From 1185e30cb4a981a429323a798f3a4db2ec03b051 Mon Sep 17 00:00:00 2001
From: ataylorme <andrew@ataylor.me>
Date: Fri, 13 Oct 2023 15:11:11 -0700
Subject: [PATCH] Add test for okta auth custom scope

Signed-off-by: ataylorme <andrew@ataylor.me>
---
 .../src/providers/okta/provider.test.ts       | 44 ++++++++++++++++++-
 1 file changed, 43 insertions(+), 1 deletion(-)

diff --git a/plugins/auth-backend/src/providers/okta/provider.test.ts b/plugins/auth-backend/src/providers/okta/provider.test.ts
index bc27129300..f91f7fff89 100644
--- a/plugins/auth-backend/src/providers/okta/provider.test.ts
+++ b/plugins/auth-backend/src/providers/okta/provider.test.ts
@@ -17,13 +17,14 @@
 import { OktaAuthProvider } from './provider';
 import * as helpers from '../../lib/passport/PassportStrategyHelper';
 import { OAuthResult } from '../../lib/oauth';
-import { AuthResolverContext } from '../types';
+import { AuthResolverContext, OAuthStartResponse } from '../types';
 
 jest.mock('../../lib/passport/PassportStrategyHelper', () => {
   return {
     executeFrameHandlerStrategy: jest.fn(),
     executeRefreshTokenStrategy: jest.fn(),
     executeFetchUserProfileStrategy: jest.fn(),
+    executeRedirectStrategy: jest.fn(),
   };
 });
 
@@ -34,6 +35,11 @@ const mockFrameHandler = jest.spyOn(
   () => Promise<{ result: OAuthResult; privateInfo: any }>
 >;
 
+const mockRedirectStrategy = jest.spyOn(
+  helpers,
+  'executeRedirectStrategy',
+) as unknown as jest.MockedFunction<() => Promise<OAuthStartResponse>>;
+
 describe('createOktaProvider', () => {
   it('should auth', async () => {
     const provider = new OktaAuthProvider({
@@ -97,4 +103,40 @@ describe('createOktaProvider', () => {
       },
     });
   });
+
+  it('should pass a custom scope to start and refresh requests', async () => {
+    const mockScope = 'openid profile email offline_access groups';
+    const reqScope = 'openid profile email offline_access';
+    const provider = new OktaAuthProvider({
+      resolverContext: {} as AuthResolverContext,
+      authHandler: async ({ fullProfile }) => ({
+        profile: {
+          email: fullProfile.emails![0]!.value,
+          displayName: fullProfile.displayName,
+        },
+      }),
+      audience: 'http://example.com',
+      clientId: 'mock',
+      clientSecret: 'mock',
+      callbackUrl: 'mock',
+      scope: mockScope,
+    });
+
+    mockRedirectStrategy.mockResolvedValueOnce({
+      url: 'http://example.com/',
+    });
+
+    const req: any = {
+      state: {
+        nonce: 'nonce',
+        env: 'development',
+      },
+      scope: reqScope,
+    };
+
+    await provider.start(req);
+    const mockCallScope = (mockRedirectStrategy.mock.calls[0] as any)?.[2]
+      ?.scope;
+    expect(mockCallScope).toBe(mockScope);
+  });
 });