view release on metacpan or  search on metacpan

t/catalyst-app.t  view on Meta::CPAN

use v5.36;
use Test::More;
use lib 't/lib';
use HTTP::Request::Common qw/GET POST/;
use JSON::MaybeXS qw/encode_json decode_json/;
use Digest::SHA qw/sha256/;
use MIME::Base64 qw/encode_base64url/;
use Crypt::JWT qw/decode_jwt/;

use Catalyst::Test 'TestApp';

my $KEY = 'integration-signing-key-0123456789';

# --- AS metadata ---
{
    my $res = request( GET '/.well-known/oauth-authorization-server' );
    ok( $res->is_success, 'metadata 200' );
    my $m = decode_json( $res->content );
    is_deeply( $m->{code_challenge_methods_supported}, ['S256'], 'S256 advertised' );
    is( $m->{registration_endpoint}, 'http://localhost/oauth/register',
        'registration endpoint' );
}

# --- DCR ---
my $client_id;
{
    my $res = request( POST '/oauth/register',
        'Content-Type' => 'application/json',
        Content => encode_json({ redirect_uris => ['https://app/cb'] }) );
    is( $res->code, 201, 'register 201' );
    $client_id = decode_json( $res->content )->{client_id};
    ok( $client_id, 'got client_id' );
}

# --- DCR rate-limit gate denies when the app says so ---
{
    my $res = request( POST '/oauth/register',
        'Content-Type' => 'application/json',
        'X-Deny-DCR'   => 1,
        Content => encode_json({ redirect_uris => ['https://app/cb'] }) );
    is( $res->code, 429, 'rate-limit gate -> 429' );
    is( decode_json( $res->content )->{error}, 'too_many_requests', 'error body' );
}

# --- authorize: our TestApp authn hook auto-consents as "user-1" and
#     redirects to redirect_uri?code=... ---
my $verifier  = 'the-code-verifier-value-0123456789012345678';
my $challenge = encode_base64url( sha256($verifier) );
my $code;
{
    my $res = request( GET '/oauth/authorize?'
        . "client_id=$client_id&redirect_uri=https://app/cb&response_type=code"
        . "&code_challenge=$challenge&code_challenge_method=S256"
        . '&scope=example:read&resource=https://rs/mcp&state=st1' );
    is( $res->code, 302, 'authorize redirects' );
    my $loc = $res->header('Location');
    like( $loc, qr{\Qhttps://app/cb\E\?code=}, 'redirect carries code' );
    like( $loc, qr/state=st1/, 'redirect carries state' );
    ($code) = $loc =~ /code=([^&]+)/;
    ok( $code, 'extracted code' );
}

# --- token: authorization_code grant ---
my $refresh;