view release on metacpan or  search on metacpan

t/server-dcr.t  view on Meta::CPAN

        engine( metadata_max_bytes => 64 )->register_client({
            redirect_uris => ['https://app.example/cb'],
            blob          => 'y' x 200,
        });
    };
    is( $e->error, 'invalid_client_metadata', 'oversize metadata rejected' );
}

# javascript: / non-https redirect_uri rejected
{
    my $e = exception {
        engine->register_client({ redirect_uris => ['javascript:alert(1)'] });
    };
    is( $e->error, 'invalid_client_metadata', 'javascript: redirect rejected' );
}
# plain http (non-loopback) rejected; loopback http allowed
{
    my $e = exception {
        engine->register_client({ redirect_uris => ['http://evil.example/cb'] });
    };
    is( $e->error, 'invalid_client_metadata', 'non-loopback http rejected' );
    my $ok = engine->register_client({ redirect_uris => ['http://127.0.0.1/cb'] });
    like( $ok->{client_id}, qr/\A[A-Za-z0-9_-]+\z/, 'loopback http allowed' );
}
# fragment rejected
{
    my $e = exception {
        engine->register_client({ redirect_uris => ['https://app/cb#frag'] });
    };
    is( $e->error, 'invalid_client_metadata', 'redirect_uri with fragment rejected' );
}

# --- RFC 7591 3.2.1: metadata values this AS does not advertise are rejected ---

# token_endpoint_auth_method: metadata advertises 'none' only
{
    my $e = exception {
        engine->register_client({
            redirect_uris              => ['https://app.example/cb'],
            token_endpoint_auth_method => 'client_secret_basic',
        });
    };
    isa_ok( $e, 'Catalyst::Plugin::OAuth2::AuthorizationServer::Error',
        'client_secret_basic registration' );
    is( $e->error, 'invalid_client_metadata',
        'unadvertised token_endpoint_auth_method rejected' );

    my $ok = engine->register_client({
        redirect_uris              => ['https://app.example/cb'],
        token_endpoint_auth_method => 'none',
    });
    is( $ok->{token_endpoint_auth_method}, 'none',
        'the advertised token_endpoint_auth_method is accepted' );
}

# grant_types: metadata advertises authorization_code + refresh_token
{
    my $e = exception {
        engine->register_client({
            redirect_uris => ['https://app.example/cb'],
            grant_types   => [ 'authorization_code', 'client_credentials' ],
        });
    };
    is( $e->error, 'invalid_client_metadata', 'unadvertised grant_type rejected' );

    my $ok = engine->register_client({
        redirect_uris => ['https://app.example/cb'],
        grant_types   => [ 'authorization_code', 'refresh_token' ],
    });
    is_deeply( $ok->{grant_types}, [ 'authorization_code', 'refresh_token' ],
        'advertised grant_types accepted' );
}

# response_types: metadata advertises 'code' only
{
    my $e = exception {
        engine->register_client({
            redirect_uris  => ['https://app.example/cb'],
            response_types => ['token'],
        });
    };
    is( $e->error, 'invalid_client_metadata', 'unadvertised response_type rejected' );

    my $ok = engine->register_client({
        redirect_uris  => ['https://app.example/cb'],
        response_types => ['code'],
    });
    is_deeply( $ok->{response_types}, ['code'], 'advertised response_type accepted' );
}

# the list-valued fields must actually be lists of strings
{
    for my $bad ( 'authorization_code', [], [ {} ] ) {
        my $e = exception {
            engine->register_client({
                redirect_uris => ['https://app.example/cb'],
                grant_types   => $bad,
            });
        };
        is( $e->error, 'invalid_client_metadata',
            'grant_types must be a non-empty array of strings' );
    }
}

# scope is only constrained when the AS advertises scopes_supported
{
    my $e = exception {
        engine( scopes_supported => ['example:read'] )->register_client({
            redirect_uris => ['https://app.example/cb'],
            scope         => 'example:read admin:all',
        });
    };
    is( $e->error, 'invalid_client_metadata', 'unadvertised scope rejected' );

    my $ok = engine( scopes_supported => ['example:read'] )->register_client({
        redirect_uris => ['https://app.example/cb'],
        scope         => 'example:read',
    });
    is( $ok->{scope}, 'example:read', 'advertised scope accepted' );

    my $free = engine->register_client({