Function TestOIDCOauthLoginWithExisting

coderd/userauth_test.go:56–121

This test specifically tests logging in with OIDC when an expired OIDC session token exists. The token refreshing should not happen since we are reauthenticating. nolint:bodyclose

(t *testing.T)

// The token refreshing should not happen since we are reauthenticating.
// nolint:bodyclose
func TestOIDCOauthLoginWithExisting(t *testing.T) {
	t.Parallel()

	fake := oidctest.NewFakeIDP(t,
		oidctest.WithRefresh(func(_ string) error {
			return xerrors.New("refreshing token should never occur")
		}),
		oidctest.WithServing(),
	)

	cfg := fake.OIDCConfig(t, nil, func(cfg *coderd.OIDCConfig) {
		cfg.AllowSignups = true
		cfg.SecondaryClaims = coderd.MergedClaimsSourceNone
	})

	certificates := []tls.Certificate{testutil.GenerateTLSCertificate(t, "localhost")}
	client, _, api := coderdtest.NewWithAPI(t, &coderdtest.Options{
		OIDCConfig:      cfg,
		TLSCertificates: certificates,
		DeploymentValues: coderdtest.DeploymentValues(t, func(values *codersdk.DeploymentValues) {
			values.HTTPCookies = codersdk.HTTPCookieConfig{
				Secure:   true,
				SameSite: "none",
			}
		}),
	})

	const username = "alice"
	claims := jwt.MapClaims{
		"email":              "alice@coder.com",
		"email_verified":     true,
		"preferred_username": username,
		"sub":                uuid.NewString(),
	}

	// Signup alice
	freshClient := func() *codersdk.Client {
		cli := codersdk.New(client.URL)
		cli.HTTPClient.Transport = &http.Transport{
			TLSClientConfig: &tls.Config{
				//nolint:gosec
				InsecureSkipVerify: true,
			},
		}
		cli.HTTPClient.Jar = testjar.New()
		return cli
	}

	unauthenticated := freshClient()
	userClient, _ := fake.Login(t, unauthenticated, claims)

	cookies := unauthenticated.HTTPClient.Jar.Cookies(client.URL)
	require.True(t, len(cookies) > 0)
	for _, c := range cookies {
		require.Truef(t, c.Secure, "cookie %q", c.Name)
		require.Equalf(t, http.SameSiteNoneMode, c.SameSite, "cookie %q", c.Name)
	}