Dan MilneandClaude Opus 4.8
f65f8da2e7
Security-review follow-ups on the OIDC flows. IPv6 loopback redirect_uri in dynamic client registration (RFC 8252): - valid_redirect_uri? compared URI#host, which returns the bracketed "[::1]" for IPv6 literals, so http://[::1]:PORT/... was always rejected. Compare #hostname (unbracketed) instead, unblocking IPv6-only native clients. Extract redirect_authorize_error (removes 12 copies of the boilerplate): - The authorize/consent flows built the error redirect by hand ~a dozen times (error_uri = "...?error=..."; += "&error_description=#{CGI.escape ...}"; += state; redirect_to). One helper now composes the query, and — unlike every copy — appends "&error=..." when the redirect_uri already has a query string instead of a malformed second "?". Extract token-endpoint helpers (removes ~80 duplicated lines): - authenticate_token_client: the identical client-auth preamble shared by the authorization-code, refresh, and device-code grants. - render_token_triple: the access + refresh + id_token mint and RFC 6749 §5.1 response shared by the authorization-code and device-code grants. Single source of truth for scope descriptions: - New OidcHelper#scope_description + shared shared/_scope_list partial, used by both the browser consent screen and the device authorization screen; drops the scope_labels hash and the hard-coded per-scope blocks that would have drifted. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016Q4ATZHoMCWqvSpE2yYoie
25 lines
1.2 KiB
Ruby
25 lines
1.2 KiB
Ruby
require "test_helper"
|
|
|
|
class OidcHelperTest < ActionView::TestCase
|
|
test "scope_description returns a human-readable label for each supported scope" do
|
|
user = User.new(email_address: "person@example.com")
|
|
assert_equal "Verify your identity", scope_description("openid", user: user)
|
|
assert_equal "Access your email address (person@example.com)", scope_description("email", user: user)
|
|
assert_equal "Access your profile information", scope_description("profile", user: user)
|
|
assert_equal "Access your group memberships", scope_description("groups", user: user)
|
|
assert_equal "Stay signed in (refresh access)", scope_description("offline_access", user: user)
|
|
end
|
|
|
|
test "scope_description covers every SUPPORTED_SCOPE (so the consent screens can't silently drop one)" do
|
|
user = User.new(email_address: "person@example.com")
|
|
OidcController::SUPPORTED_SCOPES.each do |scope|
|
|
assert_not_equal scope, scope_description(scope, user: user),
|
|
"#{scope} has no description and would render as its raw name"
|
|
end
|
|
end
|
|
|
|
test "scope_description falls back to the raw scope name for unknown scopes" do
|
|
assert_equal "somethingelse", scope_description("somethingelse", user: User.new)
|
|
end
|
|
end
|