addressing comments

Author: Hockenba

lua-resty-openidc-1.9.0-1.rockspec

@@ -24,7 +24,7 @@ description = {
 dependencies = {
     "lua >= 5.1",
     "lua-resty-http >= 0.08",
-    "lua-resty-session >= 4.2.0",
+    "lua-resty-session = 4.2.0",
     "lua-resty-jwt >= 0.2.0",
     "lua-resty-openssl >= 1.8.0"
 }

tests/spec/access_token_access_spec.lua

@@ -39,6 +39,35 @@ describe("if there is an active non-expired login", function()
   end)
 end)
 
+describe("if revocation_fail_mode is closed and the revocation store read fails", function()
+  test_support.start_server({
+    revocation_test = {
+      fail_mode = "closed",
+      get_fails_after = 1,
+    },
+  })
+  teardown(test_support.stop_server)
+
+  local _, _, cookies = test_support.login()
+  local content_table = {}
+  local _, status = http.request({
+    url = "http://localhost/access_token",
+    redirect = false,
+    headers = { cookie = cookies },
+    sink = ltn12.sink.table(content_table)
+  })
+  local body = table.concat(content_table)
+
+  it("returns the session start failure", function()
+    assert.are.equals(401, status)
+    assert.truthy(string.find(body, "unable to check session revocation", 1, true))
+  end)
+
+  it("does not return the access token", function()
+    assert.is_nil(string.find(body, "a_token", 1, true))
+  end)
+end)
+
 describe("if there is an active non-expired login but access token is not stored in session", function()
   test_support.start_server({
     access_token_opts = {

tests/spec/logout_revocation_spec.lua

@@ -3,6 +3,36 @@ local ltn12 = require("ltn12")
 local test_support = require("test_support")
 require 'busted.runner'()
 
+describe("when revocation_fail_mode is closed and the revocation store read fails", function()
+  test_support.start_server({
+    revocation_test = {
+      fail_mode = "closed",
+      get_fails_after = 1,
+    },
+  })
+  teardown(test_support.stop_server)
+
+  local _, _, cookie = test_support.login()
+
+  local response_body = {}
+  local _, status = http.request({
+    url = "http://127.0.0.1/default/t",
+    headers = { cookie = cookie },
+    redirect = false,
+    sink = ltn12.sink.table(response_body),
+  })
+  local body = table.concat(response_body)
+
+  it("propagates the session start failure", function()
+    assert.are.equals(401, status)
+    assert.truthy(string.find(body, "unable to check session revocation", 1, true))
+  end)
+
+  it("does not authenticate the request", function()
+    assert.is_nil(string.find(body, "hello, world!", 1, true))
+  end)
+end)
+
 describe("when revocation_fail_mode is closed and the revocation store is unreachable during logout", function()
   test_support.start_server({
     revocation_test = {

tests/spec/test_support.lua

@@ -98,6 +98,7 @@ local DEFAULT_DELAY_RESPONSE = "0"
 local DEFAULT_REVOCATION_TEST_ENABLED = "false"
 local DEFAULT_REVOCATION_FAIL_MODE = '"closed"'
 local DEFAULT_REVOCATION_SET_FAILS = "false"
+local DEFAULT_REVOCATION_GET_FAILS_AFTER = "nil"
 
 local DEFAULT_INIT_TEMPLATE = [[
 local test_globals = {}
@@ -165,6 +166,10 @@ if REVOCATION_TEST_ENABLED then
         return true
       end,
       get = function(_, key)
+        local calls = revoked:incr("get_calls", 1, 0)
+        if REVOCATION_GET_FAILS_AFTER and calls > REVOCATION_GET_FAILS_AFTER then
+          return nil, "connection refused"
+        end
         return revoked:get(key)
       end,
     },
@@ -539,10 +544,11 @@ http {
 
         location /access_token {
             content_by_lua_block {
-                local access_token, err = test_globals.oidc.access_token(ACCESS_TOKEN_OPTS)
+                local access_token, err = test_globals.oidc.access_token(ACCESS_TOKEN_OPTS, test_globals.session_opts)
                 if not access_token then
                   ngx.status = 401
                   ngx.log(ngx.ERR, "access_token error: " .. (err or 'no message'))
+                  ngx.say("access_token failed: " .. (err or 'no message'))
                 else
                   ngx.header.content_type = 'text/plain'
                   ngx.say(access_token)
@@ -684,6 +690,8 @@ local function write_template(out, template, custom_config)
       ('"' .. (custom_config["revocation_test"].fail_mode or "closed") .. '"') or DEFAULT_REVOCATION_FAIL_MODE)
     :gsub("REVOCATION_SET_FAILS", custom_config["revocation_test"] and
       (custom_config["revocation_test"].set_fails and "true" or "false") or DEFAULT_REVOCATION_SET_FAILS)
+    :gsub("REVOCATION_GET_FAILS_AFTER", custom_config["revocation_test"] and
+      tostring(custom_config["revocation_test"].get_fails_after) or DEFAULT_REVOCATION_GET_FAILS_AFTER)
   out:write(content)
 end