Function TestOAuth2ConcurrentSecurityOperations

coderd/oauth2_security_test.go:397–527

TestOAuth2ConcurrentSecurityOperations tests security under concurrent operations

(t *testing.T)

// TestOAuth2ConcurrentSecurityOperations tests security under concurrent operations
func TestOAuth2ConcurrentSecurityOperations(t *testing.T) {
	t.Parallel()

	client := coderdtest.New(t, nil)
	_ = coderdtest.CreateFirstUser(t, client)

	ctx := t.Context()

	// Register a client for testing
	clientName := fmt.Sprintf("test-client-%d", time.Now().UnixNano())
	regReq := codersdk.OAuth2ClientRegistrationRequest{
		RedirectURIs: []string{"https://example.com/callback"},
		ClientName:   clientName,
	}
	regResp, err := client.PostOAuth2ClientRegistration(ctx, regReq)
	require.NoError(t, err)

	t.Run("ConcurrentAccessAttempts", func(t *testing.T) {
		t.Parallel()
		ctx := t.Context()

		const numGoroutines = 20
		var wg sync.WaitGroup
		errors := make([]error, numGoroutines)

		// Launch concurrent attempts to access the client configuration
		for i := 0; i < numGoroutines; i++ {
			wg.Add(1)
			go func(index int) {
				defer wg.Done()

				_, err := client.GetOAuth2ClientConfiguration(ctx, regResp.ClientID, regResp.RegistrationAccessToken)
				errors[index] = err
			}(i)
		}

		wg.Wait()

		// All requests should succeed (they're all valid)
		for i, err := range errors {
			require.NoError(t, err, "Request %d failed", i)
		}
	})

	t.Run("ConcurrentInvalidAccessAttempts", func(t *testing.T) {
		t.Parallel()
		ctx := t.Context()

		const numGoroutines = 20
		var wg sync.WaitGroup
		statusCodes := make([]int, numGoroutines)

		// Launch concurrent attempts with invalid tokens
		for i := 0; i < numGoroutines; i++ {
			wg.Add(1)
			go func(index int) {
				defer wg.Done()