sendnrw/pocket-id
2
0
Fork 0
mirror of https://github.com/pocket-id/pocket-id.git synced 2026-10-24 18:49:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: make oauth access tokens RFC 9068 compliant

Browse Source
This commit is contained in:
Elias Schneider
2026-08-02 15:59:21 +02:00
parent b08ac7bf7d
commit 7c55bdf115
10 changed files with 70 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/internal/oidc/userinfo_handler_test.go
+16 -7
View File
@@ -204,12 +204,21 @@ func TestUserInfoHandler(t *testing.T) {
require.Contains(t, rec.Header().Get("WWW-Authenticate"), `Bearer error=`)
})
t.Run("token without a resource owner is rejected", func(t *testing.T) {
// client_credentials-style token: valid, but no subject -> must not return PII.
token := issueAccessToken(t, "req-no-subject", "", "openid")
rec, c := call(t, token)
require.Empty(t, c.Errors)
require.Equal(t, http.StatusUnauthorized, rec.Code)
require.Contains(t, rec.Header().Get("WWW-Authenticate"), `Bearer error="request_unauthorized"`)
t.Run("access token without a subject is not issued", func(t *testing.T) {
// Rejecting a subjectless token at issuance enforces the RFC 9068 invariant before it can reach UserInfo
session := NewEmptySession()
session.SetExpiresAt(fosite.AccessToken, time.Now().UTC().Add(time.Hour))
request := fosite.NewAccessRequest(session)
request.ID = "req-no-subject"
request.Client = Client{OidcClient: model.OidcClient{Base: model.Base{ID: clientID}}}
request.GrantTypes = fosite.Arguments{string(fosite.GrantTypeClientCredentials)}
request.RequestedScope = fosite.Arguments{"openid"}
request.GrantedScope = fosite.Arguments{"openid"}
request.RequestedAudience = fosite.Arguments{clientID}
request.GrantedAudience = fosite.Arguments{clientID}
_, err := provider.NewAccessResponse(t.Context(), request)
require.ErrorContains(t, err, "without a subject")
})
}