diff --git a/plugins/auth-backend-module-oidc-provider/src/module.test.ts b/plugins/auth-backend-module-oidc-provider/src/module.test.ts index 406cc3229e..f85afec0c3 100644 --- a/plugins/auth-backend-module-oidc-provider/src/module.test.ts +++ b/plugins/auth-backend-module-oidc-provider/src/module.test.ts @@ -14,9 +14,6 @@ * limitations under the License. */ -import { mockServices, startTestBackend } from '@backstage/backend-test-utils'; -import { authPlugin } from '@backstage/plugin-auth-backend'; -import { authModuleOidcProvider } from './module'; import request from 'supertest'; import { AuthProviderRouteHandlers, @@ -24,8 +21,7 @@ import { createOAuthRouteHandlers, decodeOAuthState, } from '@backstage/plugin-auth-node'; -import { setupServer } from 'msw'; -import { ClientMetadata, IssuerMetadata } from 'openid-client'; +import { setupServer } from 'msw/node'; import { rest } from 'msw'; import { setupRequestMockHandlers } from '@backstage/backend-test-utils'; import { Server } from 'http'; @@ -52,12 +48,12 @@ describe('authModuleOidcProvider', () => { const issuerMetadata = { issuer: 'https://oidc.test', - authorization_endpoint: 'https://oidc.test/as/authorization.oauth2', - token_endpoint: 'https://oidc.test/as/token.oauth2', - revocation_endpoint: 'https://oidc.test/as/revoke_token.oauth2', + authorization_endpoint: 'https://oidc.test/oauth2/authorize', + token_endpoint: 'https://oidc.test/oauth2/token', + revocation_endpoint: 'https://oidc.test/oauth2/revoke_token', userinfo_endpoint: 'https://oidc.test/idp/userinfo.openid', introspection_endpoint: 'https://oidc.test/as/introspect.oauth2', - jwks_uri: 'https://oidc.test/pf/JWKS', + jwks_uri: 'https://oidc.test/jwks.json', scopes_supported: ['openid'], claims_supported: ['email'], response_types_supported: ['code'], @@ -70,21 +66,6 @@ describe('authModuleOidcProvider', () => { request_object_signing_alg_values_supported: ['RS256', 'RS512', 'HS256'], }; - const clientMetadata = { - authHandler: async input => ({ - profile: { - displayName: input.userinfo.email, - }, - }), - resolverContext: {} as AuthResolverContext, - callbackUrl: 'https://oidc.test/callback', - clientId: 'testclientid', - clientSecret: 'testclientsecret', - metadataUrl: 'https://oidc.test/.well-known/openid-configuration', - tokenEndpointAuthMethod: 'none', - tokenSignedResponseAlg: 'none', - }; - beforeAll(async () => { const keyPair = await generateKeyPair('ES256'); const privateKey = await exportJWK(keyPair.privateKey); @@ -93,7 +74,7 @@ describe('authModuleOidcProvider', () => { idToken = await new SignJWT({ sub: 'test', - iss: 'https://pinniped.test', + iss: 'https://oidc.test', iat: Date.now(), aud: 'clientId', exp: Date.now() + 10000, @@ -181,11 +162,11 @@ describe('authModuleOidcProvider', () => { const router = Router(); router .use( - '/api/auth/pinniped/start', + '/api/auth/oidc/start', providerRouteHandler.start.bind(providerRouteHandler), ) .use( - '/api/auth/pinniped/handler/frame', + '/api/auth/oidc/handler/frame', providerRouteHandler.frameHandler.bind(providerRouteHandler), ); app.use(router); @@ -196,15 +177,15 @@ describe('authModuleOidcProvider', () => { }); it('should start', async () => { - const agent = request.agent(''); + const agent = request.agent(backstageServer); const startResponse = await agent.get( - `${appUrl}/api/auth/oidc/start?env=development`, + `/api/auth/oidc/start?env=development`, ); expect(startResponse.status).toEqual(302); const nonceCookie = agent.jar.getCookie('oidc-nonce', { - domain: 'localhost', + domain: '127.0.0.1', path: '/api/auth/oidc/handler', script: false, secure: false, @@ -212,21 +193,24 @@ describe('authModuleOidcProvider', () => { expect(nonceCookie).toBeDefined(); const startUrl = new URL(startResponse.get('location')); - expect(startUrl.origin).toBe('https://oidc.com'); - expect(startUrl.pathname).toBe('/oauth/authorize'); + expect(startUrl.origin).toBe('https://oidc.test'); + expect(startUrl.pathname).toBe('/oauth2/authorize'); expect(Object.fromEntries(startUrl.searchParams)).toEqual({ response_type: 'code', - scope: 'read_user', - client_id: 'my-client-id', - redirect_uri: `http://localhost:${ - (backstageServer.address() as AddressInfo).port - }/api/auth/oidc/handler/frame`, + scope: 'openid profile email', + client_id: 'clientId', + redirect_uri: `${appUrl}/api/auth/oidc/handler/frame`, state: expect.any(String), + prompt: 'none', + code_challenge: expect.any(String), + code_challenge_method: `S256`, }); expect(decodeOAuthState(startUrl.searchParams.get('state')!)).toEqual({ env: 'development', nonce: decodeURIComponent(nonceCookie.value), }); - }, 70000); + }); + + // TODO: This seems to be the place for integration testing, so far only have test that hit metadata endpoints along with /start but might be missing responses for handler? });