snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

selfservice/strategy/oidc/provider_google_test.go

@@ -0,0 +1,138 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package oidc_test
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/golang-jwt/jwt/v4"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
+
+	"github.com/ory/kratos/pkg"
+	"github.com/ory/kratos/selfservice/flow/login"
+	"github.com/ory/kratos/selfservice/strategy/oidc"
+	"github.com/ory/kratos/x"
+)
+
+func TestProviderGoogle_Scope(t *testing.T) {
+	_, reg := pkg.NewVeryFastRegistryWithoutDB(t)
+
+	p := oidc.NewProviderGoogle(&oidc.Configuration{
+		Provider:        "google",
+		ID:              "valid",
+		ClientID:        "client",
+		ClientSecret:    "secret",
+		Mapper:          "file://./stub/hydra.schema.json",
+		RequestedClaims: nil,
+		Scope:           []string{"email", "profile", "offline_access"},
+	}, reg)
+
+	c, _ := p.(oidc.OAuth2Provider).OAuth2(context.Background())
+	assert.NotContains(t, c.Scopes, "offline_access")
+}
+
+func TestProviderGoogle_AccessType(t *testing.T) {
+	_, reg := pkg.NewVeryFastRegistryWithoutDB(t)
+
+	p := oidc.NewProviderGoogle(&oidc.Configuration{
+		Provider:        "google",
+		ID:              "valid",
+		ClientID:        "client",
+		ClientSecret:    "secret",
+		Mapper:          "file://./stub/hydra.schema.json",
+		RequestedClaims: nil,
+		Scope:           []string{"email", "profile", "offline_access"},
+	}, reg)
+
+	r := &login.Flow{
+		ID: x.NewUUID(),
+	}
+
+	options := p.(oidc.OAuth2Provider).AuthCodeURLOptions(r)
+	assert.Contains(t, options, oauth2.AccessTypeOffline)
+}
+
+func TestGoogleVerify(t *testing.T) {
+	t.Parallel()
+
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(200)
+		_, _ = w.Write(publicJWKS)
+	}))
+
+	tsOtherJWKS := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(200)
+		_, _ = w.Write(publicJWKS2)
+	}))
+
+	makeClaims := func(aud string) jwt.RegisteredClaims {
+		return jwt.RegisteredClaims{
+			Issuer:    "https://accounts.google.com",
+			Subject:   "acme@ory.sh",
+			Audience:  jwt.ClaimStrings{aud},
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(24 * time.Hour)),
+		}
+	}
+	createProvider := func(jwksUrl string) *oidc.ProviderGoogle {
+		_, reg := pkg.NewVeryFastRegistryWithoutDB(t)
+		p := oidc.NewProviderGoogle(&oidc.Configuration{
+			Provider:        "google",
+			ID:              "valid",
+			ClientID:        "com.example.app",
+			ClientSecret:    "secret",
+			Mapper:          "file://./stub/hydra.schema.json",
+			RequestedClaims: nil,
+			Scope:           []string{"email", "profile", "offline_access"},
+		}, reg).(*oidc.ProviderGoogle)
+		p.JWKSUrl = jwksUrl
+		return p
+	}
+	t.Run("case=successful verification", func(t *testing.T) {
+		p := createProvider(ts.URL)
+		token := createIDToken(t, makeClaims("com.example.app"))
+
+		c, err := p.Verify(context.Background(), token)
+		require.NoError(t, err)
+		assert.Equal(t, "acme@ory.sh", c.Email)
+		assert.Equal(t, "acme@ory.sh", c.Subject)
+		assert.Equal(t, "https://accounts.google.com", c.Issuer)
+	})
+
+	t.Run("case=fails due to client_id mismatch", func(t *testing.T) {
+		p := createProvider(ts.URL)
+		token := createIDToken(t, makeClaims("com.different-example.app"))
+
+		_, err := p.Verify(context.Background(), token)
+		require.Error(t, err)
+		assert.Equal(t, `token audience didn't match allowed audiences: [com.example.app] oidc: expected audience "com.example.app" got ["com.different-example.app"]`, err.Error())
+	})
+
+	t.Run("case=fails due to jwks mismatch", func(t *testing.T) {
+		p := createProvider(tsOtherJWKS.URL)
+		token := createIDToken(t, makeClaims("com.example.app"))
+
+		_, err := p.Verify(context.Background(), token)
+		require.Error(t, err)
+		assert.Equal(t, "failed to verify signature: failed to verify id token signature", err.Error())
+	})
+
+	t.Run("case=succeedes with additional id token audience", func(t *testing.T) {
+		_, reg := pkg.NewFastRegistryWithMocks(t)
+		google := oidc.NewProviderGoogle(&oidc.Configuration{
+			ClientID:                   "something.else.app",
+			AdditionalIDTokenAudiences: []string{"com.example.app"},
+		}, reg).(*oidc.ProviderGoogle)
+		google.JWKSUrl = ts.URL
+		token := createIDToken(t, makeClaims("com.example.app"))
+
+		_, err := google.Verify(context.Background(), token)
+		require.NoError(t, err)
+	})
+}