Function TestOAuth2BearerTokenPrecedence

coderd/httpmw/rfc6750_extended_test.go:235–336

TestOAuth2BearerTokenPrecedence tests token extraction precedence per RFC 6750 nolint:tparallel,paralleltest // Subtests share a DB; run sequentially to avoid Windows DB cleanup flake.

(t *testing.T)

//
//nolint:tparallel,paralleltest // Subtests share a DB; run sequentially to avoid Windows DB cleanup flake.
func TestOAuth2BearerTokenPrecedence(t *testing.T) {
	t.Parallel()

	db, _ := dbtestutil.NewDB(t)
	user := dbgen.User(t, db, database.User{})

	// Create a valid API key
	key, validToken := dbgen.APIKey(t, db, database.APIKey{
		UserID:    user.ID,
		ExpiresAt: dbtime.Now().Add(testutil.WaitLong),
	})

	middleware := httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{
		DB: db,
	})

	handler := middleware(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
		apiKey := httpmw.APIKey(r)
		rw.Header().Set("X-Key-ID", apiKey.ID)
		rw.WriteHeader(http.StatusOK)
	}))

	t.Run("CookieTakesPrecedenceOverBearer", func(t *testing.T) {
		req := httptest.NewRequest("GET", "/test", nil)
		// Set both cookie and Bearer header - cookie should take precedence
		req.AddCookie(&http.Cookie{
			Name:  codersdk.SessionTokenCookie,
			Value: validToken,
		})
		req.Header.Set("Authorization", "Bearer invalid-token")
		rec := httptest.NewRecorder()
		handler.ServeHTTP(rec, req)

		require.Equal(t, http.StatusOK, rec.Code)
		require.Equal(t, key.ID, rec.Header().Get("X-Key-ID"))
	})

	t.Run("QueryParameterTakesPrecedenceOverBearer", func(t *testing.T) {
		// Set both query parameter and Bearer header - query should take precedence
		u, _ := url.Parse("/test")
		q := u.Query()
		q.Set(codersdk.SessionTokenCookie, validToken)
		u.RawQuery = q.Encode()

		req := httptest.NewRequest("GET", u.String(), nil)
		req.Header.Set("Authorization", "Bearer invalid-token")
		rec := httptest.NewRecorder()
		handler.ServeHTTP(rec, req)

		require.Equal(t, http.StatusOK, rec.Code)
		require.Equal(t, key.ID, rec.Header().Get("X-Key-ID"))
	})

	t.Run("BearerHeaderFallback", func(t *testing.T) {
		// Only set Bearer header - should be used as fallback
		req := httptest.NewRequest("GET", "/test", nil)
		req.Header.Set("Authorization", "Bearer "+validToken)
		rec := httptest.NewRecorder()