coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix UserInfo canonical subject resolution
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 23s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
This commit is contained in:
tegwick 2026-08-31 23:41:29 +02:00
parent 49dabb2d5c
commit 153258b9d3
3 changed files with 112 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

30
src/internal/server/oidc/userinfo_test.go
View file

@ -100,6 +100,36 @@ func TestUserinfoHandler_ValidToken_ReturnsClaims(t *testing.T) {
}
}
func TestUserinfoHandler_CanonicalSubjectResolvesViaPreferredUsername(t *testing.T) {
user := aliceUser()
users := &mockUserRepo{users: map[string]*domain.User{"alice": user}}
h, key := newUserinfoHandler(t, users)
now := time.Now()
token := buildToken(t, map[string]interface{}{
"iss": "https://auth.netkingdom.local",
"sub": user.ID,
"preferred_username": user.Username,
"aud": "test-client",
"exp": now.Add(10 * time.Minute).Unix(),
"iat": now.Unix(),
"scope": "openid profile",
}, key)
w := httptest.NewRecorder()
h.ServeHTTP(w, userinfoRequest(token))
if w.Code != http.StatusOK {
t.Fatalf("expected 200, got %d (body: %s)", w.Code, w.Body.String())
}
resp := decodeUserinfoClaims(t, w.Body.String())
if resp["sub"] != user.ID {
t.Errorf("sub: expected %q, got %v", user.ID, resp["sub"])
}
if resp["preferred_username"] != user.Username {
t.Errorf("preferred_username: expected %q, got %v", user.Username, resp["preferred_username"])
}
}
func TestUserinfoHandler_SuspendedUserInvalidatesToken(t *testing.T) {
user := aliceUser()
user.Groups = append(user.Groups, "netkingdom-suspended")