snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

selfservice/strategy/oidc/provider_generic_test.go

@@ -0,0 +1,94 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package oidc_test
+
+import (
+	"encoding/json"
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/ory/kratos/driver"
+	"github.com/ory/kratos/driver/config"
+	"github.com/ory/kratos/pkg"
+	"github.com/ory/kratos/selfservice/flow/login"
+	"github.com/ory/kratos/selfservice/strategy/oidc"
+	"github.com/ory/kratos/x"
+	"github.com/ory/x/configx"
+)
+
+func makeOIDCClaims() json.RawMessage {
+	claims, _ := json.Marshal(map[string]interface{}{
+		"id_token": map[string]interface{}{
+			"email": map[string]bool{
+				"essential": true,
+			},
+			"email_verified": map[string]bool{
+				"essential": true,
+			},
+		},
+	})
+	return claims
+}
+
+func makeAuthCodeURL(t *testing.T, r *login.Flow, reg *driver.RegistryDefault) string {
+	p := oidc.NewProviderGenericOIDC(&oidc.Configuration{
+		Provider:        "generic",
+		ID:              "valid",
+		ClientID:        "client",
+		ClientSecret:    "secret",
+		IssuerURL:       "https://accounts.google.com",
+		Mapper:          "file://./stub/hydra.schema.json",
+		RequestedClaims: makeOIDCClaims(),
+	}, reg)
+	c, err := p.(oidc.OAuth2Provider).OAuth2(t.Context())
+	require.NoError(t, err)
+	return c.AuthCodeURL("state", p.(oidc.OAuth2Provider).AuthCodeURLOptions(r)...)
+}
+
+func TestProviderGenericOIDC_AddAuthCodeURLOptions(t *testing.T) {
+	conf, reg := pkg.NewFastRegistryWithMocks(t,
+		configx.WithValue(config.ViperKeyPublicBaseURL, "https://ory.sh"))
+	t.Run("case=redirectURI is public base url", func(t *testing.T) {
+		r := &login.Flow{ID: x.NewUUID(), Refresh: true}
+		actual, err := url.ParseRequestURI(makeAuthCodeURL(t, r, reg))
+		require.NoError(t, err)
+		assert.Contains(t, actual.Query().Get("redirect_uri"), "https://ory.sh")
+	})
+
+	t.Run("case=redirectURI is public base url", func(t *testing.T) {
+		conf.MustSet(t.Context(), config.ViperKeyOIDCBaseRedirectURL, "https://example.org")
+		t.Cleanup(func() {
+			conf.MustSet(t.Context(), config.ViperKeyOIDCBaseRedirectURL, nil)
+		})
+		r := &login.Flow{ID: x.NewUUID(), Refresh: true}
+		actual, err := url.ParseRequestURI(makeAuthCodeURL(t, r, reg))
+		require.NoError(t, err)
+		assert.Contains(t, actual.Query().Get("redirect_uri"), "https://example.org")
+	})
+
+	t.Run("case=expect prompt to be login with forced flag", func(t *testing.T) {
+		r := &login.Flow{
+			ID:      x.NewUUID(),
+			Refresh: true,
+		}
+		assert.Contains(t, makeAuthCodeURL(t, r, reg), "prompt=login")
+	})
+
+	t.Run("case=expect prompt to not be login without forced flag", func(t *testing.T) {
+		r := &login.Flow{
+			ID: x.NewUUID(),
+		}
+		assert.NotContains(t, makeAuthCodeURL(t, r, reg), "prompt=login")
+	})
+
+	t.Run("case=expect requested claims to be set", func(t *testing.T) {
+		r := &login.Flow{
+			ID: x.NewUUID(),
+		}
+		assert.Contains(t, makeAuthCodeURL(t, r, reg), "claims="+url.QueryEscape(string(makeOIDCClaims())))
+	})
+}