Function TestOAuth2RegistrationTokenSecurity

coderd/oauth2_security_test.go:104–201

TestOAuth2RegistrationTokenSecurity tests security aspects of registration access tokens

(t *testing.T)

// TestOAuth2RegistrationTokenSecurity tests security aspects of registration access tokens
func TestOAuth2RegistrationTokenSecurity(t *testing.T) {
	t.Parallel()

	// Single instance shared across all sub-tests. Each registers
	// independent OAuth2 apps with unique client names.
	client := coderdtest.New(t, nil)
	_ = coderdtest.CreateFirstUser(t, client)

	t.Run("InvalidTokenFormats", func(t *testing.T) {
		t.Parallel()

		ctx := t.Context()

		// Register a client to use for testing
		clientName := fmt.Sprintf("test-client-%s-%d", t.Name(), time.Now().UnixNano())
		regReq := codersdk.OAuth2ClientRegistrationRequest{
			RedirectURIs: []string{"https://example.com/callback"},
			ClientName:   clientName,
		}
		regResp, err := client.PostOAuth2ClientRegistration(ctx, regReq)
		require.NoError(t, err)

		invalidTokens := []string{
			"",                        // Empty token
			"invalid",                 // Too short
			"not-base64-!@#$%^&*",     // Invalid characters
			strings.Repeat("a", 1000), // Too long
			"Bearer " + regResp.RegistrationAccessToken, // With Bearer prefix (incorrect)
		}

		for i, token := range invalidTokens {
			t.Run(fmt.Sprintf("InvalidToken_%d", i), func(t *testing.T) {
				t.Parallel()

				_, err := client.GetOAuth2ClientConfiguration(ctx, regResp.ClientID, token)
				require.Error(t, err)

				var httpErr *codersdk.Error
				require.ErrorAs(t, err, &httpErr)
				require.Equal(t, http.StatusUnauthorized, httpErr.StatusCode())
			})
		}
	})

	t.Run("TokenNotReusableAcrossClients", func(t *testing.T) {
		t.Parallel()

		ctx := t.Context()

		// Register first client
		client1Name := fmt.Sprintf("test-client-1-%s-%d", t.Name(), time.Now().UnixNano())
		regReq1 := codersdk.OAuth2ClientRegistrationRequest{
			RedirectURIs: []string{"https://example.com/callback"},
			ClientName:   client1Name,
		}
		regResp1, err := client.PostOAuth2ClientRegistration(ctx, regReq1)
		require.NoError(t, err)