Add private_key_jwt integration tests for /oauth2/token - #4853
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughAdded an integration suite for OAuth ChangesPrivate key JWT authentication
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant TestSuite
participant TokenEndpoint
participant JWKS
TestSuite->>TestSuite: Sign client assertion
TestSuite->>TokenEndpoint: Submit token request
TokenEndpoint->>JWKS: Resolve signing key
JWKS-->>TokenEndpoint: Return registered key
TokenEndpoint-->>TestSuite: Return token or OAuth error
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
sahandilshan
added
Test
skip-changelog
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (4)
tests/integration/oauth/token/private_key_jwt_test.go (4)
663-671: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueThe explicit
jtiis redundant.
createClientAssertionalready generates a randomjtiwhenopts.jtiis empty. Both requests reuse the same assertion string, so replay detection is exercised either way.♻️ Proposed simplification
assertion := createClientAssertion(clientAssertionOptions{ sub: pkjRSAClientID, aud: pkjIssuer, kid: pkjRSAKid, alg: "RS256", key: ts.rsaKey.Private, - jti: testutils.RandomJTI(), })🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/integration/oauth/token/private_key_jwt_test.go` around lines 663 - 671, Remove the explicit jti assignment from the createClientAssertion options in TestReplayedAssertion, relying on its built-in random JTI generation while preserving the assertion reuse and replay-detection behavior.
22-33: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueVerify that a shared base URL constant already exists in
testutils.
pkjServerURLandpkjIssuerhardcodehttps://localhost:8095. Other integration suites likely declare the same value. Iftestutilsexports a shared constant, reuse it instead.#!/bin/bash # Description: Find existing declarations of the integration server base URL. rg -n -C2 'localhost:8095' tests/integration --type=go | head -60🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/integration/oauth/token/private_key_jwt_test.go` around lines 22 - 33, Check testutils for an exported shared integration server base URL constant and reuse it for pkjServerURL and pkjIssuer if available, removing the duplicated https://localhost:8095 literals while preserving the issuer and server URL values.
510-517: 🎯 Functional Correctness | 🔵 Trivial | 💤 Low value
TestEmptySubalso clearsiss.
createClientAssertionsetsissfromopts.subat Line 236. Whensubis empty, bothsubandissare empty. The test therefore does not isolate the empty-subcondition. The server may reject the assertion on the missingissclaim instead.Add an explicit
issoption, or rename the test to reflect that both claims are empty.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/integration/oauth/token/private_key_jwt_test.go` around lines 510 - 517, Update TestEmptySub and its createClientAssertion options so iss remains populated while sub is empty, isolating the intended empty-sub condition; alternatively, rename the test to explicitly cover both empty claims.
201-213: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winRemove the unused
tamperSigfield and its branch. No test or other Go file setstamperSig, so the branch is unreachable.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/integration/oauth/token/private_key_jwt_test.go` around lines 201 - 213, Remove the unused tamperSig field from clientAssertionOptions and delete the corresponding tamperSig-dependent branch in createClientAssertion. Leave the remaining JWT option handling unchanged.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@tests/integration/oauth/token/private_key_jwt_test.go`:
- Around line 663-671: Remove the explicit jti assignment from the
createClientAssertion options in TestReplayedAssertion, relying on its built-in
random JTI generation while preserving the assertion reuse and replay-detection
behavior.
- Around line 22-33: Check testutils for an exported shared integration server
base URL constant and reuse it for pkjServerURL and pkjIssuer if available,
removing the duplicated https://localhost:8095 literals while preserving the
issuer and server URL values.
- Around line 510-517: Update TestEmptySub and its createClientAssertion options
so iss remains populated while sub is empty, isolating the intended empty-sub
condition; alternatively, rename the test to explicitly cover both empty claims.
- Around line 201-213: Remove the unused tamperSig field from
clientAssertionOptions and delete the corresponding tamperSig-dependent branch
in createClientAssertion. Leave the remaining JWT option handling unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: aba67abd-e64f-4d19-a359-21ef2877ac18
📒 Files selected for processing (2)
tests/integration/oauth/token/private_key_jwt_test.gotests/integration/testutils/oauth2_utils.go
fb470f6 to
c02e388
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
sahandilshan
added
the
trigger-pr-builder
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Signed-off-by: Sahan Dilshan <sahandilshan222@gmail.com>
c02e388 to
54e2a27
Compare
2 participants
Summary
private_key_jwtclient authentication at the/oauth2/tokenendpoint, filling a gap where zero integration tests actually POSTed aclient_assertionto obtain a real tokenRandomJTI()andSignJWT()helpers intestutils/oauth2_utils.gofor JWT assertion constructionTest coverage
Positive (5 tests): RS256, ES256, PS256 success paths,
client_idin body alongside assertion, scope parameter handlingNegative — format (5 tests): Missing
client_assertion, missingclient_assertion_type, unsupported assertion type, malformed JWT, emptysubclaimNegative — validation (7 tests): Wrong signing key, expired assertion, wrong audience, array audience (FAPI 2.0 rejection), missing
jti, replayed assertion (JTI replay protection),kidnot matching JWKSNegative — auth method conflicts (3 tests):
client_idmismatch, Basic auth + assertion,client_secret+ assertionTest plan
make test_integration PACKAGE="./oauth/token" RUN="TestPrivateKeyJWTTestSuite")go build ./...andgo vet ./...passmake lintpassesSummary by CodeRabbit
private_key_jwtclient authentication.