|
1 | 1 | package auth |
2 | 2 |
|
3 | 3 | import ( |
| 4 | + "encoding/json" |
| 5 | + "net/http" |
| 6 | + "net/http/httptest" |
4 | 7 | "os" |
5 | 8 | "path/filepath" |
6 | 9 | "testing" |
| 10 | + "time" |
7 | 11 |
|
8 | 12 | "github.com/stretchr/testify/assert" |
9 | 13 | "github.com/stretchr/testify/require" |
@@ -209,6 +213,89 @@ func TestWithAppName(t *testing.T) { |
209 | 213 | assert.Equal(t, "other-secret", a.clientSecret) |
210 | 214 | } |
211 | 215 |
|
| 216 | +func TestWithAppNameOverridesEnvCredentials(t *testing.T) { |
| 217 | + tempDir, err := os.MkdirTemp("", "xurl_auth_test") |
| 218 | + require.NoError(t, err) |
| 219 | + defer os.RemoveAll(tempDir) |
| 220 | + t.Setenv("HOME", tempDir) |
| 221 | + |
| 222 | + tokenStore, tsDir := createTempTokenStore(t) |
| 223 | + defer os.RemoveAll(tsDir) |
| 224 | + tokenStore.AddApp("my-app", "app-id", "app-secret") |
| 225 | + |
| 226 | + // Simulate env vars being set at startup |
| 227 | + cfg := &config.Config{ClientID: "env-id", ClientSecret: "env-secret"} |
| 228 | + a := NewAuth(cfg).WithTokenStore(tokenStore) |
| 229 | + assert.Equal(t, "env-id", a.clientID) |
| 230 | + |
| 231 | + // --app override should replace env-var credentials with the named app's |
| 232 | + a.WithAppName("my-app") |
| 233 | + assert.Equal(t, "app-id", a.clientID) |
| 234 | + assert.Equal(t, "app-secret", a.clientSecret) |
| 235 | +} |
| 236 | + |
| 237 | +func TestAppFlagTokenIsolation(t *testing.T) { |
| 238 | + tempDir, err := os.MkdirTemp("", "xurl_auth_test") |
| 239 | + require.NoError(t, err) |
| 240 | + defer os.RemoveAll(tempDir) |
| 241 | + t.Setenv("HOME", tempDir) |
| 242 | + |
| 243 | + tokenStore, tsDir := createTempTokenStore(t) |
| 244 | + defer os.RemoveAll(tsDir) |
| 245 | + |
| 246 | + tokenStore.AddApp("app-a", "id-a", "secret-a") |
| 247 | + tokenStore.AddApp("app-b", "id-b", "secret-b") |
| 248 | + |
| 249 | + // Save a bearer token only in app-a |
| 250 | + tokenStore.SaveBearerTokenForApp("app-a", "bearer-for-a") |
| 251 | + |
| 252 | + // Save OAuth1 tokens only in app-b |
| 253 | + tokenStore.SaveOAuth1TokensForApp("app-b", "at-b", "ts-b", "ck-b", "cs-b") |
| 254 | + |
| 255 | + // Save OAuth2 token only in app-a |
| 256 | + tokenStore.SaveOAuth2TokenForApp("app-a", "alice", "oauth2-for-a", "refresh-a", 9999999999) |
| 257 | + |
| 258 | + t.Run("Bearer token from named app", func(t *testing.T) { |
| 259 | + cfg := &config.Config{} |
| 260 | + a := NewAuth(cfg).WithTokenStore(tokenStore).WithAppName("app-a") |
| 261 | + header, err := a.GetBearerTokenHeader() |
| 262 | + require.NoError(t, err) |
| 263 | + assert.Equal(t, "Bearer bearer-for-a", header) |
| 264 | + }) |
| 265 | + |
| 266 | + t.Run("Bearer token not found in other app", func(t *testing.T) { |
| 267 | + cfg := &config.Config{} |
| 268 | + a := NewAuth(cfg).WithTokenStore(tokenStore).WithAppName("app-b") |
| 269 | + _, err := a.GetBearerTokenHeader() |
| 270 | + assert.Error(t, err, "app-b has no bearer token, expected error") |
| 271 | + }) |
| 272 | + |
| 273 | + t.Run("OAuth1 header from named app", func(t *testing.T) { |
| 274 | + cfg := &config.Config{} |
| 275 | + a := NewAuth(cfg).WithTokenStore(tokenStore).WithAppName("app-b") |
| 276 | + header, err := a.GetOAuth1Header("GET", "https://api.x.com/2/users/me", nil) |
| 277 | + require.NoError(t, err) |
| 278 | + assert.Contains(t, header, "OAuth ") |
| 279 | + }) |
| 280 | + |
| 281 | + t.Run("OAuth1 not found in other app", func(t *testing.T) { |
| 282 | + cfg := &config.Config{} |
| 283 | + a := NewAuth(cfg).WithTokenStore(tokenStore).WithAppName("app-a") |
| 284 | + _, err := a.GetOAuth1Header("GET", "https://api.x.com/2/users/me", nil) |
| 285 | + assert.Error(t, err, "app-a has no OAuth1 token, expected error") |
| 286 | + }) |
| 287 | + |
| 288 | + t.Run("Default app used when no --app flag", func(t *testing.T) { |
| 289 | + tokenStore.SetDefaultApp("app-a") |
| 290 | + cfg := &config.Config{} |
| 291 | + // No WithAppName call — appName stays "" |
| 292 | + a := NewAuth(cfg).WithTokenStore(tokenStore) |
| 293 | + header, err := a.GetBearerTokenHeader() |
| 294 | + require.NoError(t, err) |
| 295 | + assert.Equal(t, "Bearer bearer-for-a", header) |
| 296 | + }) |
| 297 | +} |
| 298 | + |
212 | 299 | func TestWithAppNameNonexistent(t *testing.T) { |
213 | 300 | tempDir, err := os.MkdirTemp("", "xurl_auth_test") |
214 | 301 | require.NoError(t, err) |
@@ -265,6 +352,79 @@ func TestGetOAuth2HeaderNoToken(t *testing.T) { |
265 | 352 | assert.Nil(t, token) |
266 | 353 | } |
267 | 354 |
|
| 355 | + |
| 356 | +// mockTokenServer returns an httptest.Server that responds to token refresh |
| 357 | +// requests with a new access token. |
| 358 | +func mockTokenServer(t *testing.T, accessToken, refreshToken string) *httptest.Server { |
| 359 | + t.Helper() |
| 360 | + return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { |
| 361 | + w.Header().Set("Content-Type", "application/json") |
| 362 | + json.NewEncoder(w).Encode(map[string]interface{}{ |
| 363 | + "access_token": accessToken, |
| 364 | + "token_type": "Bearer", |
| 365 | + "expires_in": 3600, |
| 366 | + "refresh_token": refreshToken, |
| 367 | + }) |
| 368 | + })) |
| 369 | +} |
| 370 | + |
| 371 | +func TestRefreshOAuth2TokenSavesToNamedApp(t *testing.T) { |
| 372 | + server := mockTokenServer(t, "new-access-token", "new-refresh-token") |
| 373 | + defer server.Close() |
| 374 | + |
| 375 | + tokenStore, tempDir := createTempTokenStore(t) |
| 376 | + defer os.RemoveAll(tempDir) |
| 377 | + |
| 378 | + tokenStore.AddApp("my-app", "client-id", "client-secret") |
| 379 | + |
| 380 | + // Save an already-expired token to "my-app" |
| 381 | + expiredTime := uint64(time.Now().Add(-1 * time.Hour).Unix()) |
| 382 | + tokenStore.SaveOAuth2TokenForApp("my-app", "alice", "old-access", "old-refresh", expiredTime) |
| 383 | + |
| 384 | + cfg := &config.Config{TokenURL: server.URL + "/token"} |
| 385 | + a := NewAuth(cfg).WithTokenStore(tokenStore).WithAppName("my-app") |
| 386 | + |
| 387 | + newToken, err := a.RefreshOAuth2Token("alice") |
| 388 | + require.NoError(t, err) |
| 389 | + assert.Equal(t, "new-access-token", newToken) |
| 390 | + |
| 391 | + // Refreshed token must be saved to "my-app", not the default app |
| 392 | + tok := tokenStore.GetOAuth2TokenForApp("my-app", "alice") |
| 393 | + require.NotNil(t, tok) |
| 394 | + assert.Equal(t, "new-access-token", tok.OAuth2.AccessToken) |
| 395 | + |
| 396 | + // Default app must not have received the token |
| 397 | + assert.Nil(t, tokenStore.GetOAuth2TokenForApp("default", "alice")) |
| 398 | +} |
| 399 | + |
| 400 | +func TestRefreshOAuth2TokenSavesToDefaultAppWhenNoOverride(t *testing.T) { |
| 401 | + server := mockTokenServer(t, "new-access-token", "new-refresh-token") |
| 402 | + defer server.Close() |
| 403 | + |
| 404 | + tokenStore, tempDir := createTempTokenStore(t) |
| 405 | + defer os.RemoveAll(tempDir) |
| 406 | + |
| 407 | + tokenStore.Apps["default"].ClientID = "client-id" |
| 408 | + tokenStore.Apps["default"].ClientSecret = "client-secret" |
| 409 | + |
| 410 | + // Save an expired token to the default app |
| 411 | + expiredTime := uint64(time.Now().Add(-1 * time.Hour).Unix()) |
| 412 | + tokenStore.SaveOAuth2TokenForApp("default", "bob", "old-access", "old-refresh", expiredTime) |
| 413 | + |
| 414 | + cfg := &config.Config{TokenURL: server.URL + "/token"} |
| 415 | + // No WithAppName — appName stays "" |
| 416 | + a := NewAuth(cfg).WithTokenStore(tokenStore) |
| 417 | + |
| 418 | + newToken, err := a.RefreshOAuth2Token("bob") |
| 419 | + require.NoError(t, err) |
| 420 | + assert.Equal(t, "new-access-token", newToken) |
| 421 | + |
| 422 | + // Token must be saved back to the default app |
| 423 | + tok := tokenStore.GetOAuth2TokenForApp("default", "bob") |
| 424 | + require.NotNil(t, tok) |
| 425 | + assert.Equal(t, "new-access-token", tok.OAuth2.AccessToken) |
| 426 | +} |
| 427 | + |
268 | 428 | func TestBrowserLaunchCommand(t *testing.T) { |
269 | 429 | url := "https://x.com/i/oauth2/authorize?client_id=abc&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fcallback&response_type=code&scope=tweet.read+users.read&state=123&code_challenge=xyz&code_challenge_method=S256" |
270 | 430 |
|
|
0 commit comments