improve testing

Author: ndyakov

entraid_test.go

@@ -11,7 +11,7 @@ import (
 	"github.com/stretchr/testify/mock"
 )
 
-// testJWT token is a JWT token for testing
+// testJWTToken is a JWT token for testing
 //
 //	{
 //	 "iss": "test jwt",
@@ -21,8 +21,37 @@ import (
 //	 "sub": "[email protected]",
 //	 "oid": "test"
 //	}
+//
+// key: qwertyuiopasdfghjklzxcvbnm123456
 const testJWTtoken = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJ0ZXN0IGp3dCIsImlhdCI6MTc0MzUxNTAxMSwiZXhwIjoxNzc1MDUxMDExLCJhdWQiOiJ3d3cuZXhhbXBsZS5jb20iLCJzdWIiOiJ0ZXN0QHRlc3QuY29tIiwib2lkIjoidGVzdCJ9.6RG721V2eFlSLsCRmo53kSRRrTZIe1UPdLZCUEvIarU"
 
+// testJWTExpiredToken is an expired JWT token for testing
+//
+// {
+// "iss": "test jwt",
+// "iat": 1617795148,
+// "exp": 1617795148,
+// "aud": "www.example.com",
+// "sub": "[email protected]",
+// "oid": "test"
+// }
+//
+// key: qwertyuiopasdfghjklzxcvbnm123456
+const testJWTExpiredToken = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJ0ZXN0IGp3dCIsImlhdCI6MTYxNzc5NTE0OCwiZXhwIjoxNjE3Nzk1MTQ4LCJhdWQiOiJ3d3cuZXhhbXBsZS5jb20iLCJzdWIiOiJ0ZXN0QHRlc3QuY29tIiwib2lkIjoidGVzdCJ9.IbGPhHRiPYcpUDrhAPf4h3gH1XXBOu560NYT59rUMzc"
+
+// testJWTWithZeroExpiryToken is a JWT token with zero expiry for testing
+//
+// {
+// "iss": "test jwt",
+// "iat": 1744025944,
+// "exp": null,
+// "aud": "www.example.com",
+// "sub": "[email protected]",
+// "oid": "test"
+// }
+// key: qwertyuiopasdfghjklzxcvbnm123456
+const testJWTWithZeroExpiryToken = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJ0ZXN0IGp3dCIsImlhdCI6MTc0NDAyNTk0NCwiZXhwIjpudWxsLCJhdWQiOiJ3d3cuZXhhbXBsZS5jb20iLCJzdWIiOiJ0ZXN0QHRlc3QuY29tIiwib2lkIjoidGVzdCJ9.bLSANIzawE5Y6rgspvvUaRhkBq6Y4E0ggjXlmHRn8ew"
+
 var testTokenValid = NewToken(
 	"test",
 	"password",

token_manager.go

@@ -127,7 +127,7 @@ func (*defaultIdentityProviderResponseParser) ParseResponse(response IdentityPro
 		username = claims.Oid
 		password = rawToken
 
-		if expiresOn.IsZero() {
+		if expiresOn.IsZero() && claims.ExpiresAt != nil {
 			expiresOn = claims.ExpiresAt.Time
 		}
 
@@ -146,7 +146,7 @@ func (*defaultIdentityProviderResponseParser) ParseResponse(response IdentityPro
 	}
 
 	if time.Until(expiresOn) < MinTokenTTL {
-		return nil, fmt.Errorf("expires on is less than minimum token TTL which is %d", MinTokenTTL)
+		return nil, fmt.Errorf("expires on is less than minimum token TTL which is %s", MinTokenTTL)
 	}
 	// parse token as jwt token and get claims
 

token_manager_test.go

@@ -423,6 +423,22 @@ func TestDefaultIdentityProviderResponseParser(t *testing.T) {
 		assert.NotNil(t, token)
 	})
 
+	t.Run("Default IdentityProviderResponseParser with expired JWT Token", func(t *testing.T) {
+		idpResponse, err := NewIDPResponse(ResponseTypeRawToken, testJWTExpiredToken)
+		assert.NoError(t, err)
+		token, err := parser.ParseResponse(idpResponse)
+		assert.Error(t, err)
+		assert.Nil(t, token)
+	})
+
+	t.Run("Default IdentityProviderResponseParser with zero expiry JWT Token", func(t *testing.T) {
+		idpResponse, err := NewIDPResponse(ResponseTypeRawToken, testJWTWithZeroExpiryToken)
+		assert.NoError(t, err)
+		token, err := parser.ParseResponse(idpResponse)
+		assert.Error(t, err)
+		assert.Nil(t, token)
+	})
+
 	t.Run("NewIDPResponse with type Unknown", func(t *testing.T) {
 		idpResponse, err := NewIDPResponse("Unknown", testJWTtoken)
 		assert.Error(t, err)
@@ -567,3 +583,42 @@ func TestEntraidTokenManager_GetToken(t *testing.T) {
 
 	})
 }
+
+func TestEntraidTokenManager_durationToRenewal(t *testing.T) {
+	// Test the durationToRenewal function
+	t.Parallel()
+	t.Run("durationToRenewal", func(t *testing.T) {
+		idp := &mockIdentityProvider{}
+		tokenManager, err := NewTokenManager(idp, TokenManagerOptions{
+			LowerRefreshBoundMs: 1000 * 60 * 60, // 1 hour
+
+		})
+		assert.NoError(t, err)
+		assert.NotNil(t, tokenManager)
+		tm, ok := tokenManager.(*entraidTokenManager)
+		assert.True(t, ok)
+
+		result := tm.durationToRenewal()
+		// returns 0 for nil token
+		assert.Equal(t, time.Duration(0), result)
+
+		// get token that expires before the lower bound
+		assert.NotPanics(t, func() {
+			expiresSoon := &public.AuthResult{
+				ExpiresOn: time.Now().Add(time.Duration(tm.lowerBoundDuration) - time.Minute).UTC(),
+			}
+			idpResponse, err := NewIDPResponse(ResponseTypeAuthResult,
+				expiresSoon)
+			assert.NoError(t, err)
+			idp.On("RequestToken").Return(idpResponse, nil)
+
+			_, err = tm.GetToken()
+			assert.NoError(t, err)
+			assert.NotNil(t, tm.token)
+		})
+
+		// return the lower bound
+		result = tm.durationToRenewal()
+		assert.Equal(t, tm.lowerBoundDuration, result)
+	})
+}