tests: renamed other_client fixture in trusted_client

tests/oidc/conftest.py

@@ -41,7 +41,7 @@ def configuration(configuration, keypair):
 
 
 @pytest.fixture
-def client(testclient, other_client, backend):
+def client(testclient, trusted_client, backend):
     c = models.Client(
         client_id=gen_salt(24),
         client_name="Some client",
@@ -69,7 +69,7 @@ def client(testclient, other_client, backend):
         token_endpoint_auth_method="client_secret_basic",
         post_logout_redirect_uris=["https://mydomain.tld/disconnected"],
     )
-    c.audience = [c, other_client]
+    c.audience = [c, trusted_client]
     c.save()
 
     yield c
@@ -77,7 +77,7 @@ def client(testclient, other_client, backend):
 
 
 @pytest.fixture
-def other_client(testclient, backend):
+def trusted_client(testclient, backend):
     c = models.Client(
         client_id=gen_salt(24),
         client_name="Some other client",
@@ -104,6 +104,7 @@ def other_client(testclient, backend):
         jwks_uri="https://myotherdomain.tld/jwk",
         token_endpoint_auth_method="client_secret_basic",
         post_logout_redirect_uris=["https://myotherdomain.tld/disconnected"],
+        preconsent=True,
     )
     c.audience = [c]
     c.save()

tests/oidc/test_authorization_code_flow.py

@@ -13,7 +13,7 @@ from . import client_credentials
 
 
 def test_authorization_code_flow(
-    testclient, logged_user, client, keypair, other_client
+    testclient, logged_user, client, keypair, trusted_client
 ):
     assert not models.Consent.query()
 
@@ -81,13 +81,13 @@ def test_authorization_code_flow(
     claims = jwt.decode(access_token, keypair[1])
     assert claims["sub"] == logged_user.user_name
     assert claims["name"] == logged_user.formatted_name
-    assert claims["aud"] == [client.client_id, other_client.client_id]
+    assert claims["aud"] == [client.client_id, trusted_client.client_id]
 
     id_token = res.json["id_token"]
     claims = jwt.decode(id_token, keypair[1])
     assert claims["sub"] == logged_user.user_name
     assert claims["name"] == logged_user.formatted_name
-    assert claims["aud"] == [client.client_id, other_client.client_id]
+    assert claims["aud"] == [client.client_id, trusted_client.client_id]
 
     res = testclient.get(
         "/oauth/userinfo",
@@ -114,7 +114,7 @@ def test_invalid_client(testclient, logged_user, keypair):
 
 
 def test_authorization_code_flow_with_redirect_uri(
-    testclient, logged_user, client, keypair, other_client
+    testclient, logged_user, client, keypair, trusted_client
 ):
     assert not models.Consent.query()
 
@@ -161,7 +161,7 @@ def test_authorization_code_flow_with_redirect_uri(
 
 
 def test_authorization_code_flow_preconsented(
-    testclient, logged_user, client, keypair, other_client
+    testclient, logged_user, client, keypair, trusted_client
 ):
     assert not models.Consent.query()
 
@@ -209,7 +209,7 @@ def test_authorization_code_flow_preconsented(
     claims = jwt.decode(id_token, keypair[1])
     assert logged_user.user_name == claims["sub"]
     assert logged_user.formatted_name == claims["name"]
-    assert [client.client_id, other_client.client_id] == claims["aud"]
+    assert [client.client_id, trusted_client.client_id] == claims["aud"]
 
     res = testclient.get(
         "/oauth/userinfo",
@@ -584,7 +584,7 @@ def test_authorization_code_flow_when_consent_already_given_but_for_a_smaller_sc
 
 
 def test_authorization_code_flow_but_user_cannot_use_oidc(
-    testclient, user, client, keypair, other_client
+    testclient, user, client, keypair, trusted_client
 ):
     testclient.app.config["ACL"]["DEFAULT"]["PERMISSIONS"] = []
     user.reload()
@@ -645,16 +645,17 @@ def test_nonce_not_required_in_oauth_requests(testclient, logged_user, client):
 
 
 def test_authorization_code_request_scope_too_large(
-    testclient, logged_user, keypair, other_client
+    testclient, logged_user, keypair, client
 ):
     assert not models.Consent.query()
-    assert "email" not in other_client.scope
+    client.scope = ["openid", "profile", "groups"]
+    client.save()
 
     res = testclient.get(
         "/oauth/authorize",
         params=dict(
             response_type="code",
-            client_id=other_client.client_id,
+            client_id=client.client_id,
             scope="openid profile email",
             nonce="somenonce",
         ),
@@ -671,7 +672,7 @@ def test_authorization_code_request_scope_too_large(
         "profile",
     }
 
-    consents = models.Consent.query(client=other_client, subject=logged_user)
+    consents = models.Consent.query(client=client, subject=logged_user)
     assert set(consents[0].scope) == {
         "openid",
         "profile",
@@ -683,15 +684,15 @@ def test_authorization_code_request_scope_too_large(
             grant_type="authorization_code",
             code=code,
             scope="openid profile email groups address phone",
-            redirect_uri=other_client.redirect_uris[0],
+            redirect_uri=client.redirect_uris[0],
         ),
-        headers={"Authorization": f"Basic {client_credentials(other_client)}"},
+        headers={"Authorization": f"Basic {client_credentials(client)}"},
         status=200,
     )
 
     access_token = res.json["access_token"]
     token = models.Token.get(access_token=access_token)
-    assert token.client == other_client
+    assert token.client == client
     assert token.subject == logged_user
     assert set(token.scope) == {
         "openid",

tests/oidc/test_client_admin.py

@@ -21,7 +21,7 @@ def test_client_list(testclient, client, logged_admin):
     res.mustcontain(client.client_name)
 
 
-def test_client_list_pagination(testclient, logged_admin, client, other_client):
+def test_client_list_pagination(testclient, logged_admin, client, trusted_client):
     res = testclient.get("/admin/client")
     res.mustcontain("2 items")
     clients = []
@@ -67,18 +67,18 @@ def test_client_list_bad_pages(testclient, logged_admin):
     )
 
 
-def test_client_list_search(testclient, logged_admin, client, other_client):
+def test_client_list_search(testclient, logged_admin, client, trusted_client):
     res = testclient.get("/admin/client")
     res.mustcontain("2 items")
     res.mustcontain(client.client_name)
-    res.mustcontain(other_client.client_name)
+    res.mustcontain(trusted_client.client_name)
 
     form = res.forms["search"]
     form["query"] = "other"
     res = form.submit()
 
     res.mustcontain("1 item")
-    res.mustcontain(other_client.client_name)
+    res.mustcontain(trusted_client.client_name)
     res.mustcontain(no=client.client_name)
 
 
@@ -144,7 +144,7 @@ def test_add_missing_fields(testclient, logged_admin):
     ) in res.flashes
 
 
-def test_client_edit(testclient, client, logged_admin, other_client):
+def test_client_edit(testclient, client, logged_admin, trusted_client):
     res = testclient.get("/admin/client/edit/" + client.client_id)
     data = {
         "client_name": "foobar",
@@ -162,7 +162,7 @@ def test_client_edit(testclient, client, logged_admin, other_client):
         "software_version": "1",
         "jwk": "jwk",
         "jwks_uri": "https://foo.bar/jwks.json",
-        "audience": [client.id, other_client.id],
+        "audience": [client.id, trusted_client.id],
         "preconsent": True,
         "post_logout_redirect_uris-0": "https://foo.bar/disconnected",
     }
@@ -196,12 +196,12 @@ def test_client_edit(testclient, client, logged_admin, other_client):
     assert client.software_version == "1"
     assert client.jwk == "jwk"
     assert client.jwks_uri == "https://foo.bar/jwks.json"
-    assert client.audience == [client, other_client]
+    assert client.audience == [client, trusted_client]
     assert not client.preconsent
     assert client.post_logout_redirect_uris == ["https://foo.bar/disconnected"]
 
 
-def test_client_edit_missing_fields(testclient, client, logged_admin, other_client):
+def test_client_edit_missing_fields(testclient, client, logged_admin, trusted_client):
     res = testclient.get("/admin/client/edit/" + client.client_id)
     res.forms["clientaddform"]["client_name"] = ""
     res = res.forms["clientaddform"].submit(name="action", value="edit")
@@ -255,7 +255,7 @@ def test_client_delete_invalid_client(testclient, logged_admin, client):
     )
 
 
-def test_client_edit_preauth(testclient, client, logged_admin, other_client):
+def test_client_edit_preauth(testclient, client, logged_admin, trusted_client):
     assert not client.preconsent
 
     res = testclient.get("/admin/client/edit/" + client.client_id)
@@ -275,7 +275,7 @@ def test_client_edit_preauth(testclient, client, logged_admin, other_client):
     assert not client.preconsent
 
 
-def test_client_edit_invalid_uri(testclient, client, logged_admin, other_client):
+def test_client_edit_invalid_uri(testclient, client, logged_admin, trusted_client):
     res = testclient.get("/admin/client/edit/" + client.client_id)
     res.forms["clientaddform"]["client_uri"] = "invalid"
     res = res.forms["clientaddform"].submit(status=200, name="action", value="edit")

tests/oidc/test_hybrid_flow.py

@@ -46,7 +46,7 @@ def test_oauth_hybrid(testclient, backend, user, client):
     assert res.json["name"] == "John (johnny) Doe"
 
 
-def test_oidc_hybrid(testclient, backend, logged_user, client, keypair, other_client):
+def test_oidc_hybrid(testclient, backend, logged_user, client, keypair, trusted_client):
     res = testclient.get(
         "/oauth/authorize",
         params=dict(
@@ -75,7 +75,7 @@ def test_oidc_hybrid(testclient, backend, logged_user, client, keypair, other_cl
     claims = jwt.decode(id_token, keypair[1])
     assert logged_user.user_name == claims["sub"]
     assert logged_user.formatted_name == claims["name"]
-    assert [client.client_id, other_client.client_id] == claims["aud"]
+    assert [client.client_id, trusted_client.client_id] == claims["aud"]
 
     res = testclient.get(
         "/oauth/userinfo",

tests/oidc/test_implicit_flow.py

@@ -50,7 +50,7 @@ def test_oauth_implicit(testclient, user, client):
     client.save()
 
 
-def test_oidc_implicit(testclient, keypair, user, client, other_client):
+def test_oidc_implicit(testclient, keypair, user, client, trusted_client):
     client.grant_types = ["token id_token"]
     client.token_endpoint_auth_method = "none"
 
@@ -88,7 +88,7 @@ def test_oidc_implicit(testclient, keypair, user, client, other_client):
     claims = jwt.decode(id_token, keypair[1])
     assert user.user_name == claims["sub"]
     assert user.formatted_name == claims["name"]
-    assert [client.client_id, other_client.client_id] == claims["aud"]
+    assert [client.client_id, trusted_client.client_id] == claims["aud"]
 
     res = testclient.get(
         "/oauth/userinfo",
@@ -104,7 +104,7 @@ def test_oidc_implicit(testclient, keypair, user, client, other_client):
 
 
 def test_oidc_implicit_with_group(
-    testclient, keypair, user, client, foo_group, other_client
+    testclient, keypair, user, client, foo_group, trusted_client
 ):
     client.grant_types = ["token id_token"]
     client.token_endpoint_auth_method = "none"
@@ -143,7 +143,7 @@ def test_oidc_implicit_with_group(
     claims = jwt.decode(id_token, keypair[1])
     assert user.user_name == claims["sub"]
     assert user.formatted_name == claims["name"]
-    assert [client.client_id, other_client.client_id] == claims["aud"]
+    assert [client.client_id, trusted_client.client_id] == claims["aud"]
     assert ["foo"] == claims["groups"]
 
     res = testclient.get(

tests/oidc/test_token_introspection.py

@@ -58,7 +58,7 @@ def test_token_invalid(testclient, client):
     assert {"active": False} == res.json
 
 
-def test_full_flow(testclient, logged_user, client, user, other_client):
+def test_full_flow(testclient, logged_user, client, user, trusted_client):
     res = testclient.get(
         "/oauth/authorize",
         params=dict(
@@ -103,7 +103,7 @@ def test_full_flow(testclient, logged_user, client, user, other_client):
         headers={"Authorization": f"Basic {client_credentials(client)}"},
         status=200,
     )
-    assert set(res.json["aud"]) == {client.client_id, other_client.client_id}
+    assert set(res.json["aud"]) == {client.client_id, trusted_client.client_id}
     assert res.json["active"]
     assert res.json["client_id"] == client.client_id
     assert res.json["token_type"] == token.type