Add KeyCape PKCE browser sessions

tests/test_oidc.py

@@ -0,0 +1,34 @@
+import unittest
+from urllib.parse import parse_qs, urlparse
+
+from user_engine.oidc import BrowserSession, OIDCClient, cookie_value
+
+
+class OIDCClientTests(unittest.TestCase):
+    def setUp(self):
+        self.client = OIDCClient(
+            issuer="https://kc.example",
+            client_id="portal",
+            redirect_uri="https://users.example/oidc/callback",
+            audience="portal",
+        )
+
+    def test_begin_uses_s256_and_one_time_state(self):
+        url = urlparse(self.client.begin())
+        query = parse_qs(url.query)
+        self.assertEqual(["S256"], query["code_challenge_method"])
+        self.assertEqual(["portal"], query["client_id"])
+        self.assertIn(query["state"][0], self.client.pending)
+        self.assertNotIn(self.client.pending[query["state"][0]].verifier, url.query)
+
+    def test_opaque_session_and_cookie_parser(self):
+        self.client.sessions["opaque"] = BrowserSession(
+            claims={"sub": "person"}, expires_at=9999999999
+        )
+        self.assertEqual("person", self.client.claims("opaque")["sub"])
+        self.assertEqual("opaque", cookie_value("x=1; ue_session=opaque", "ue_session"))
+        self.client.logout("opaque")
+        self.assertIsNone(self.client.claims("opaque"))
+
+    def test_unknown_session_is_rejected(self):
+        self.assertIsNone(self.client.claims("not-there"))