You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
53 lines
1.8 KiB
53 lines
1.8 KiB
"""Tests for PKCE flow: code verifier and code challenge handling."""
|
|
|
|
from unittest import mock
|
|
|
|
from keycloak import KeycloakOpenID
|
|
from keycloak.pkce_utils import generate_code_challenge, generate_code_verifier
|
|
|
|
|
|
def test_pkce_auth_url_and_token(env: object) -> None:
|
|
"""Test PKCE flow: auth_url includes code_challenge, token includes code_verifier."""
|
|
oid = KeycloakOpenID(
|
|
server_url=f"http://{env.keycloak_host}:{env.keycloak_port}",
|
|
realm_name="master",
|
|
client_id="admin-cli",
|
|
)
|
|
code_verifier = generate_code_verifier()
|
|
code_challenge, code_challenge_method = generate_code_challenge(code_verifier)
|
|
|
|
# Build PKCE auth URL
|
|
url = oid.auth_url(
|
|
redirect_uri="http://test.test/*",
|
|
code_challenge=code_challenge,
|
|
code_challenge_method=code_challenge_method,
|
|
)
|
|
assert f"code_challenge={code_challenge}" in url
|
|
assert f"code_challenge_method={code_challenge_method}" in url
|
|
|
|
# Simulate token exchange with PKCE
|
|
# This part would require a real code from Keycloak, so we mock the response
|
|
with mock.patch.object(
|
|
oid,
|
|
"token",
|
|
return_value={
|
|
"access_token": mock.ANY,
|
|
"refresh_token": mock.ANY,
|
|
"token_type": "Bearer",
|
|
},
|
|
) as mocked_token:
|
|
token = oid.token(
|
|
grant_type="authorization_code",
|
|
code="dummy_code",
|
|
redirect_uri="http://test.test/*",
|
|
code_verifier=code_verifier,
|
|
)
|
|
mocked_token.assert_called_with(
|
|
grant_type="authorization_code",
|
|
code="dummy_code",
|
|
redirect_uri="http://test.test/*",
|
|
code_verifier=code_verifier,
|
|
)
|
|
assert "access_token" in token
|
|
assert "refresh_token" in token
|
|
assert token["token_type"] == "Bearer" # noqa: S105
|