Function TestOAuth2PrivilegeEscalation

coderd/oauth2_security_test.go:204–311

TestOAuth2PrivilegeEscalation tests that clients cannot escalate their privileges

(t *testing.T)

// TestOAuth2PrivilegeEscalation tests that clients cannot escalate their privileges
func TestOAuth2PrivilegeEscalation(t *testing.T) {
	t.Parallel()

	t.Run("CannotEscalateScopeViaUpdate", func(t *testing.T) {
		t.Parallel()

		client := coderdtest.New(t, nil)
		_ = coderdtest.CreateFirstUser(t, client)
		ctx := t.Context()

		// Register a basic client
		clientName := fmt.Sprintf("test-client-%d", time.Now().UnixNano())
		regReq := codersdk.OAuth2ClientRegistrationRequest{
			RedirectURIs: []string{"https://example.com/callback"},
			ClientName:   clientName,
			Scope:        "read", // Limited scope
		}
		regResp, err := client.PostOAuth2ClientRegistration(ctx, regReq)
		require.NoError(t, err)

		// Try to escalate scope through update
		updateReq := codersdk.OAuth2ClientRegistrationRequest{
			RedirectURIs: []string{"https://example.com/callback"},
			ClientName:   clientName,
			Scope:        "read write admin", // Trying to escalate to admin
		}

		// This should succeed (scope changes are allowed in updates)
		// but the system should validate scope permissions appropriately
		updatedConfig, err := client.PutOAuth2ClientConfiguration(ctx, regResp.ClientID, regResp.RegistrationAccessToken, updateReq)
		if err == nil {
			// If update succeeds, verify the scope was set appropriately
			// (The actual scope validation would happen during token issuance)
			require.Contains(t, updatedConfig.Scope, "read")
		}
	})

	t.Run("CustomSchemeRedirectURIs", func(t *testing.T) {
		t.Parallel()

		client := coderdtest.New(t, nil)
		_ = coderdtest.CreateFirstUser(t, client)
		ctx := t.Context()

		// Test valid custom schemes per RFC 7591/8252
		validCustomSchemeRequests := []codersdk.OAuth2ClientRegistrationRequest{
			{
				RedirectURIs:            []string{"com.example.myapp://callback"},
				ClientName:              fmt.Sprintf("native-app-1-%d", time.Now().UnixNano()),
				TokenEndpointAuthMethod: "none", // Required for public clients using custom schemes
			},
			{
				RedirectURIs:            []string{"com.example.app://oauth"},
				ClientName:              fmt.Sprintf("native-app-2-%d", time.Now().UnixNano()),
				TokenEndpointAuthMethod: "none", // Required for public clients using custom schemes
			},
			{
				RedirectURIs:            []string{"urn:ietf:wg:oauth:2.0:oob"},