public/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-05-28 02:38:44 +09:00
Code Issues Packages Projects Releases Wiki Activity

Support for Custom URI Schemes in OAuth2 Redirect URIs (#37356)

Browse Source 
Fix #34349

By the way, remove `(ctx *APIContext) HasAPIError() ` and `(ctx
*APIContext) GetErrMsg()` because they do nothing, the error handling
has been done in API's middeware

The existing OAuth2 tests were not quite right, refactored them together
This commit is contained in:
wxiaoguang
2026-04-23 05:33:27 +08:00
committed by GitHub
parent 8cfcef32c6
commit 83bdfc2a57
21 changed files with 340 additions and 512 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/api_oauth2_apps_test.go
+39 -74
View File
@@ -11,10 +11,13 @@ import (
auth_model "code.gitea.io/gitea/models/auth"
"code.gitea.io/gitea/models/unittest"
user_model "code.gitea.io/gitea/models/user"
"code.gitea.io/gitea/modules/setting"
api "code.gitea.io/gitea/modules/structs"
"code.gitea.io/gitea/modules/test"
"code.gitea.io/gitea/tests"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestOAuth2Application(t *testing.T) {
@@ -28,18 +31,17 @@ func TestOAuth2Application(t *testing.T) {
func testAPICreateOAuth2Application(t *testing.T) {
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
appBody := api.CreateOAuth2ApplicationOptions{
Name: "test-app-1",
RedirectURIs: []string{
"http://www.google.com",
},
ConfidentialClient: true,
}
redirectURIs := []string{"http://www.google.com", "my-app:foo"}
appBody := api.CreateOAuth2ApplicationOptions{Name: "test-app-1", RedirectURIs: redirectURIs, ConfidentialClient: true}
req := NewRequestWithJSON(t, "POST", "/api/v1/user/applications/oauth2", &appBody).
AddBasicAuth(user.Name)
// no custom scheme
req := NewRequestWithJSON(t, "POST", "/api/v1/user/applications/oauth2", &appBody).AddBasicAuth(user.Name)
MakeRequest(t, req, http.StatusBadRequest)
// with custom scheme
defer test.MockVariableValue(&setting.OAuth2.CustomSchemes, []string{"my-app"})()
req = NewRequestWithJSON(t, "POST", "/api/v1/user/applications/oauth2", &appBody).AddBasicAuth(user.Name)
resp := MakeRequest(t, req, http.StatusCreated)
createdApp := DecodeJSON(t, resp, &api.OAuth2Application{})
assert.Equal(t, appBody.Name, createdApp.Name)
@@ -47,7 +49,7 @@ func testAPICreateOAuth2Application(t *testing.T) {
assert.Len(t, createdApp.ClientID, 36)
assert.True(t, createdApp.ConfidentialClient)
assert.NotEmpty(t, createdApp.Created)
assert.Equal(t, appBody.RedirectURIs[0], createdApp.RedirectURIs[0])
assert.Equal(t, redirectURIs, createdApp.RedirectURIs)
unittest.AssertExistsAndLoadBean(t, &auth_model.OAuth2Application{UID: user.ID, Name: createdApp.Name})
}
@@ -56,21 +58,13 @@ func testAPIListOAuth2Applications(t *testing.T) {
session := loginUser(t, user.Name)
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadUser)
existApp := unittest.AssertExistsAndLoadBean(t, &auth_model.OAuth2Application{
UID: user.ID,
Name: "test-app-1",
RedirectURIs: []string{
"http://www.google.com",
},
ConfidentialClient: true,
})
existApp := unittest.AssertExistsAndLoadBean(t, &auth_model.OAuth2Application{UID: user.ID, Name: "test-app-1", ConfidentialClient: true})
require.NotEmpty(t, existApp.RedirectURIs)
req := NewRequest(t, "GET", "/api/v1/user/applications/oauth2").
AddTokenAuth(token)
req := NewRequest(t, "GET", "/api/v1/user/applications/oauth2").AddTokenAuth(token)
resp := MakeRequest(t, req, http.StatusOK)
var appList api.OAuth2ApplicationList
DecodeJSON(t, resp, &appList)
appList := DecodeJSON(t, resp, api.OAuth2ApplicationList{})
expectedApp := appList[0]
assert.Equal(t, expectedApp.Name, existApp.Name)
@@ -78,7 +72,7 @@ func testAPIListOAuth2Applications(t *testing.T) {
assert.Equal(t, expectedApp.ConfidentialClient, existApp.ConfidentialClient)
assert.Len(t, expectedApp.ClientID, 36)
assert.Empty(t, expectedApp.ClientSecret)
assert.Equal(t, existApp.RedirectURIs[0], expectedApp.RedirectURIs[0])
assert.Equal(t, expectedApp.RedirectURIs, existApp.RedirectURIs)
unittest.AssertExistsAndLoadBean(t, &auth_model.OAuth2Application{ID: expectedApp.ID, Name: expectedApp.Name})
}
@@ -87,21 +81,16 @@ func testAPIDeleteOAuth2Application(t *testing.T) {
session := loginUser(t, user.Name)
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteUser)
oldApp := unittest.AssertExistsAndLoadBean(t, &auth_model.OAuth2Application{
UID: user.ID,
Name: "test-app-1",
})
oldApp := unittest.AssertExistsAndLoadBean(t, &auth_model.OAuth2Application{UID: user.ID, Name: "test-app-1"})
urlStr := fmt.Sprintf("/api/v1/user/applications/oauth2/%d", oldApp.ID)
req := NewRequest(t, "DELETE", urlStr).
AddTokenAuth(token)
req := NewRequest(t, "DELETE", urlStr).AddTokenAuth(token)
MakeRequest(t, req, http.StatusNoContent)
unittest.AssertNotExistsBean(t, &auth_model.OAuth2Application{UID: oldApp.UID, Name: oldApp.Name})
// Delete again will return not found
req = NewRequest(t, "DELETE", urlStr).
AddTokenAuth(token)
req = NewRequest(t, "DELETE", urlStr).AddTokenAuth(token)
MakeRequest(t, req, http.StatusNotFound)
}
@@ -110,65 +99,41 @@ func testAPIGetOAuth2Application(t *testing.T) {
session := loginUser(t, user.Name)
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadUser)
existApp := unittest.AssertExistsAndLoadBean(t, &auth_model.OAuth2Application{
UID: user.ID,
Name: "test-app-1",
RedirectURIs: []string{
"http://www.google.com",
},
ConfidentialClient: true,
})
existApp := unittest.AssertExistsAndLoadBean(t, &auth_model.OAuth2Application{UID: user.ID, Name: "test-app-1", ConfidentialClient: true})
require.NotEmpty(t, existApp.RedirectURIs)
req := NewRequest(t, "GET", fmt.Sprintf("/api/v1/user/applications/oauth2/%d", existApp.ID)).
AddTokenAuth(token)
req := NewRequest(t, "GET", fmt.Sprintf("/api/v1/user/applications/oauth2/%d", existApp.ID)).AddTokenAuth(token)
resp := MakeRequest(t, req, http.StatusOK)
var app api.OAuth2Application
DecodeJSON(t, resp, &app)
expectedApp := app
expectedApp := DecodeJSON(t, resp, &api.OAuth2Application{})
assert.Equal(t, expectedApp.Name, existApp.Name)
assert.Equal(t, expectedApp.ClientID, existApp.ClientID)
assert.Equal(t, expectedApp.ConfidentialClient, existApp.ConfidentialClient)
assert.Len(t, expectedApp.ClientID, 36)
assert.Empty(t, expectedApp.ClientSecret)
assert.Len(t, expectedApp.RedirectURIs, 1)
assert.Equal(t, expectedApp.RedirectURIs[0], existApp.RedirectURIs[0])
assert.Equal(t, expectedApp.RedirectURIs, existApp.RedirectURIs)
unittest.AssertExistsAndLoadBean(t, &auth_model.OAuth2Application{ID: expectedApp.ID, Name: expectedApp.Name})
}
func testAPIUpdateOAuth2Application(t *testing.T) {
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
existApp := unittest.AssertExistsAndLoadBean(t, &auth_model.OAuth2Application{
UID: user.ID,
Name: "test-app-1",
RedirectURIs: []string{
"http://www.google.com",
},
})
appBody := api.CreateOAuth2ApplicationOptions{
Name: "test-app-1",
RedirectURIs: []string{
"http://www.google.com/",
"http://www.github.com/",
},
ConfidentialClient: true,
}
existApp := unittest.AssertExistsAndLoadBean(t, &auth_model.OAuth2Application{UID: user.ID, Name: "test-app-1"})
redirectURIs := []string{"https://www.google.com", "my-app:foo"}
appBody := api.CreateOAuth2ApplicationOptions{Name: "test-app-1", RedirectURIs: redirectURIs, ConfidentialClient: true}
urlStr := fmt.Sprintf("/api/v1/user/applications/oauth2/%d", existApp.ID)
req := NewRequestWithJSON(t, "PATCH", urlStr, &appBody).
AddBasicAuth(user.Name)
// no custom scheme
req := NewRequestWithJSON(t, "PATCH", urlStr, &appBody).AddBasicAuth(user.Name)
MakeRequest(t, req, http.StatusBadRequest)
// with custom scheme
defer test.MockVariableValue(&setting.OAuth2.CustomSchemes, []string{"my-app"})()
req = NewRequestWithJSON(t, "PATCH", urlStr, &appBody).AddBasicAuth(user.Name)
resp := MakeRequest(t, req, http.StatusOK)
var app api.OAuth2Application
DecodeJSON(t, resp, &app)
expectedApp := app
assert.Len(t, expectedApp.RedirectURIs, 2)
assert.Equal(t, expectedApp.RedirectURIs[0], appBody.RedirectURIs[0])
assert.Equal(t, expectedApp.RedirectURIs[1], appBody.RedirectURIs[1])
expectedApp := DecodeJSON(t, resp, &api.OAuth2Application{})
assert.Equal(t, expectedApp.RedirectURIs, appBody.RedirectURIs)
assert.Equal(t, expectedApp.ConfidentialClient, appBody.ConfidentialClient)
unittest.AssertExistsAndLoadBean(t, &auth_model.OAuth2Application{ID: expectedApp.ID, Name: expectedApp.Name})
}