snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

selfservice/strategy/oidc/provider_amazon_test.go

@@ -0,0 +1,59 @@
+// Copyright © 2025 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package oidc_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/amazon"
+
+	"github.com/ory/kratos/pkg"
+	"github.com/ory/kratos/selfservice/strategy/oidc"
+)
+
+func TestAmazonOidcClaims(t *testing.T) {
+	t.Parallel()
+
+	handler := http.NewServeMux()
+	expectedAccessToken := "my-access-token"
+	handler.HandleFunc("GET /user/profile", func(w http.ResponseWriter, r *http.Request) {
+		token := r.Header.Get("x-amz-access-token")
+		if token != expectedAccessToken {
+			w.WriteHeader(http.StatusForbidden)
+			return
+		}
+		// From the official docs: https://developer.amazon.com/docs/login-with-amazon/customer-profile.html .
+		userProfile := `
+{
+    "user_id" : "amzn1.account.K2LI23KL2LK2",
+    "email" : "johndoe@gmail.com",
+    "name" : "John Doe",
+    "postal_code": "98101"
+}
+`
+
+		_, err := w.Write([]byte(userProfile))
+		require.NoError(t, err)
+	})
+	amazonAPI := httptest.NewServer(handler)
+	t.Cleanup(amazonAPI.Close)
+
+	_, reg := pkg.NewFastRegistryWithMocks(t)
+	p := oidc.NewProviderAmazon(&oidc.Configuration{}, reg).(*oidc.ProviderAmazon)
+	p.SetProfileURL(t, amazonAPI.URL+"/user/profile")
+
+	claims, err := p.Claims(t.Context(), &oauth2.Token{AccessToken: expectedAccessToken}, nil)
+	require.NoError(t, err)
+	require.NotNil(t, claims)
+
+	require.Equal(t, claims.Subject, "amzn1.account.K2LI23KL2LK2")
+	require.Equal(t, claims.Issuer, amazon.Endpoint.TokenURL)
+	require.Equal(t, claims.Name, "John Doe")
+	require.Equal(t, claims.Email, "johndoe@gmail.com")
+	require.Equal(t, claims.Zoneinfo, "98101")
+}