sendnrw/pocket-id
2
0
Fork 0
mirror of https://github.com/pocket-id/pocket-id.git synced 2026-10-11 12:19:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: re-check api permissions on access token refresh

Browse Source
This commit is contained in:
Elias Schneider
2026-07-07 10:58:39 +02:00
parent 337fc6fd1e
commit e8cb0c831c
2 changed files with 85 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/internal/oidc/token_handler_test.go
+44 -1
View File
@@ -551,7 +551,7 @@ func TestTokenHandlerRefreshGrantPreservesAudienceAndScope(t *testing.T) {
Secret: []byte(secret),
})
require.NoError(t, err)
handler := newTokenHandler(provider, newClaimsService(db, nil, baseURL, nil), nil)
handler := newTokenHandler(provider, newClaimsService(db, nil, baseURL, nil), apiAccess)
form := url.Values{
"grant_type": {"refresh_token"},
@@ -637,4 +637,47 @@ func TestTokenHandlerRefreshGrantPreservesAudienceAndScope(t *testing.T) {
require.Empty(t, body["access_token"])
require.Equal(t, "invalid_scope", body["error"])
})
t.Run("revoking only the user-delegated API grant makes the next refresh fail", func(t *testing.T) {
db := testutils.NewDatabaseForTest(t)
const clientID, userID = "client-user-revoked", "user-user-revoked"
seedUserAndClient(t, db, clientID, userID)
clientOnlyAPI := fakeAPIAccess{allowed: map[string]map[SubjectType][]string{
apiResource: {
SubjectTypeClient: {"read:orders"},
},
}}
token := mintRefreshToken(t, db, clientID, userID,
fosite.Arguments{"openid", "read:orders"},
fosite.Arguments{apiResource},
)
body := doRefresh(t, db, clientOnlyAPI, clientID, token, nil)
require.Empty(t, body["access_token"])
require.Equal(t, "access_denied", body["error"])
})
t.Run("refresh rechecks the granted scope against the granted API audience", func(t *testing.T) {
db := testutils.NewDatabaseForTest(t)
const clientID, userID = "client-split-grant", "user-split-grant"
seedUserAndClient(t, db, clientID, userID)
splitGrantAPI := fakeAPIAccess{allowed: map[string]map[SubjectType][]string{
apiResource: {
SubjectTypeUser: {"write:orders"},
},
"https://api.inventory.example.com": {
SubjectTypeUser: {"read:orders"},
},
}}
token := mintRefreshToken(t, db, clientID, userID,
fosite.Arguments{"openid", "read:orders"},
fosite.Arguments{apiResource},
)
body := doRefresh(t, db, splitGrantAPI, clientID, token, nil)
require.Empty(t, body["access_token"])
require.Equal(t, "invalid_scope", body["error"])
})
}