Skip to content

Commit 0ff401b

Browse files
jaredhansonjaredhanson
committed
Clarify test cases.
1 parent 705db83 commit 0ff401b

File tree

2 files changed

+284
-0
lines changed

2 files changed

+284
-0
lines changed

‎test/oauth2.state.session.test.js

Lines changed: 277 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,277 @@
1+
var OAuth2Strategy = require('../lib/strategy')
2+
, AuthorizationError = require('../lib/errors/authorizationerror')
3+
, TokenError = require('../lib/errors/tokenerror')
4+
, InternalOAuthError = require('../lib/errors/internaloautherror')
5+
, chai = require('chai')
6+
, uri = require('url');
7+
8+
9+
describe('OAuth2Strategy', function() {
10+
11+
describe('using default session state store', function() {
12+
13+
describe('issuing authorization request', function() {
14+
var strategy = new OAuth2Strategy({
15+
authorizationURL: 'https://www.example.com/oauth2/authorize',
16+
tokenURL: 'https://www.example.com/oauth2/token',
17+
clientID: 'ABC123',
18+
clientSecret: 'secret',
19+
callbackURL: 'https://www.example.net/auth/example/callback',
20+
state: true
21+
},
22+
function(accessToken, refreshToken, profile, done) {});
23+
24+
25+
describe('that redirects to service provider', function() {
26+
var request, url;
27+
28+
before(function(done) {
29+
chai.passport.use(strategy)
30+
.redirect(function(u) {
31+
url = u;
32+
done();
33+
})
34+
.req(function(req) {
35+
request = req;
36+
req.session = {};
37+
})
38+
.authenticate();
39+
});
40+
41+
it('should be redirected', function() {
42+
var u = uri.parse(url, true);
43+
expect(u.query.state).to.have.length(24);
44+
});
45+
46+
it('should save state in session', function() {
47+
var u = uri.parse(url, true);
48+
49+
expect(request.session['oauth2:www.example.com'].state).to.have.length(24);
50+
expect(request.session['oauth2:www.example.com'].state).to.equal(u.query.state);
51+
});
52+
}); // that redirects to service provider
53+
54+
describe('that errors due to lack of session support in app', function() {
55+
var request, err;
56+
57+
before(function(done) {
58+
chai.passport.use(strategy)
59+
.error(function(e) {
60+
err = e;
61+
done();
62+
})
63+
.req(function(req) {
64+
request = req;
65+
})
66+
.authenticate();
67+
});
68+
69+
it('should error', function() {
70+
expect(err).to.be.an.instanceof(Error)
71+
expect(err.message).to.equal('OAuth2Strategy requires session support when using state. Did you forget app.use(express.session(...))?');
72+
});
73+
}); // that errors due to lack of session support in app
74+
75+
}); // issuing authorization request
76+
77+
describe('processing response to authorization request', function() {
78+
var strategy = new OAuth2Strategy({
79+
authorizationURL: 'https://www.example.com/oauth2/authorize',
80+
tokenURL: 'https://www.example.com/oauth2/token',
81+
clientID: 'ABC123',
82+
clientSecret: 'secret',
83+
callbackURL: 'https://www.example.net/auth/example/callback',
84+
state: true
85+
},
86+
function(accessToken, refreshToken, profile, done) {
87+
if (accessToken !== '2YotnFZFEjr1zCsicMWpAA') { return done(new Error('incorrect accessToken argument')); }
88+
if (refreshToken !== 'tGzv3JOkF0XG5Qx2TlKWIA') { return done(new Error('incorrect refreshToken argument')); }
89+
if (typeof profile !== 'object') { return done(new Error('incorrect profile argument')); }
90+
if (Object.keys(profile).length !== 0) { return done(new Error('incorrect profile argument')); }
91+
92+
return done(null, { id: '1234' }, { message: 'Hello' });
93+
});
94+
95+
strategy._oauth2.getOAuthAccessToken = function(code, options, callback) {
96+
if (code !== 'SplxlOBeZQQYbYS6WxSbIA') { return callback(new Error('incorrect code argument')); }
97+
if (options.grant_type !== 'authorization_code') { return callback(new Error('incorrect options.grant_type argument')); }
98+
if (options.redirect_uri !== 'https://www.example.net/auth/example/callback') { return callback(new Error('incorrect options.redirect_uri argument')); }
99+
100+
return callback(null, '2YotnFZFEjr1zCsicMWpAA', 'tGzv3JOkF0XG5Qx2TlKWIA', { token_type: 'example' });
101+
}
102+
103+
104+
describe('that was approved', function() {
105+
var request
106+
, user
107+
, info;
108+
109+
before(function(done) {
110+
chai.passport.use(strategy)
111+
.success(function(u, i) {
112+
user = u;
113+
info = i;
114+
done();
115+
})
116+
.req(function(req) {
117+
request = req;
118+
119+
req.query = {};
120+
req.query.code = 'SplxlOBeZQQYbYS6WxSbIA';
121+
req.query.state = 'DkbychwKu8kBaJoLE5yeR5NK';
122+
req.session = {};
123+
req.session['oauth2:www.example.com'] = {};
124+
req.session['oauth2:www.example.com']['state'] = 'DkbychwKu8kBaJoLE5yeR5NK';
125+
})
126+
.authenticate();
127+
});
128+
129+
it('should supply user', function() {
130+
expect(user).to.be.an.object;
131+
expect(user.id).to.equal('1234');
132+
});
133+
134+
it('should supply info', function() {
135+
expect(info).to.be.an.object;
136+
expect(info.message).to.equal('Hello');
137+
});
138+
139+
it('should remove state from session', function() {
140+
expect(request.session['oauth2:www.example.com']).to.be.undefined;
141+
});
142+
}); // that was approved
143+
144+
describe('that fails due to state being invalid', function() {
145+
var request
146+
, info, status;
147+
148+
before(function(done) {
149+
chai.passport.use(strategy)
150+
.fail(function(i, s) {
151+
info = i;
152+
status = s;
153+
done();
154+
})
155+
.req(function(req) {
156+
request = req;
157+
158+
req.query = {};
159+
req.query.code = 'SplxlOBeZQQYbYS6WxSbIA';
160+
req.query.state = 'DkbychwKu8kBaJoLE5yeR5NK-WRONG';
161+
req.session = {};
162+
req.session['oauth2:www.example.com'] = {};
163+
req.session['oauth2:www.example.com']['state'] = 'DkbychwKu8kBaJoLE5yeR5NK';
164+
})
165+
.authenticate();
166+
});
167+
168+
it('should supply info', function() {
169+
expect(info).to.be.an.object;
170+
expect(info.message).to.equal('Invalid authorization request state.');
171+
});
172+
173+
it('should supply status', function() {
174+
expect(status).to.equal(403);
175+
});
176+
177+
it('should remove state from session', function() {
178+
expect(request.session['oauth2:www.example.com']).to.be.undefined;
179+
});
180+
}); // that fails due to state being invalid
181+
182+
describe('that fails due to provider-specific state not found in session', function() {
183+
var request
184+
, info, status;
185+
186+
before(function(done) {
187+
chai.passport.use(strategy)
188+
.fail(function(i, s) {
189+
info = i;
190+
status = s;
191+
done();
192+
})
193+
.req(function(req) {
194+
request = req;
195+
196+
req.query = {};
197+
req.query.code = 'SplxlOBeZQQYbYS6WxSbIA';
198+
req.query.state = 'DkbychwKu8kBaJoLE5yeR5NK';
199+
req.session = {};
200+
})
201+
.authenticate();
202+
});
203+
204+
it('should supply info', function() {
205+
expect(info).to.be.an.object;
206+
expect(info.message).to.equal('Unable to verify authorization request state.');
207+
});
208+
209+
it('should supply status', function() {
210+
expect(status).to.equal(403);
211+
});
212+
}); // that fails due to state not found in session
213+
214+
describe('that fails due to provider-specific state lacking state value', function() {
215+
var request
216+
, info, status;
217+
218+
before(function(done) {
219+
chai.passport.use(strategy)
220+
.fail(function(i, s) {
221+
info = i;
222+
status = s;
223+
done();
224+
})
225+
.req(function(req) {
226+
request = req;
227+
228+
req.query = {};
229+
req.query.code = 'SplxlOBeZQQYbYS6WxSbIA';
230+
req.query.state = 'DkbychwKu8kBaJoLE5yeR5NK';
231+
req.session = {};
232+
req.session['oauth2:www.example.com'] = {};
233+
})
234+
.authenticate();
235+
});
236+
237+
it('should supply info', function() {
238+
expect(info).to.be.an.object;
239+
expect(info.message).to.equal('Unable to verify authorization request state.');
240+
});
241+
242+
it('should supply status', function() {
243+
expect(status).to.equal(403);
244+
});
245+
}); // that fails due to provider-specific state lacking state value
246+
247+
describe('that errors due to lack of session support in app', function() {
248+
var request
249+
, err;
250+
251+
before(function(done) {
252+
chai.passport.use(strategy)
253+
.error(function(e) {
254+
err = e;
255+
done();
256+
})
257+
.req(function(req) {
258+
request = req;
259+
260+
req.query = {};
261+
req.query.code = 'SplxlOBeZQQYbYS6WxSbIA';
262+
req.query.state = 'DkbychwKu8kBaJoLE5yeR5NK';
263+
})
264+
.authenticate();
265+
});
266+
267+
it('should error', function() {
268+
expect(err).to.be.an.instanceof(Error)
269+
expect(err.message).to.equal('OAuth2Strategy requires session support when using state. Did you forget app.use(express.session(...))?');
270+
});
271+
}); // that errors due to lack of session support in app
272+
273+
}); // processing response to authorization request
274+
275+
}); // using default session state store
276+
277+
});

‎test/oauth2.state.test.js

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ describe('OAuth2Strategy', function() {
3232
}
3333
}
3434

35+
// OK
3536
describe('handling an authorized return request with correct state', function() {
3637
var request
3738
, user
@@ -72,6 +73,7 @@ describe('OAuth2Strategy', function() {
7273
});
7374
});
7475

76+
// OK
7577
describe('handling an authorized return request with incorrect state', function() {
7678
var request
7779
, info, status;
@@ -110,6 +112,7 @@ describe('OAuth2Strategy', function() {
110112
});
111113
});
112114

115+
// OK
113116
describe('handling an authorized return request with session that lacks key', function() {
114117
var request
115118
, info, status;
@@ -142,6 +145,7 @@ describe('OAuth2Strategy', function() {
142145
});
143146
});
144147

148+
// OK
145149
describe('handling an authorized return request with session that has key but no state', function() {
146150
var request
147151
, info, status;
@@ -175,6 +179,7 @@ describe('OAuth2Strategy', function() {
175179
});
176180
});
177181

182+
// OK
178183
describe('handling an authorized return request without session', function() {
179184
var request
180185
, err;
@@ -201,6 +206,7 @@ describe('OAuth2Strategy', function() {
201206
});
202207
});
203208

209+
// OK
204210
describe('handling a request to be redirected for authorization', function() {
205211
var request, url;
206212

@@ -230,6 +236,7 @@ describe('OAuth2Strategy', function() {
230236
});
231237
});
232238

239+
// OK
233240
describe('handling a request without session to be redirected for authorization', function() {
234241
var request, err;
235242

0 commit comments

Comments
 (0)