opencode/yao
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #1070 from trheyi/main

Browse source 
Refactor test user model and update subject references in tests
This commit is contained in:
Max 2025-08-02 18:58:49 +08:00 • committed by GitHub
commit 1ee0bf9653
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 237 additions and 184 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
openapi/oauth/core_test.go
View file

@ -369,7 +369,7 @@ func TestRefreshToken(t *testing.T) {
refreshToken := "test-refresh-token" refreshToken := "test-refresh-token"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
originalScope := "openid profile email" originalScope := "openid profile email"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store refresh token with scope using storeRefreshTokenWithScope // Store refresh token with scope using storeRefreshTokenWithScope
err := service.storeRefreshTokenWithScope(refreshToken, clientID, originalScope, subject) err := service.storeRefreshTokenWithScope(refreshToken, clientID, originalScope, subject)
@ -388,7 +388,7 @@ func TestRefreshToken(t *testing.T) {
refreshToken := "test-refresh-token-rotation" refreshToken := "test-refresh-token-rotation"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
originalScope := "openid profile" originalScope := "openid profile"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store refresh token with scope using storeRefreshTokenWithScope // Store refresh token with scope using storeRefreshTokenWithScope
err := service.storeRefreshTokenWithScope(refreshToken, clientID, originalScope, subject) err := service.storeRefreshTokenWithScope(refreshToken, clientID, originalScope, subject)
@ -440,7 +440,7 @@ func TestRefreshToken(t *testing.T) {
refreshToken := "test-refresh-token-invalid-scope" refreshToken := "test-refresh-token-invalid-scope"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
originalScope := "openid profile" // Original scope originalScope := "openid profile" // Original scope
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store refresh token with limited scope // Store refresh token with limited scope
err := service.storeRefreshTokenWithScope(refreshToken, clientID, originalScope, subject) err := service.storeRefreshTokenWithScope(refreshToken, clientID, originalScope, subject)
@ -487,7 +487,7 @@ func TestRotateRefreshToken(t *testing.T) {
oldToken := "old-refresh-token" oldToken := "old-refresh-token"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
originalScope := "openid profile" originalScope := "openid profile"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store old refresh token with scope using storeRefreshTokenWithScope // Store old refresh token with scope using storeRefreshTokenWithScope
err := service.storeRefreshTokenWithScope(oldToken, clientID, originalScope, subject) err := service.storeRefreshTokenWithScope(oldToken, clientID, originalScope, subject)
@ -648,7 +648,7 @@ func TestHandleRefreshTokenGrant(t *testing.T) {
refreshToken := "test-refresh-token-grant" refreshToken := "test-refresh-token-grant"
originalScope := "openid profile" originalScope := "openid profile"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store refresh token with scope using storeRefreshTokenWithScope // Store refresh token with scope using storeRefreshTokenWithScope
err := service.storeRefreshTokenWithScope(refreshToken, client.ClientID, originalScope, subject) err := service.storeRefreshTokenWithScope(refreshToken, client.ClientID, originalScope, subject)
@ -683,7 +683,7 @@ func TestHandleRefreshTokenGrant(t *testing.T) {
refreshToken := "test-refresh-token-no-rotation" refreshToken := "test-refresh-token-no-rotation"
originalScope := "openid profile" originalScope := "openid profile"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store refresh token with scope using storeRefreshTokenWithScope // Store refresh token with scope using storeRefreshTokenWithScope
err := service.storeRefreshTokenWithScope(refreshToken, client.ClientID, originalScope, subject) err := service.storeRefreshTokenWithScope(refreshToken, client.ClientID, originalScope, subject)

365
openapi/oauth/oauth_test.go
View file

@ -56,21 +56,23 @@ type TestClient struct {
// TestUser represents a test user // TestUser represents a test user
// AI: Use this standard test user structure for all OAuth functionality tests // AI: Use this standard test user structure for all OAuth functionality tests
// Updated to match the latest user model and provider interfaces
type TestUser struct { type TestUser struct {
ID int64 ID int64 `json:"id"` // Database ID (auto-generated)
Subject string UserID string `json:"user_id"` // Global unique user identifier (auto-generated)
Username string PreferredUsername string `json:"preferred_username"` // OIDC preferred username
Email string Email string `json:"email"` // OIDC email address
PasswordHash string Password string `json:"password"` // Plain password (will be hashed by Yao)
FirstName string Name string `json:"name"` // OIDC full name
LastName string GivenName string `json:"given_name"` // OIDC given name(s) or first name(s)
FullName string FamilyName string `json:"family_name"` // OIDC surname(s) or last name(s)
Scopes []string Status string `json:"status"` // User account status (pending, active, disabled, etc.)
Status string RoleID string `json:"role_id"` // User role identifier
EmailVerified bool TypeID string `json:"type_id"` // User type identifier
MobileVerified bool EmailVerified bool `json:"email_verified"` // OIDC email verification status
TwoFactorEnabled bool MFAEnabled bool `json:"mfa_enabled"` // Whether multi-factor authentication is enabled
Description string // For test identification Metadata map[string]interface{} `json:"metadata"` // Extended user metadata and custom fields
Description string `json:"description"` // For test identification
} }
// OAuth Test Environment Setup // OAuth Test Environment Setup
@ -120,156 +122,200 @@ var testClients = []*TestClient{
} }
// Test users - 10 users with different characteristics // Test users - 10 users with different characteristics
// Updated to match the latest user model and provider interfaces
var testUsers = []*TestUser{ var testUsers = []*TestUser{
{ {
Subject: "user-admin-001", UserID: "", // Will be auto-generated by CreateUser
Username: "admin", PreferredUsername: "admin",
Email: "admin@example.com", Email: "admin@example.com",
PasswordHash: "admin-hash-001", Password: "Admin123!@#", // Plain password (will be hashed by Yao)
FirstName: "Admin", Name: "Admin User",
LastName: "User", GivenName: "Admin",
FullName: "Admin User", FamilyName: "User",
Scopes: []string{"openid", "profile", "email", "admin"}, Status: "active",
Status: "active", RoleID: "admin", // Administrator role
EmailVerified: true, TypeID: "internal", // Internal user type
MobileVerified: true, EmailVerified: true,
TwoFactorEnabled: true, MFAEnabled: true,
Description: "Administrator user with full privileges", Metadata: map[string]interface{}{
"department": "IT",
"permissions": []string{"admin", "user_management", "system_config"},
},
Description: "Administrator user with full privileges",
}, },
{ {
Subject: "user-regular-001", UserID: "", // Will be auto-generated by CreateUser
Username: "john.doe", PreferredUsername: "john.doe",
Email: "john.doe@example.com", Email: "john.doe@example.com",
PasswordHash: "john-hash-001", Password: "JohnDoe123!",
FirstName: "John", Name: "John Doe",
LastName: "Doe", GivenName: "John",
FullName: "John Doe", FamilyName: "Doe",
Scopes: []string{"openid", "profile", "email"}, Status: "active",
Status: "active", RoleID: "user", // Regular user role
EmailVerified: true, TypeID: "external", // External user type
MobileVerified: false, EmailVerified: true,
TwoFactorEnabled: false, MFAEnabled: false,
Description: "Regular user with basic privileges", Metadata: map[string]interface{}{
"company": "Example Corp",
"job_title": "Software Engineer",
},
Description: "Regular user with basic privileges",
}, },
{ {
Subject: "user-regular-002", UserID: "", // Will be auto-generated by CreateUser
Username: "jane.smith", PreferredUsername: "jane.smith",
Email: "jane.smith@example.com", Email: "jane.smith@example.com",
PasswordHash: "jane-hash-001", Password: "JaneSmith456!",
FirstName: "Jane", Name: "Jane Smith",
LastName: "Smith", GivenName: "Jane",
FullName: "Jane Smith", FamilyName: "Smith",
Scopes: []string{"openid", "profile", "email"}, Status: "active",
Status: "active", RoleID: "user", // Regular user role
EmailVerified: true, TypeID: "external", // External user type
MobileVerified: true, EmailVerified: true,
TwoFactorEnabled: false, MFAEnabled: false,
Description: "Regular user with verified mobile", Metadata: map[string]interface{}{
"company": "Tech Solutions",
"job_title": "Product Manager",
"mobile_verified": true,
},
Description: "Regular user with verified mobile",
}, },
{ {
Subject: "user-pending-001", UserID: "", // Will be auto-generated by CreateUser
Username: "pending.user", PreferredUsername: "pending.user",
Email: "pending@example.com", Email: "pending@example.com",
PasswordHash: "pending-hash-001", Password: "Pending789!",
FirstName: "Pending", Name: "Pending User",
LastName: "User", GivenName: "Pending",
FullName: "Pending User", FamilyName: "User",
Scopes: []string{"openid", "profile"}, Status: "pending", // Awaiting verification
Status: "pending", RoleID: "user", // Regular user role
EmailVerified: false, TypeID: "external", // External user type
MobileVerified: false, EmailVerified: false,
TwoFactorEnabled: false, MFAEnabled: false,
Description: "User with pending verification", Metadata: map[string]interface{}{
"registration_source": "web_signup",
"verification_required": true,
},
Description: "User with pending verification",
}, },
{ {
Subject: "user-inactive-001", UserID: "", // Will be auto-generated by CreateUser
Username: "inactive.user", PreferredUsername: "inactive.user",
Email: "inactive@example.com", Email: "inactive@example.com",
PasswordHash: "inactive-hash-001", Password: "Inactive123!",
FirstName: "Inactive", Name: "Inactive User",
LastName: "User", GivenName: "Inactive",
FullName: "Inactive User", FamilyName: "User",
Scopes: []string{"openid"}, Status: "disabled", // Changed from "inactive" to match model enum
Status: "inactive", RoleID: "user", // Regular user role
EmailVerified: true, TypeID: "external", // External user type
MobileVerified: false, EmailVerified: true,
TwoFactorEnabled: false, MFAEnabled: false,
Description: "Inactive user account", Metadata: map[string]interface{}{
"deactivation_reason": "admin_action",
"deactivated_at": "2024-01-01T00:00:00Z",
},
Description: "Disabled user account",
}, },
{ {
Subject: "user-limited-001", UserID: "", // Will be auto-generated by CreateUser
Username: "limited.user", PreferredUsername: "limited.user",
Email: "limited@example.com", Email: "limited@example.com",
PasswordHash: "limited-hash-001", Password: "Limited456!",
FirstName: "Limited", Name: "Limited User",
LastName: "User", GivenName: "Limited",
FullName: "Limited User", FamilyName: "User",
Scopes: []string{"openid"}, Status: "active",
Status: "active", RoleID: "guest", // Limited guest role
EmailVerified: true, TypeID: "guest", // Guest user type
MobileVerified: false, EmailVerified: true,
TwoFactorEnabled: false, MFAEnabled: false,
Description: "User with limited scope access", Metadata: map[string]interface{}{
"access_level": "read_only",
"restrictions": []string{"no_data_export", "limited_api_access"},
},
Description: "User with limited access privileges",
}, },
{ {
Subject: "user-2fa-001", UserID: "", // Will be auto-generated by CreateUser
Username: "secure.user", PreferredUsername: "secure.user",
Email: "secure@example.com", Email: "secure@example.com",
PasswordHash: "secure-hash-001", Password: "SecureUser789!@#",
FirstName: "Secure", Name: "Secure User",
LastName: "User", GivenName: "Secure",
FullName: "Secure User", FamilyName: "User",
Scopes: []string{"openid", "profile", "email"}, Status: "active",
Status: "active", RoleID: "user", // Regular user role
EmailVerified: true, TypeID: "internal", // Internal user type
MobileVerified: true, EmailVerified: true,
TwoFactorEnabled: true, MFAEnabled: true, // Security-focused with MFA
Description: "Security-focused user with 2FA enabled", Metadata: map[string]interface{}{
"security_clearance": "high",
"department": "Security",
"mobile_verified": true,
},
Description: "Security-focused user with 2FA enabled",
}, },
{ {
Subject: "user-api-001", UserID: "", // Will be auto-generated by CreateUser
Username: "api.user", PreferredUsername: "api.user",
Email: "api@example.com", Email: "api@example.com",
PasswordHash: "api-hash-001", Password: "ApiUser123!@#",
FirstName: "API", Name: "API User",
LastName: "User", GivenName: "API",
FullName: "API User", FamilyName: "User",
Scopes: []string{"api:read", "api:write"}, Status: "active",
Status: "active", RoleID: "api", // API access role
EmailVerified: true, TypeID: "service", // Service account type
MobileVerified: false, EmailVerified: true,
TwoFactorEnabled: false, MFAEnabled: false, // Service accounts typically don't use MFA
Description: "User for API access testing", Metadata: map[string]interface{}{
"api_scopes": []string{"api:read", "api:write"},
"service_type": "automated_system",
},
Description: "User for API access testing",
}, },
{ {
Subject: "user-guest-001", UserID: "", // Will be auto-generated by CreateUser
Username: "guest.user", PreferredUsername: "guest.user",
Email: "guest@example.com", Email: "guest@example.com",
PasswordHash: "guest-hash-001", Password: "GuestUser456!",
FirstName: "Guest", Name: "Guest User",
LastName: "User", GivenName: "Guest",
FullName: "Guest User", FamilyName: "User",
Scopes: []string{"openid"}, Status: "active",
Status: "active", RoleID: "guest", // Guest role
EmailVerified: false, TypeID: "guest", // Guest user type
MobileVerified: false, EmailVerified: false, // Guests may not verify email
TwoFactorEnabled: false, MFAEnabled: false,
Description: "Guest user with minimal access", Metadata: map[string]interface{}{
"access_level": "minimal",
"temporary_access": true,
},
Description: "Guest user with minimal access",
}, },
{ {
Subject: "user-test-001", UserID: "", // Will be auto-generated by CreateUser
Username: "test.user", PreferredUsername: "test.user",
Email: "test@example.com", Email: "test@example.com",
PasswordHash: "test-hash-001", Password: "TestUser789!",
FirstName: "Test", Name: "Test User",
LastName: "User", GivenName: "Test",
FullName: "Test User", FamilyName: "User",
Scopes: []string{"openid", "profile", "email", "test"}, Status: "active",
Status: "active", RoleID: "user", // Regular user role
EmailVerified: true, TypeID: "external", // External user type
MobileVerified: true, EmailVerified: true,
TwoFactorEnabled: false, MFAEnabled: false,
Description: "General purpose test user", Metadata: map[string]interface{}{
"test_account": true,
"test_scopes": []string{"openid", "profile", "email", "test"},
"mobile_verified": true,
},
Description: "General purpose test user",
}, },
} }
@ -437,29 +483,31 @@ func setupTestData(t *testing.T, service *Service) {
t.Logf("Created test client: %s (%s)", testClient.ClientID, testClient.Description) t.Logf("Created test client: %s (%s)", testClient.ClientID, testClient.Description)
} }
// Create test users // Create test users using the updated user provider interface
userProvider := service.GetUserProvider() userProvider := service.GetUserProvider()
for i, testUser := range testUsers { for i, testUser := range testUsers {
// Convert TestUser to the format expected by CreateUser
userData := map[string]interface{}{ userData := map[string]interface{}{
"subject": testUser.Subject, // Note: user_id is auto-generated by CreateUser, don't include it
"username": testUser.Username, "preferred_username": testUser.PreferredUsername,
"email": testUser.Email, "email": testUser.Email,
"password_hash": testUser.PasswordHash, "password": testUser.Password, // Plain password (will be hashed by Yao)
"first_name": testUser.FirstName, "name": testUser.Name,
"last_name": testUser.LastName, "given_name": testUser.GivenName,
"full_name": testUser.FullName, "family_name": testUser.FamilyName,
"scopes": testUser.Scopes,
"status": testUser.Status, "status": testUser.Status,
"role_id": testUser.RoleID,
"type_id": testUser.TypeID,
"email_verified": testUser.EmailVerified, "email_verified": testUser.EmailVerified,
"mobile_verified": testUser.MobileVerified, "mfa_enabled": testUser.MFAEnabled,
"two_factor_enabled": testUser.TwoFactorEnabled, "metadata": testUser.Metadata,
} }
createdUserID, err := userProvider.CreateUser(ctx, userData) createdUserID, err := userProvider.CreateUser(ctx, userData)
require.NoError(t, err, "Failed to create test user %d: %s", i, testUser.Description) require.NoError(t, err, "Failed to create test user %d: %s", i, testUser.Description)
require.NotNil(t, createdUserID, "Created user ID should not be nil") require.NotNil(t, createdUserID, "Created user ID should not be nil")
// Update the test user with the created ID // Update the test user with the created database ID and auto-generated user_id
if userID, ok := createdUserID.(int64); ok { if userID, ok := createdUserID.(int64); ok {
testUser.ID = userID testUser.ID = userID
} else if userID, ok := createdUserID.(int); ok { } else if userID, ok := createdUserID.(int); ok {
@ -468,7 +516,12 @@ func setupTestData(t *testing.T, service *Service) {
testUser.ID = int64(0) // Fallback for interface{} types testUser.ID = int64(0) // Fallback for interface{} types
} }
t.Logf("Created test user: %s (%s)", testUser.Username, testUser.Description) // Extract the auto-generated user_id from userData (CreateUser sets it)
if generatedUserID, ok := userData["user_id"].(string); ok {
testUser.UserID = generatedUserID
}
t.Logf("Created test user: %s (ID: %s, %s)", testUser.PreferredUsername, testUser.UserID, testUser.Description)
} }
t.Logf("Test data setup complete: %d clients, %d users", len(testClients), len(testUsers)) t.Logf("Test data setup complete: %d clients, %d users", len(testClients), len(testUsers))

44
openapi/oauth/token_test.go
View file

@ -23,7 +23,7 @@ func TestIntrospect(t *testing.T) {
token := "test-active-token" token := "test-active-token"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
scope := "openid profile email" scope := "openid profile email"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store token using the updated method with expiresIn parameter // Store token using the updated method with expiresIn parameter
err := service.storeAccessToken(token, clientID, scope, subject, 3600) err := service.storeAccessToken(token, clientID, scope, subject, 3600)
@ -45,7 +45,7 @@ func TestIntrospect(t *testing.T) {
token := "test-expired-token" token := "test-expired-token"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
scope := "openid profile email" scope := "openid profile email"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store expired token with negative expiresIn (already expired) // Store expired token with negative expiresIn (already expired)
expiresIn := -3600 // Expired 1 hour ago expiresIn := -3600 // Expired 1 hour ago
@ -116,7 +116,7 @@ func TestTokenExchange(t *testing.T) {
subjectToken := "test-subject-token" subjectToken := "test-subject-token"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
scope := "openid profile email" scope := "openid profile email"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store subject token with expiresIn parameter // Store subject token with expiresIn parameter
err := service.storeAccessToken(subjectToken, clientID, scope, subject, 3600) err := service.storeAccessToken(subjectToken, clientID, scope, subject, 3600)
@ -170,7 +170,7 @@ func TestTokenExchange(t *testing.T) {
subjectToken := "test-inactive-token" subjectToken := "test-inactive-token"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
scope := "openid profile email" scope := "openid profile email"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store expired token with negative expiresIn // Store expired token with negative expiresIn
expiresIn := -3600 // Expired 1 hour ago expiresIn := -3600 // Expired 1 hour ago
@ -191,7 +191,7 @@ func TestTokenExchange(t *testing.T) {
subjectToken := "test-subject-token-aud" subjectToken := "test-subject-token-aud"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
scope := "openid profile email" scope := "openid profile email"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store subject token with expiresIn parameter // Store subject token with expiresIn parameter
err := service.storeAccessToken(subjectToken, clientID, scope, subject, 3600) err := service.storeAccessToken(subjectToken, clientID, scope, subject, 3600)
@ -209,7 +209,7 @@ func TestTokenExchange(t *testing.T) {
subjectToken := "test-subject-token-aud-empty" subjectToken := "test-subject-token-aud-empty"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
scope := "openid profile email" scope := "openid profile email"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store subject token with expiresIn parameter // Store subject token with expiresIn parameter
err := service.storeAccessToken(subjectToken, clientID, scope, subject, 3600) err := service.storeAccessToken(subjectToken, clientID, scope, subject, 3600)
@ -227,7 +227,7 @@ func TestTokenExchange(t *testing.T) {
subjectToken := "test-subject-token-scope" subjectToken := "test-subject-token-scope"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
scope := "openid profile email" scope := "openid profile email"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store subject token with expiresIn parameter // Store subject token with expiresIn parameter
err := service.storeAccessToken(subjectToken, clientID, scope, subject, 3600) err := service.storeAccessToken(subjectToken, clientID, scope, subject, 3600)
@ -243,7 +243,7 @@ func TestTokenExchange(t *testing.T) {
subjectToken := "test-inactive-subject-token" subjectToken := "test-inactive-subject-token"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
scope := "openid profile email" scope := "openid profile email"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store expired subject token with negative expiresIn // Store expired subject token with negative expiresIn
expiresIn := -3600 // Expired 1 hour ago expiresIn := -3600 // Expired 1 hour ago
@ -263,7 +263,7 @@ func TestTokenExchange(t *testing.T) {
subjectToken := "test-subject-token-minimal" subjectToken := "test-subject-token-minimal"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
scope := "openid profile email" scope := "openid profile email"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store subject token with expiresIn parameter // Store subject token with expiresIn parameter
err := service.storeAccessToken(subjectToken, clientID, scope, subject, 3600) err := service.storeAccessToken(subjectToken, clientID, scope, subject, 3600)
@ -296,7 +296,7 @@ func TestValidateTokenAudience(t *testing.T) {
expectedAudience := "https://api.example.com" expectedAudience := "https://api.example.com"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
scope := "openid profile email" scope := "openid profile email"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store token with expiresIn parameter // Store token with expiresIn parameter
err := service.storeAccessToken(token, clientID, scope, subject, 3600) err := service.storeAccessToken(token, clientID, scope, subject, 3600)
@ -314,7 +314,7 @@ func TestValidateTokenAudience(t *testing.T) {
expectedAudience := "https://api.example.com" expectedAudience := "https://api.example.com"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
scope := "openid profile email" scope := "openid profile email"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store token with expiresIn parameter // Store token with expiresIn parameter
err := service.storeAccessToken(token, clientID, scope, subject, 3600) err := service.storeAccessToken(token, clientID, scope, subject, 3600)
@ -332,7 +332,7 @@ func TestValidateTokenAudience(t *testing.T) {
expectedAudience := "https://api.example.com" expectedAudience := "https://api.example.com"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
scope := "openid profile email" scope := "openid profile email"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store token with expiresIn parameter // Store token with expiresIn parameter
err := service.storeAccessToken(token, clientID, scope, subject, 3600) err := service.storeAccessToken(token, clientID, scope, subject, 3600)
@ -350,7 +350,7 @@ func TestValidateTokenAudience(t *testing.T) {
expectedAudience := "https://api.example.com" expectedAudience := "https://api.example.com"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
scope := "openid profile email" scope := "openid profile email"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store expired token with negative expiresIn // Store expired token with negative expiresIn
expiresIn := -3600 // Expired 1 hour ago expiresIn := -3600 // Expired 1 hour ago
@ -410,7 +410,7 @@ func TestValidateTokenBinding(t *testing.T) {
token := "test-dpop-binding-token" token := "test-dpop-binding-token"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
scope := "openid profile email" scope := "openid profile email"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store token with expiresIn parameter // Store token with expiresIn parameter
err := service.storeAccessToken(token, clientID, scope, subject, 3600) err := service.storeAccessToken(token, clientID, scope, subject, 3600)
@ -431,7 +431,7 @@ func TestValidateTokenBinding(t *testing.T) {
token := "test-mtls-binding-token" token := "test-mtls-binding-token"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
scope := "openid profile email" scope := "openid profile email"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store token with expiresIn parameter // Store token with expiresIn parameter
err := service.storeAccessToken(token, clientID, scope, subject, 3600) err := service.storeAccessToken(token, clientID, scope, subject, 3600)
@ -452,7 +452,7 @@ func TestValidateTokenBinding(t *testing.T) {
token := "test-cert-binding-token" token := "test-cert-binding-token"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
scope := "openid profile email" scope := "openid profile email"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store token with expiresIn parameter // Store token with expiresIn parameter
err := service.storeAccessToken(token, clientID, scope, subject, 3600) err := service.storeAccessToken(token, clientID, scope, subject, 3600)
@ -473,7 +473,7 @@ func TestValidateTokenBinding(t *testing.T) {
token := "test-unknown-binding-token" token := "test-unknown-binding-token"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
scope := "openid profile email" scope := "openid profile email"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store token with expiresIn parameter // Store token with expiresIn parameter
err := service.storeAccessToken(token, clientID, scope, subject, 3600) err := service.storeAccessToken(token, clientID, scope, subject, 3600)
@ -494,7 +494,7 @@ func TestValidateTokenBinding(t *testing.T) {
token := "test-inactive-binding-token" token := "test-inactive-binding-token"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
scope := "openid profile email" scope := "openid profile email"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store expired token with negative expiresIn // Store expired token with negative expiresIn
expiresIn := -3600 // Expired 1 hour ago expiresIn := -3600 // Expired 1 hour ago
@ -573,7 +573,7 @@ func TestTokenGeneration(t *testing.T) {
t.Run("generate refresh token", func(t *testing.T) { t.Run("generate refresh token", func(t *testing.T) {
// Updated to use new generateRefreshToken signature with scope and subject // Updated to use new generateRefreshToken signature with scope and subject
token, err := service.generateRefreshToken(clientID, "openid profile", testUsers[0].Subject) token, err := service.generateRefreshToken(clientID, "openid profile", testUsers[0].UserID)
assert.NoError(t, err) assert.NoError(t, err)
assert.NotEmpty(t, token) assert.NotEmpty(t, token)
assert.True(t, strings.HasPrefix(token, "rfk_")) assert.True(t, strings.HasPrefix(token, "rfk_"))
@ -668,7 +668,7 @@ func TestTokenIntegration(t *testing.T) {
// Step 2: Store token data with expiresIn parameter // Step 2: Store token data with expiresIn parameter
scope := "openid profile email" scope := "openid profile email"
subject := testUsers[0].Subject subject := testUsers[0].UserID
err = service.storeAccessToken(accessToken, clientID, scope, subject, 3600) err = service.storeAccessToken(accessToken, clientID, scope, subject, 3600)
assert.NoError(t, err) assert.NoError(t, err)
@ -752,7 +752,7 @@ func TestTokenEdgeCases(t *testing.T) {
token := "test-malformed-token" token := "test-malformed-token"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
scope := "openid profile" scope := "openid profile"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store token with expiresIn parameter (it will handle data types correctly) // Store token with expiresIn parameter (it will handle data types correctly)
err := service.storeAccessToken(token, clientID, scope, subject, 3600) err := service.storeAccessToken(token, clientID, scope, subject, 3600)
@ -770,7 +770,7 @@ func TestTokenEdgeCases(t *testing.T) {
subjectToken := "test-long-audience-token" subjectToken := "test-long-audience-token"
clientID := testClients[0].ClientID clientID := testClients[0].ClientID
scope := "openid profile email" scope := "openid profile email"
subject := testUsers[0].Subject subject := testUsers[0].UserID
// Store subject token with expiresIn parameter // Store subject token with expiresIn parameter
err := service.storeAccessToken(subjectToken, clientID, scope, subject, 3600) err := service.storeAccessToken(subjectToken, clientID, scope, subject, 3600)