andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-15 10:25:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
* fix: client_id verification during code exchange and refresh token flows

* add clientID check for device token flow

* Trigger Build
This commit is contained in:
Gayathri Vijayan
2026-06-16 15:19:56 +02:00
committed by GitHub
parent e94d4c3986
commit 0973b074b4
8 changed files with 257 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/command/oidc_session_test.go
+59 -2
View File
@@ -1644,10 +1644,13 @@ func TestCommands_CreateOIDCSession(t *testing.T) {
}
func mockRefreshTokenComplianceChecker(returnErr error) RefreshTokenComplianceChecker {
return func(_ context.Context, wm *OIDCSessionWriteModel, scope []string) ([]string, error) {
return func(_ context.Context, wm *OIDCSessionWriteModel, scope []string, clientID string) ([]string, error) {
if returnErr != nil {
return nil, returnErr
}
if wm.ClientID != clientID {
return nil, zerrors.ThrowInvalidArgument(nil, "test", "invalid clientID")
}
if len(scope) > 0 {
return scope, nil
}
@@ -1668,6 +1671,7 @@ func TestCommands_ExchangeOIDCSessionRefreshAndAccessToken(t *testing.T) {
ctx context.Context
refreshToken string
scope []string
reqClientID string
complianceCheck RefreshTokenComplianceChecker
}
type res struct {
@@ -1831,6 +1835,58 @@ func TestCommands_ExchangeOIDCSessionRefreshAndAccessToken(t *testing.T) {
err: zerrors.ThrowPreconditionFailed(nil, "OIDCS-J39h2", "Errors.User.NotActive"),
},
},
{
"refresh with an invalid client id fails",
fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusherWithCreationDateNow(
oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate,
"userID", "org1", "sessionID", "clientID", []string{"audience"}, []string{"openid", "profile", "offline_access"},
[]domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans,
&domain.UserAgent{FingerprintID: gu.Ptr("browserFP")},
),
),
eventFromEventPusherWithCreationDateNow(
oidcsession.NewAccessTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate,
"at_accessTokenID", []string{"openid", "profile", "offline_access"}, time.Hour, domain.TokenReasonAuthRequest, nil),
),
eventFromEventPusherWithCreationDateNow(
oidcsession.NewRefreshTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate,
"rt_refreshTokenID", 7*24*time.Hour, 24*time.Hour),
),
),
expectFilter(
user.NewHumanAddedEvent(
context.Background(),
&user.NewAggregate("userID", "org1").Aggregate,
"username",
"firstname",
"lastname",
"nickname",
"displayname",
language.Afrikaans,
domain.GenderUnspecified,
"email",
false,
),
),
expectFilter(),
),
idGenerator: mock.NewIDGeneratorExpectIDs(t),
keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
},
args{
ctx: authz.WithInstanceID(context.Background(), "instanceID"),
refreshToken: "V2_oidcSessionID-rt_refreshTokenID:userID", //V2_oidcSessionID:rt_refreshTokenID:userID
scope: []string{"openid", "offline_access"},
reqClientID: "differentClientID",
complianceCheck: mockRefreshTokenComplianceChecker(nil),
},
res{
err: zerrors.ThrowInvalidArgument(nil, "test", "invalid clientID"),
},
},
{
"refresh successful",
fields{
@@ -1885,6 +1941,7 @@ func TestCommands_ExchangeOIDCSessionRefreshAndAccessToken(t *testing.T) {
ctx: authz.WithInstanceID(context.Background(), "instanceID"),
refreshToken: "V2_oidcSessionID-rt_refreshTokenID:userID", //V2_oidcSessionID:rt_refreshTokenID:userID
scope: []string{"openid", "offline_access"},
reqClientID: "clientID",
complianceCheck: mockRefreshTokenComplianceChecker(nil),
},
res{
@@ -1918,7 +1975,7 @@ func TestCommands_ExchangeOIDCSessionRefreshAndAccessToken(t *testing.T) {
keyAlgorithm: tt.fields.keyAlgorithm,
authAlgorithm: &mockAuthCrypto{},
}
got, err := c.ExchangeOIDCSessionRefreshAndAccessToken(tt.args.ctx, tt.args.refreshToken, tt.args.scope, tt.args.complianceCheck)
got, err := c.ExchangeOIDCSessionRefreshAndAccessToken(tt.args.ctx, tt.args.refreshToken, tt.args.scope, tt.args.reqClientID, tt.args.complianceCheck)
require.ErrorIs(t, err, tt.res.err)
if got != nil {
assert.WithinRange(t, got.AuthTime, tt.res.session.AuthTime.Add(-time.Second), tt.res.session.AuthTime.Add(time.Second))