44 lines
1.6 KiB
Elixir
44 lines
1.6 KiB
Elixir
defmodule WhoNeedHelp.SocialOAuthTest do
|
|
use ExUnit.Case, async: true
|
|
|
|
alias WhoNeedHelp.SocialOAuth.GithubStrategy
|
|
|
|
test "GitHub authorization uses state and PKCE without requesting extra scopes" do
|
|
assert {:ok, %{url: url, session_params: session_params}} =
|
|
GithubStrategy.authorize_url(
|
|
client_id: "client",
|
|
client_secret: "secret",
|
|
redirect_uri: "https://example.test/auth/social/github/callback"
|
|
)
|
|
|
|
uri = URI.parse(url)
|
|
params = URI.decode_query(uri.query)
|
|
|
|
assert uri.host == "github.com"
|
|
assert params["client_id"] == "client"
|
|
assert params["redirect_uri"] == "https://example.test/auth/social/github/callback"
|
|
assert params["state"] == session_params.state
|
|
assert params["code_challenge_method"] == "S256"
|
|
assert is_binary(session_params.code_verifier)
|
|
assert is_binary(session_params.code_challenge)
|
|
refute Map.has_key?(params, "scope")
|
|
end
|
|
|
|
test "normalizes only the public GitHub identity fields" do
|
|
assert {:ok, normalized} =
|
|
GithubStrategy.normalize([], %{
|
|
"id" => 123,
|
|
"login" => "alice",
|
|
"name" => "Alice",
|
|
"html_url" => "https://github.com/alice",
|
|
"avatar_url" => "https://avatars.githubusercontent.com/u/123",
|
|
"access_token" => "must-not-leak"
|
|
})
|
|
|
|
assert normalized["sub"] == 123
|
|
assert normalized["preferred_username"] == "alice"
|
|
refute Map.has_key?(normalized, "access_token")
|
|
refute Map.has_key?(normalized, "email")
|
|
end
|
|
end
|