

	// RetryAfter: 403 with Retry-After header (secondary rate limit)
	// should be treated as rate-limited.