pansy/internal/api/oidc_test.go

package api

import (
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	"gitea.stevedudenhoeffer.com/steve/pansy/internal/config"
)

// fakeIssuer stands up a minimal OIDC discovery endpoint so oidcClient.ensure
// succeeds without a real IdP. It only needs to serve the discovery document for
// the login-initiation and route tests; token exchange is covered by the
// service-layer provisioning tests and manual Authentik verification.
func fakeIssuer(t *testing.T) string {
	t.Helper()
	mux := http.NewServeMux()
	var issuer string
	mux.HandleFunc("/.well-known/openid-configuration", func(w http.ResponseWriter, _ *http.Request) {
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(map[string]any{
			"issuer":                 issuer,
			"authorization_endpoint": issuer + "/authorize",
			"token_endpoint":         issuer + "/token",
			"jwks_uri":               issuer + "/jwks",
		})
	})
	ts := httptest.NewServer(mux)
	t.Cleanup(ts.Close)
	issuer = ts.URL
	return issuer
}

func oidcCfg(t *testing.T) *config.Config {
	cfg := localCfg()
	cfg.BaseURL = "https://pansy.example.com"
	cfg.OIDC = config.OIDCConfig{Issuer: fakeIssuer(t), ClientID: "pansy-client", ButtonLabel: "Sign in with Authentik"}
	return cfg
}

func TestOIDCRoutesAbsentWhenUnconfigured(t *testing.T) {
	r := authEngine(t, localCfg()) // no OIDC
	for _, path := range []string{"/api/v1/auth/oidc/login", "/api/v1/auth/oidc/callback"} {
		w := doJSON(t, r, http.MethodGet, path, nil, nil)
		if w.Code != http.StatusNotFound {
			t.Errorf("GET %s status = %d, want 404 when OIDC unconfigured", path, w.Code)
		}
	}
}

func TestProvidersReportsOIDCWhenConfigured(t *testing.T) {
	r := authEngine(t, oidcCfg(t))
	w := doJSON(t, r, http.MethodGet, "/api/v1/auth/providers", nil, nil)
	var got struct {
		Local     bool   `json:"local"`
		OIDC      bool   `json:"oidc"`
		OIDCLabel string `json:"oidcLabel"`
	}
	if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
		t.Fatalf("decode providers: %v", err)
	}
	if !got.OIDC || got.OIDCLabel != "Sign in with Authentik" {
		t.Errorf("providers = %+v, want oidc=true with Authentik label", got)
	}
}

func TestOIDCLoginRedirectsToProviderWithPKCE(t *testing.T) {
	r := authEngine(t, oidcCfg(t))
	w := doJSON(t, r, http.MethodGet, "/api/v1/auth/oidc/login", nil, nil)
	if w.Code != http.StatusFound {
		t.Fatalf("oidc login status = %d, want 302 (body %s)", w.Code, w.Body.String())
	}
	loc := w.Header().Get("Location")
	for _, want := range []string{"/authorize?", "code_challenge=", "code_challenge_method=S256", "state=", "nonce="} {
		if !strings.Contains(loc, want) {
			t.Errorf("auth redirect %q missing %q", loc, want)
		}
	}
	// The transaction cookie must be set so the callback can validate state.
	var haveTx bool
	for _, ck := range w.Result().Cookies() {
		if ck.Name == oidcTxCookie {
			haveTx = ck.HttpOnly && ck.Value != ""
		}
	}
	if !haveTx {
		t.Error("expected an HttpOnly pansy_oidc_tx cookie to be set")
	}
}

func TestOIDCCallbackWithoutTransactionRejected(t *testing.T) {
	r := authEngine(t, oidcCfg(t))
	// No tx cookie → state can't be validated → redirect to login with error=state.
	w := doJSON(t, r, http.MethodGet, "/api/v1/auth/oidc/callback?state=abc&code=xyz", nil, nil)
	if w.Code != http.StatusFound {
		t.Fatalf("callback status = %d, want 302", w.Code)
	}
	if loc := w.Header().Get("Location"); !strings.Contains(loc, "error=state") {
		t.Errorf("callback redirect = %q, want error=state", loc)
	}
}

func TestOIDCCallbackProviderErrorRedirects(t *testing.T) {
	r := authEngine(t, oidcCfg(t))
	w := doJSON(t, r, http.MethodGet, "/api/v1/auth/oidc/callback?error=access_denied", nil, nil)
	if w.Code != http.StatusFound {
		t.Fatalf("callback status = %d, want 302", w.Code)
	}
	if loc := w.Header().Get("Location"); !strings.Contains(loc, "error=oidc") {
		t.Errorf("callback redirect = %q, want error=oidc", loc)
	}
}