// Copyright 2022 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "chrome/browser/ash/printing/oauth2/authorization_server_session.h"
#include <memory>
#include <string>
#include "base/containers/flat_map.h"
#include "base/containers/flat_set.h"
#include "base/values.h"
#include "chrome/browser/ash/printing/oauth2/constants.h"
#include "chrome/browser/ash/printing/oauth2/status_code.h"
#include "chrome/browser/ash/printing/oauth2/test_authorization_server.h"
#include "net/http/http_status_code.h"
#include "testing/gtest/include/gtest/gtest.h"
#include "url/gurl.h"
namespace ash {
namespace printing {
namespace oauth2 {
namespace {
class PrintingOAuth2AuthorizationServerSessionTest : public testing::Test {
protected:
// Initialize the `session_` field.
void CreateSession(base::flat_set<std::string>&& scope) {
GURL gurl(url_);
CHECK(gurl.is_valid());
session_ = std::make_unique<AuthorizationServerSession>(
server_.GetURLLoaderFactory(), gurl, std::move(scope));
}
// Process the First Token request on the server side and send a response
// with given `access_token` and `refresh_token`. If the `refresh_token` is
// empty the response does not contain the field "refresh_token".
void ProcessFirstTokenRequestAndResponse(
const std::string& access_token,
const std::string& refresh_token = "") {
base::flat_map<std::string, std::string> params;
base::Value::Dict fields;
EXPECT_EQ("", server_.ReceivePOSTWithURLParams(url_, params));
fields.Set("access_token", access_token);
fields.Set("token_type", "bearer");
if (!refresh_token.empty()) {
fields.Set("refresh_token", refresh_token);
}
server_.ResponseWithJSON(net::HttpStatusCode::HTTP_OK, fields);
}
// URL of the endpoint at the server.
const std::string url_ = "https://a.b/c";
// The object simulating the Authorization Server.
FakeAuthorizationServer server_;
// The testes session, it is created by the method CreateSession(...).
std::unique_ptr<AuthorizationServerSession> session_;
};
TEST_F(PrintingOAuth2AuthorizationServerSessionTest, ParseScope) {
auto scope = ParseScope(" w szczebrzeszynie chrzaszcz brzmi w trzcinie ");
EXPECT_EQ(scope.size(), 5u);
EXPECT_TRUE(scope.contains("w"));
EXPECT_TRUE(scope.contains("szczebrzeszynie"));
EXPECT_TRUE(scope.contains("chrzaszcz"));
EXPECT_TRUE(scope.contains("brzmi"));
EXPECT_TRUE(scope.contains("trzcinie"));
}
TEST_F(PrintingOAuth2AuthorizationServerSessionTest, InitialState) {
CreateSession({"ala", "ma", "kota"});
EXPECT_TRUE(session_->access_token().empty());
EXPECT_TRUE(session_->ContainsAll({}));
EXPECT_TRUE(session_->ContainsAll({"kota", "ala"}));
EXPECT_FALSE(session_->ContainsAll({"psa", "ma"}));
}
TEST_F(PrintingOAuth2AuthorizationServerSessionTest, WaitingList) {
CreateSession({});
CallbackResult cr1;
CallbackResult cr2;
CallbackResult cr3;
session_->AddToWaitingList(BindResult(cr1));
session_->AddToWaitingList(BindResult(cr2));
session_->AddToWaitingList(BindResult(cr3));
auto callbacks = session_->TakeWaitingList();
ASSERT_EQ(callbacks.size(), 3u);
EXPECT_TRUE(session_->TakeWaitingList().empty());
std::move(callbacks[0]).Run(StatusCode::kOK, "1");
std::move(callbacks[1]).Run(StatusCode::kAccessDenied, "2");
std::move(callbacks[2]).Run(StatusCode::kServerError, "3");
EXPECT_EQ(cr1.status, StatusCode::kOK);
EXPECT_EQ(cr1.data, "1");
EXPECT_EQ(cr2.status, StatusCode::kAccessDenied);
EXPECT_EQ(cr2.data, "2");
EXPECT_EQ(cr3.status, StatusCode::kServerError);
EXPECT_EQ(cr3.data, "3");
}
TEST_F(PrintingOAuth2AuthorizationServerSessionTest, FirstTokenRequest) {
CreateSession({"xxx"});
CallbackResult cr;
session_->SendFirstTokenRequest("clientID_xe2$", "auth_code_3d#x",
"code_verifier_P2s&", BindResult(cr));
// Verify the request.
base::flat_map<std::string, std::string> params;
ASSERT_EQ("", server_.ReceivePOSTWithURLParams(url_, params));
EXPECT_EQ(params["grant_type"], "authorization_code");
EXPECT_EQ(params["code"], "auth_code_3d#x");
EXPECT_EQ(params["redirect_uri"], printing::oauth2::kRedirectURI);
EXPECT_EQ(params["client_id"], "clientID_xe2$");
EXPECT_EQ(params["code_verifier"], "code_verifier_P2s&");
// Prepare and send the response.
base::Value::Dict fields;
fields.Set("access_token", "access_token_@(#a");
fields.Set("token_type", "bearer");
fields.Set("refresh_token", "refresh_token_X)(@K");
server_.ResponseWithJSON(net::HttpStatusCode::HTTP_OK, fields);
// Verify the response.
EXPECT_EQ(cr.status, StatusCode::kOK);
EXPECT_EQ(cr.data, "access_token_@(#a");
EXPECT_EQ(session_->access_token(), "access_token_@(#a");
}
TEST_F(PrintingOAuth2AuthorizationServerSessionTest, FirstTokenRequestError) {
CreateSession({"xxx"});
CallbackResult cr;
session_->SendFirstTokenRequest("a", "b", "c", BindResult(cr));
// Receive the request.
base::flat_map<std::string, std::string> params;
ASSERT_EQ("", server_.ReceivePOSTWithURLParams(url_, params));
EXPECT_EQ(params["code"], "b");
EXPECT_EQ(params["client_id"], "a");
EXPECT_EQ(params["code_verifier"], "c");
// Prepare and send the response.
base::Value::Dict fields;
fields.Set("access_token", "access_token_1");
// The field "token_type" is wrong.
fields.Set("token_type", "bearer_WRONG");
fields.Set("refresh_token", "refresh_token_2");
server_.ResponseWithJSON(net::HttpStatusCode::HTTP_OK, fields);
// Verify the response.
EXPECT_EQ(cr.status, StatusCode::kInvalidResponse);
// The error message contains "token_type".
EXPECT_NE(cr.data.find("token_type"), std::string::npos);
EXPECT_TRUE(session_->access_token().empty());
}
TEST_F(PrintingOAuth2AuthorizationServerSessionTest, NextTokenRequest) {
CreateSession({"xxx"});
CallbackResult cr;
// Send the First Token Request and process it.
session_->SendFirstTokenRequest("a", "b", "c", BindResult(cr));
ProcessFirstTokenRequestAndResponse("access_token_1", "refresh_token_X)(@K");
// Receive the response and send the Next Token Request.
ASSERT_EQ(cr.status, StatusCode::kOK);
EXPECT_EQ(session_->access_token(), "access_token_1");
session_->SendNextTokenRequest(BindResult(cr));
// It should reset the current access token.
EXPECT_TRUE(session_->access_token().empty());
// Receive and verify the request.
base::flat_map<std::string, std::string> params;
ASSERT_EQ("", server_.ReceivePOSTWithURLParams(url_, params));
EXPECT_EQ(params["grant_type"], "refresh_token");
EXPECT_EQ(params["refresh_token"], "refresh_token_X)(@K");
// Prepare and send the response.
base::Value::Dict fields;
fields.Set("access_token", "new_access_token_123");
fields.Set("token_type", "bearer");
server_.ResponseWithJSON(net::HttpStatusCode::HTTP_OK, fields);
// Verify the response.
EXPECT_EQ(cr.status, StatusCode::kOK);
EXPECT_EQ(cr.data, "new_access_token_123");
EXPECT_EQ(session_->access_token(), "new_access_token_123");
}
TEST_F(PrintingOAuth2AuthorizationServerSessionTest, NextTokenRequestError) {
CreateSession({"xxx"});
CallbackResult cr;
// Send the First Token Request and process it.
session_->SendFirstTokenRequest("a", "b", "c", BindResult(cr));
ProcessFirstTokenRequestAndResponse("access_token_1", "refresh_token_X)(@K");
// Receive the response and send the Next Token Request.
ASSERT_EQ(cr.status, StatusCode::kOK);
EXPECT_EQ(session_->access_token(), "access_token_1");
session_->SendNextTokenRequest(BindResult(cr));
// Receive the request and send the response.
base::flat_map<std::string, std::string> params;
ASSERT_EQ("", server_.ReceivePOSTWithURLParams(url_, params));
EXPECT_EQ(params["refresh_token"], "refresh_token_X)(@K");
base::Value::Dict fields;
fields.Set("token_type", "bearer");
// The field "access_token" is missing.
server_.ResponseWithJSON(net::HttpStatusCode::HTTP_OK, fields);
// Verify the response.
EXPECT_EQ(cr.status, StatusCode::kInvalidResponse);
// The error message contains "access_token".
EXPECT_NE(cr.data.find("access_token"), std::string::npos);
EXPECT_TRUE(session_->access_token().empty());
}
TEST_F(PrintingOAuth2AuthorizationServerSessionTest, NoRefreshTokens) {
CreateSession({});
CallbackResult cr;
// Send the First Token Request and process it.
session_->SendFirstTokenRequest("a", "b", "c", BindResult(cr));
ProcessFirstTokenRequestAndResponse("access_token_@(#a");
// Receive the response and send the Next Token Request.
ASSERT_EQ(cr.status, StatusCode::kOK);
EXPECT_EQ(cr.data, "access_token_@(#a");
session_->SendNextTokenRequest(BindResult(cr));
// Verify the response.
EXPECT_EQ(cr.status, StatusCode::kAuthorizationNeeded);
EXPECT_TRUE(session_->access_token().empty());
}
TEST_F(PrintingOAuth2AuthorizationServerSessionTest, InvalidRefreshToken) {
CreateSession({"xxx"});
CallbackResult cr;
// Send the First Token Request and process it.
session_->SendFirstTokenRequest("a", "b", "c", BindResult(cr));
ProcessFirstTokenRequestAndResponse("access_token_1", "refresh_token_X)@K");
// Receive the response and send the Next Token Request.
ASSERT_EQ(cr.status, StatusCode::kOK);
session_->SendNextTokenRequest(BindResult(cr));
// Receive and the request and send the response.
base::flat_map<std::string, std::string> params;
ASSERT_EQ("", server_.ReceivePOSTWithURLParams(url_, params));
EXPECT_EQ(params["refresh_token"], "refresh_token_X)@K");
base::Value::Dict fields;
fields.Set("error", "invalid_grant");
server_.ResponseWithJSON(net::HttpStatusCode::HTTP_BAD_REQUEST, fields);
// Verify the response.
EXPECT_EQ(cr.status, StatusCode::kAuthorizationNeeded);
EXPECT_TRUE(session_->access_token().empty());
}
} // namespace
} // namespace oauth2
} // namespace printing
} // namespace ash
Codebase Browser
chromium