| 16 | ) |
| 17 | |
| 18 | func TestOAuth2AuthorizationServerMetadata(t *testing.T) { |
| 19 | t.Parallel() |
| 20 | |
| 21 | client := coderdtest.New(t, nil) |
| 22 | serverURL := client.URL |
| 23 | |
| 24 | ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong) |
| 25 | defer cancel() |
| 26 | |
| 27 | // Use a plain HTTP client since this endpoint doesn't require authentication |
| 28 | endpoint := serverURL.ResolveReference(&url.URL{Path: "/.well-known/oauth-authorization-server"}).String() |
| 29 | req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil) |
| 30 | require.NoError(t, err) |
| 31 | |
| 32 | httpClient := &http.Client{} |
| 33 | resp, err := httpClient.Do(req) |
| 34 | require.NoError(t, err) |
| 35 | defer resp.Body.Close() |
| 36 | |
| 37 | require.Equal(t, http.StatusOK, resp.StatusCode) |
| 38 | |
| 39 | var metadata codersdk.OAuth2AuthorizationServerMetadata |
| 40 | err = json.NewDecoder(resp.Body).Decode(&metadata) |
| 41 | require.NoError(t, err) |
| 42 | |
| 43 | // Verify the metadata |
| 44 | require.NotEmpty(t, metadata.Issuer) |
| 45 | require.NotEmpty(t, metadata.AuthorizationEndpoint) |
| 46 | require.NotEmpty(t, metadata.TokenEndpoint) |
| 47 | require.Contains(t, metadata.ResponseTypesSupported, codersdk.OAuth2ProviderResponseTypeCode) |
| 48 | require.Contains(t, metadata.GrantTypesSupported, codersdk.OAuth2ProviderGrantTypeAuthorizationCode) |
| 49 | require.Contains(t, metadata.GrantTypesSupported, codersdk.OAuth2ProviderGrantTypeRefreshToken) |
| 50 | require.Contains(t, metadata.CodeChallengeMethodsSupported, codersdk.OAuth2PKCECodeChallengeMethodS256) |
| 51 | // Supported scopes are published from the curated catalog |
| 52 | require.Equal(t, rbac.ExternalScopeNames(), metadata.ScopesSupported) |
| 53 | } |
| 54 | |
| 55 | func TestOAuth2ProtectedResourceMetadata(t *testing.T) { |
| 56 | t.Parallel() |