wip

tests/test_hybrid_flow.py

@@ -1,9 +1,9 @@
-from . import client_credentials
+from authlib.jose import jwt
 from urllib.parse import urlsplit, parse_qs
 from web.models import AuthorizationCode, Token
 
 
-def test_success(testclient, slapd_connection, user, client):
+def test_oauth_hybrid(testclient, slapd_connection, user, client):
     res = testclient.get(
         "/oauth/authorize",
         params=dict(
@@ -40,3 +40,40 @@ def test_success(testclient, slapd_connection, user, client):
     res = testclient.get("/api/me", headers={"Authorization": f"Bearer {access_token}"})
     assert 200 == res.status_code
     assert {"foo": "bar"} == res.json
+
+
+def test_oidc_hybrid(testclient, slapd_connection, user, client):
+    with testclient.session_transaction() as sess:
+        sess["user_dn"] = user.dn
+
+    res = testclient.get(
+        "/oauth/authorize",
+        params=dict(
+            response_type="code id_token token",
+            client_id=client.oauthClientID,
+            scope="openid profile",
+            nonce="somenonce",
+        ),
+    )
+    assert (200, "text/html") == (res.status_code, res.content_type), res.json
+
+    res = res.forms["accept"].submit()
+    assert 302 == res.status_code
+
+    assert res.location.startswith(client.oauthRedirectURIs[0])
+    params = parse_qs(urlsplit(res.location).fragment)
+
+    code = params["code"][0]
+    authcode = AuthorizationCode.get(code, conn=slapd_connection)
+    assert authcode is not None
+
+    access_token = params["access_token"][0]
+    token = Token.get(access_token, conn=slapd_connection)
+    assert token is not None
+
+    id_token = params["id_token"][0]
+#    claims = jwt.decode(id_token, None)
+
+    res = testclient.get("/api/me", headers={"Authorization": f"Bearer {access_token}"})
+    assert 200 == res.status_code
+    assert {"foo": "bar"} == res.json

web/oauth2utils.py

@@ -127,11 +127,10 @@ class OpenIDHybridGrant(_OpenIDHybridGrant):
         return exists_nonce(nonce, request)
 
     def get_jwt_config(self):
-        raise NotImplementedError()
         return DUMMY_JWT_CONFIG
 
     def generate_user_info(self, user, scope):
-        raise NotImplementedError()
+        user = User.get(user)
         return generate_user_info(user, scope)