sascha
/
nextcloud-server
mirror of https://github.com/nextcloud/server.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

add test for refusing to get an oauth token from a code when we're not in authorization state 

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
pull/40766/head
Julien Veyssier 2023-08-29 12:37:30 +07:00
parent 779e1d51ac
commit ddfc124767
No known key found for this signature in database
GPG Key ID: 4141FEE162030638
1 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
apps/oauth2/tests/Controller/OauthApiControllerTest.php
Unescape Escape View File

@ -151,6 +151,33 @@ class OauthApiControllerTest extends TestCase {
$this->assertEquals($expected, $this->oauthApiController->getToken('authorization_code', 'validcode', null, null, null));
}
public function testGetTokenWithCodeForActiveToken() {
// if a token has already delivered oauth tokens,
// it should not be possible to get a new oauth token from a valid authorization code
$tokenCreatedAt = 100;
$expected = new JSONResponse([
'error' => 'invalid_request',
], Http::STATUS_BAD_REQUEST);
$expected->throttle(['invalid_request' => 'authorization_code_received_for_active_token']);
$accessToken = new AccessToken();
$accessToken->setClientId(42);
$accessToken->setCreatedAt($tokenCreatedAt);
$accessToken->setTokenCount(1);
$this->accessTokenMapper->method('getByCode')
->with('validcode')
->willReturn($accessToken);
$tsNow = $tokenCreatedAt + 1;
$dateNow = (new \DateTimeImmutable())->setTimestamp($tsNow);
$this->timeFactory->method('now')
->willReturn($dateNow);
$this->assertEquals($expected, $this->oauthApiController->getToken('authorization_code', 'validcode', null, null, null));
}
public function testGetTokenClientDoesNotExist() {
// In this test, the token's authorization code is valid and has not expired
// and we check what happens when the associated Oauth client does not exist