|
| 1 | +/* |
| 2 | + * Copyright 2020-2021 the original author or authors. |
| 3 | + * |
| 4 | + * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | + * you may not use this file except in compliance with the License. |
| 6 | + * You may obtain a copy of the License at |
| 7 | + * |
| 8 | + * https://www.apache.org/licenses/LICENSE-2.0 |
| 9 | + * |
| 10 | + * Unless required by applicable law or agreed to in writing, software |
| 11 | + * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | + * See the License for the specific language governing permissions and |
| 14 | + * limitations under the License. |
| 15 | + */ |
| 16 | +package sample; |
| 17 | + |
| 18 | +import java.io.IOException; |
| 19 | +import java.util.List; |
| 20 | +import java.util.stream.Collectors; |
| 21 | + |
| 22 | +import com.gargoylesoftware.htmlunit.WebClient; |
| 23 | +import com.gargoylesoftware.htmlunit.WebResponse; |
| 24 | +import com.gargoylesoftware.htmlunit.html.DomElement; |
| 25 | +import com.gargoylesoftware.htmlunit.html.HtmlCheckBoxInput; |
| 26 | +import com.gargoylesoftware.htmlunit.html.HtmlPage; |
| 27 | +import org.junit.Before; |
| 28 | +import org.junit.Test; |
| 29 | +import org.junit.runner.RunWith; |
| 30 | +import org.springframework.beans.factory.annotation.Autowired; |
| 31 | +import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc; |
| 32 | +import org.springframework.boot.test.context.SpringBootTest; |
| 33 | +import org.springframework.boot.test.context.TestConfiguration; |
| 34 | +import org.springframework.boot.test.mock.mockito.MockBean; |
| 35 | +import org.springframework.context.annotation.Bean; |
| 36 | +import org.springframework.context.annotation.Import; |
| 37 | +import org.springframework.http.HttpStatus; |
| 38 | +import org.springframework.security.oauth2.server.authorization.InMemoryOAuth2AuthorizationService; |
| 39 | +import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationConsentService; |
| 40 | +import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService; |
| 41 | +import org.springframework.security.test.context.support.WithMockUser; |
| 42 | +import org.springframework.test.context.junit4.SpringRunner; |
| 43 | +import org.springframework.web.util.UriComponentsBuilder; |
| 44 | + |
| 45 | +import static org.assertj.core.api.Assertions.assertThat; |
| 46 | +import static org.mockito.ArgumentMatchers.any; |
| 47 | +import static org.mockito.Mockito.when; |
| 48 | + |
| 49 | +/** |
| 50 | + * Consent page integration tests for the sample Authorization Server serving a custom Consent page |
| 51 | + * |
| 52 | + * @author Dmitriy Dubson |
| 53 | + */ |
| 54 | +@RunWith(SpringRunner.class) |
| 55 | +@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT) |
| 56 | +@Import({OAuth2AuthorizationServerCustomConsentPageApplicationTests.InMemoryOAuth2AuthorizationServiceTestConfiguration.class}) |
| 57 | +@AutoConfigureMockMvc |
| 58 | +public class OAuth2AuthorizationServerCustomConsentPageApplicationTests { |
| 59 | + @Autowired |
| 60 | + private WebClient webClient; |
| 61 | + |
| 62 | + @MockBean |
| 63 | + private OAuth2AuthorizationConsentService mockAuthorizationConsentService; |
| 64 | + |
| 65 | + private final String testConsentResultEndpoint = "http://127.0.0.1/login/oauth2/code/messaging-client-oidc"; |
| 66 | + |
| 67 | + private final String authorizeEndpoint = UriComponentsBuilder |
| 68 | + .fromPath("/oauth2/authorize") |
| 69 | + .queryParam("response_type", "code") |
| 70 | + .queryParam("client_id", "messaging-client") |
| 71 | + .queryParam("scope", "openid message.read message.write") |
| 72 | + .queryParam("state", "state") |
| 73 | + .queryParam("redirect_uri", testConsentResultEndpoint) |
| 74 | + .toUriString(); |
| 75 | + |
| 76 | + @Before |
| 77 | + public void setUp() { |
| 78 | + this.webClient.getOptions().setThrowExceptionOnFailingStatusCode(false); |
| 79 | + this.webClient.getOptions().setRedirectEnabled(true); |
| 80 | + this.webClient.getCookieManager().clearCookies(); |
| 81 | + when(mockAuthorizationConsentService.findById(any(), any())).thenReturn(null); |
| 82 | + } |
| 83 | + |
| 84 | + @Test |
| 85 | + @WithMockUser("user1") |
| 86 | + public void whenUserConsentsToAllScopesThenReturnAuthorizationCode() throws IOException { |
| 87 | + final HtmlPage consentPage = webClient.getPage(authorizeEndpoint); |
| 88 | + assertThat(consentPage.getTitleText()).isEqualTo("Custom consent page - Consent required"); |
| 89 | + |
| 90 | + List<HtmlCheckBoxInput> scopes = consentPage.querySelectorAll("input[name='scope']").stream() |
| 91 | + .map(scope -> (HtmlCheckBoxInput) scope).collect(Collectors.toList()); |
| 92 | + for (HtmlCheckBoxInput scope : scopes) { |
| 93 | + scope.click(); |
| 94 | + } |
| 95 | + |
| 96 | + assertThat(scopes.stream().map(DomElement::getId).collect(Collectors.toList())) |
| 97 | + .containsExactlyInAnyOrder("openid", "message.read", "message.write"); |
| 98 | + assertThat(scopes.stream().allMatch(HtmlCheckBoxInput::isChecked)).isTrue(); |
| 99 | + |
| 100 | + DomElement submitConsentButton = consentPage.querySelector("button[id='submit-consent']"); |
| 101 | + this.webClient.getOptions().setRedirectEnabled(false); |
| 102 | + |
| 103 | + WebResponse approveConsentResponse = submitConsentButton.click().getWebResponse(); |
| 104 | + assertThat(approveConsentResponse.getStatusCode()).isEqualTo(HttpStatus.MOVED_PERMANENTLY.value()); |
| 105 | + String location = approveConsentResponse.getResponseHeaderValue("location"); |
| 106 | + assertThat(location).startsWith(testConsentResultEndpoint); |
| 107 | + assertThat(location).contains("code="); |
| 108 | + } |
| 109 | + |
| 110 | + @Test |
| 111 | + @WithMockUser("user1") |
| 112 | + public void whenUserCancelsApprovingConsentThenReturnAnAccessDeniedError() throws IOException { |
| 113 | + final HtmlPage consentPage = webClient.getPage(authorizeEndpoint); |
| 114 | + assertThat(consentPage.getTitleText()).isEqualTo("Custom consent page - Consent required"); |
| 115 | + |
| 116 | + DomElement cancelConsentButton = consentPage.querySelector("button[id='cancel-consent']"); |
| 117 | + this.webClient.getOptions().setRedirectEnabled(false); |
| 118 | + |
| 119 | + WebResponse cancelConsentResponse = cancelConsentButton.click().getWebResponse(); |
| 120 | + assertThat(cancelConsentResponse.getStatusCode()).isEqualTo(HttpStatus.MOVED_PERMANENTLY.value()); |
| 121 | + String location = cancelConsentResponse.getResponseHeaderValue("location"); |
| 122 | + assertThat(location).contains("error=access_denied"); |
| 123 | + } |
| 124 | + |
| 125 | + @TestConfiguration |
| 126 | + static class InMemoryOAuth2AuthorizationServiceTestConfiguration { |
| 127 | + @Bean |
| 128 | + public OAuth2AuthorizationService authorizationService() { |
| 129 | + return new InMemoryOAuth2AuthorizationService(); |
| 130 | + } |
| 131 | + } |
| 132 | +} |
0 commit comments