9 |
10 |
11 | ## Purpose
12 |
13 | When we create a CLI tool which accesses an API with OAuth, it needs the complicated flow such as copy/paste of a URL and code, as follows:
14 |
15 | 1. User runs the command.
16 | 1. Command shows the URL for authorization.
17 | 1. User opens the browser, logs in to the server and approves the authorization.
18 | 1. Server shows an authorization code.
19 | 1. User copies the code and pastes into the command.
20 | 1. Command accesses the API with the token.
21 |
22 | You can make it simple by using oauth2cli as follows:
23 |
24 | 1. User runs the command.
25 | 1. Command opens the browser.
26 | 1. User logs in to the server and approves the authorization.
27 | 1. Command gets a token and access the API with the token.
28 |
29 |
30 | ## How it works
31 |
32 | oauth2cli starts the local server and initiates the flow of [OAuth 2.0 Authorization Code Grant](https://tools.ietf.org/html/rfc6749#section-4.1).
33 |
34 | Take a look at the sequence diagram:
35 |
36 | 
37 |
38 |
39 | ## Contributions
40 |
41 | This is an open source software licensed under Apache 2.0.
42 | Feel free to open issues and pull requests.
43 |
--------------------------------------------------------------------------------
/docs/diagram.svg:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
--------------------------------------------------------------------------------
/e2e_test/authserver/handler.go:
--------------------------------------------------------------------------------
1 | // Package authserver provides a stub server of the OAuth 2.0 authorization server.
2 | // This supports the authorization code grant described as:
3 | // https://tools.ietf.org/html/rfc6749#section-4.1
4 | package authserver
5 |
6 | import (
7 | "errors"
8 | "fmt"
9 | "net/http"
10 | "net/url"
11 | "testing"
12 | )
13 |
14 | // AuthorizationRequest represents an authorization request described as:
15 | // https://tools.ietf.org/html/rfc6749#section-4.1.1
16 | type AuthorizationRequest struct {
17 | Scope string
18 | State string
19 | RedirectURI string
20 | Raw url.Values
21 | }
22 |
23 | // TokenRequest represents a token request described as:
24 | // https://tools.ietf.org/html/rfc6749#section-4.1.3
25 | type TokenRequest struct {
26 | Code string
27 | Raw url.Values
28 | }
29 |
30 | // Handler handles HTTP requests.
31 | type Handler struct {
32 | TestingT *testing.T
33 |
34 | // This should return a URL with query parameters of authorization response.
35 | // See https://tools.ietf.org/html/rfc6749#section-4.1.2
36 | NewAuthorizationResponse func(req AuthorizationRequest) string
37 |
38 | // This should return a JSON body of access token response or error response.
39 | // See https://tools.ietf.org/html/rfc6749#section-5.1
40 | // and https://tools.ietf.org/html/rfc6749#section-5.2
41 | NewTokenResponse func(req TokenRequest) (int, string)
42 | }
43 |
44 | func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
45 | h.TestingT.Logf("authServer: %s %s", r.Method, r.RequestURI)
46 | if err := h.serveHTTP(w, r); err != nil {
47 | h.TestingT.Errorf("Handler error: %s", err)
48 | http.Error(w, err.Error(), http.StatusInternalServerError)
49 | }
50 | }
51 |
52 | func (h *Handler) serveHTTP(w http.ResponseWriter, r *http.Request) error {
53 | switch {
54 | case r.Method == "GET" && r.URL.Path == "/auth":
55 | q := r.URL.Query()
56 | scope, state, redirectURI := q.Get("scope"), q.Get("state"), q.Get("redirect_uri")
57 | if scope == "" {
58 | return errors.New("scope is missing")
59 | }
60 | if state == "" {
61 | return errors.New("state is missing")
62 | }
63 | if redirectURI == "" {
64 | return errors.New("redirect_uri is missing")
65 | }
66 | authorizationResponseURL := h.NewAuthorizationResponse(AuthorizationRequest{
67 | Scope: scope,
68 | State: state,
69 | RedirectURI: redirectURI,
70 | Raw: q,
71 | })
72 | http.Redirect(w, r, authorizationResponseURL, http.StatusFound)
73 |
74 | case r.Method == "POST" && r.URL.Path == "/token":
75 | if err := r.ParseForm(); err != nil {
76 | return fmt.Errorf("error while parsing form: %w", err)
77 | }
78 | code, redirectURI := r.Form.Get("code"), r.Form.Get("redirect_uri")
79 | if code == "" {
80 | return errors.New("code is missing")
81 | }
82 | if redirectURI == "" {
83 | return errors.New("redirect_uri is missing")
84 | }
85 | status, body := h.NewTokenResponse(TokenRequest{
86 | Code: code,
87 | Raw: r.Form,
88 | })
89 | w.Header().Add("Content-Type", "application/json")
90 | w.WriteHeader(status)
91 | if _, err := w.Write([]byte(body)); err != nil {
92 | return fmt.Errorf("error while writing response body: %w", err)
93 | }
94 |
95 | default:
96 | http.NotFound(w, r)
97 | }
98 | return nil
99 | }
100 |
--------------------------------------------------------------------------------
/e2e_test/client/client.go:
--------------------------------------------------------------------------------
1 | package client
2 |
3 | import (
4 | "crypto/tls"
5 | "crypto/x509"
6 | "fmt"
7 | "io"
8 | "net/http"
9 | "os"
10 | "testing"
11 |
12 | "github.com/google/go-cmp/cmp"
13 | )
14 |
15 | var certPool = x509.NewCertPool()
16 |
17 | func init() {
18 | data, err := os.ReadFile("testdata/ca.crt")
19 | if err != nil {
20 | panic(err)
21 | }
22 | if !certPool.AppendCertsFromPEM(data) {
23 | panic("could not append certificate data")
24 | }
25 | }
26 |
27 | func Get(url string) (int, string, error) {
28 | client := http.Client{Transport: &http.Transport{TLSClientConfig: &tls.Config{RootCAs: certPool}}}
29 | resp, err := client.Get(url)
30 | if err != nil {
31 | return 0, "", fmt.Errorf("could not send a request: %w", err)
32 | }
33 | defer func() {
34 | if err := resp.Body.Close(); err != nil {
35 | panic(err)
36 | }
37 | }()
38 | b, err := io.ReadAll(resp.Body)
39 | if err != nil {
40 | return resp.StatusCode, "", fmt.Errorf("could not read response body: %w", err)
41 | }
42 | return resp.StatusCode, string(b), nil
43 | }
44 |
45 | func GetAndVerify(t *testing.T, url string, code int, body string) {
46 | gotCode, gotBody, err := Get(url)
47 | if err != nil {
48 | t.Errorf("could not open browser request: %s", err)
49 | return
50 | }
51 | if gotCode != code {
52 | t.Errorf("status wants %d but %d", code, gotCode)
53 | }
54 | if gotBody != body {
55 | t.Errorf("response body did not match: %s", cmp.Diff(gotBody, body))
56 | }
57 | }
58 |
--------------------------------------------------------------------------------
/e2e_test/context_test.go:
--------------------------------------------------------------------------------
1 | package e2e_test
2 |
3 | import (
4 | "context"
5 | "errors"
6 | "fmt"
7 | "net/http/httptest"
8 | "testing"
9 | "time"
10 |
11 | "github.com/int128/oauth2cli"
12 | "github.com/int128/oauth2cli/e2e_test/authserver"
13 | "golang.org/x/oauth2"
14 | )
15 |
16 | func TestContextCancelOnWaitingForBrowser(t *testing.T) {
17 | ctx, cancel := context.WithTimeout(context.TODO(), 100*time.Millisecond)
18 | defer cancel()
19 | testServer := httptest.NewServer(&authserver.Handler{
20 | TestingT: t,
21 | NewAuthorizationResponse: func(req authserver.AuthorizationRequest) string {
22 | return fmt.Sprintf("%s?error=server_error", req.RedirectURI)
23 | },
24 | NewTokenResponse: func(req authserver.TokenRequest) (int, string) {
25 | return 500, "should not reach here"
26 | },
27 | })
28 | defer testServer.Close()
29 | cfg := oauth2cli.Config{
30 | OAuth2Config: oauth2.Config{
31 | ClientID: "YOUR_CLIENT_ID",
32 | ClientSecret: "YOUR_CLIENT_SECRET",
33 | Scopes: []string{"email", "profile"},
34 | Endpoint: oauth2.Endpoint{
35 | AuthURL: testServer.URL + "/auth",
36 | TokenURL: testServer.URL + "/token",
37 | },
38 | },
39 | Logf: t.Logf,
40 | }
41 | _, err := oauth2cli.GetToken(ctx, cfg)
42 | if err == nil {
43 | t.Errorf("GetToken wants error but was nil")
44 | return
45 | }
46 | if !errors.Is(err, context.DeadlineExceeded) {
47 | t.Errorf("err wants DeadlineExceeded but %+v", err)
48 | }
49 | }
50 |
51 | func TestContextCancelOnLocalServerReadyChan(t *testing.T) {
52 | ctx, cancel := context.WithTimeout(context.TODO(), 100*time.Millisecond)
53 | defer cancel()
54 | openBrowserCh := make(chan string)
55 | defer close(openBrowserCh)
56 | testServer := httptest.NewServer(&authserver.Handler{
57 | TestingT: t,
58 | NewAuthorizationResponse: func(req authserver.AuthorizationRequest) string {
59 | return fmt.Sprintf("%s?error=server_error", req.RedirectURI)
60 | },
61 | NewTokenResponse: func(req authserver.TokenRequest) (int, string) {
62 | return 500, "should not reach here"
63 | },
64 | })
65 | defer testServer.Close()
66 | cfg := oauth2cli.Config{
67 | OAuth2Config: oauth2.Config{
68 | ClientID: "YOUR_CLIENT_ID",
69 | ClientSecret: "YOUR_CLIENT_SECRET",
70 | Scopes: []string{"email", "profile"},
71 | Endpoint: oauth2.Endpoint{
72 | AuthURL: testServer.URL + "/auth",
73 | TokenURL: testServer.URL + "/token",
74 | },
75 | },
76 | LocalServerReadyChan: openBrowserCh,
77 | Logf: t.Logf,
78 | }
79 | _, err := oauth2cli.GetToken(ctx, cfg)
80 | if err == nil {
81 | t.Errorf("GetToken wants error but was nil")
82 | return
83 | }
84 | if !errors.Is(err, context.DeadlineExceeded) {
85 | t.Errorf("err wants DeadlineExceeded but %+v", err)
86 | }
87 | }
88 |
--------------------------------------------------------------------------------
/e2e_test/e2e_test.go:
--------------------------------------------------------------------------------
1 | package e2e_test
2 |
3 | import (
4 | "context"
5 | "fmt"
6 | "net/http"
7 | "net/http/httptest"
8 | "net/url"
9 | "sync"
10 | "testing"
11 | "time"
12 |
13 | "github.com/int128/oauth2cli"
14 | "github.com/int128/oauth2cli/e2e_test/authserver"
15 | "github.com/int128/oauth2cli/e2e_test/client"
16 | "golang.org/x/oauth2"
17 | )
18 |
19 | const invalidGrantResponse = `{"error":"invalid_grant"}`
20 | const validTokenResponse = `{"access_token": "ACCESS_TOKEN","token_type": "Bearer","expires_in": 3600,"refresh_token": "REFRESH_TOKEN"}`
21 |
22 | func TestHappyPath(t *testing.T) {
23 | ctx, cancel := context.WithTimeout(context.TODO(), 1*time.Second)
24 | defer cancel()
25 | openBrowserCh := make(chan string)
26 | var wg sync.WaitGroup
27 | wg.Add(1)
28 | go func() {
29 | defer wg.Done()
30 | defer close(openBrowserCh)
31 | // Start a local server and get a token.
32 | testServer := httptest.NewServer(&authserver.Handler{
33 | TestingT: t,
34 | NewAuthorizationResponse: func(req authserver.AuthorizationRequest) string {
35 | if want := "email profile"; req.Scope != want {
36 | t.Errorf("scope wants %s but %s", want, req.Scope)
37 | return fmt.Sprintf("%s?error=invalid_scope", req.RedirectURI)
38 | }
39 | if !assertRedirectURI(t, req.RedirectURI, "http", "localhost", "") {
40 | return fmt.Sprintf("%s?error=invalid_redirect_uri", req.RedirectURI)
41 | }
42 | return fmt.Sprintf("%s?state=%s&code=%s", req.RedirectURI, req.State, "AUTH_CODE")
43 | },
44 | NewTokenResponse: func(req authserver.TokenRequest) (int, string) {
45 | if want := "AUTH_CODE"; req.Code != want {
46 | t.Errorf("code wants %s but %s", want, req.Code)
47 | return 400, invalidGrantResponse
48 | }
49 | return 200, validTokenResponse
50 | },
51 | })
52 | defer testServer.Close()
53 | cfg := oauth2cli.Config{
54 | OAuth2Config: oauth2.Config{
55 | ClientID: "YOUR_CLIENT_ID",
56 | ClientSecret: "YOUR_CLIENT_SECRET",
57 | Scopes: []string{"email", "profile"},
58 | Endpoint: oauth2.Endpoint{
59 | AuthURL: testServer.URL + "/auth",
60 | TokenURL: testServer.URL + "/token",
61 | },
62 | },
63 | LocalServerReadyChan: openBrowserCh,
64 | LocalServerMiddleware: loggingMiddleware(t),
65 | Logf: t.Logf,
66 | }
67 | token, err := oauth2cli.GetToken(ctx, cfg)
68 | if err != nil {
69 | t.Errorf("could not get a token: %s", err)
70 | return
71 | }
72 | if token.AccessToken != "ACCESS_TOKEN" {
73 | t.Errorf("AccessToken wants %s but %s", "ACCESS_TOKEN", token.AccessToken)
74 | }
75 | if token.RefreshToken != "REFRESH_TOKEN" {
76 | t.Errorf("RefreshToken wants %s but %s", "REFRESH_TOKEN", token.RefreshToken)
77 | }
78 | }()
79 | wg.Add(1)
80 | go func() {
81 | defer wg.Done()
82 | toURL, ok := <-openBrowserCh
83 | if !ok {
84 | t.Errorf("server already closed")
85 | return
86 | }
87 | client.GetAndVerify(t, toURL, 200, oauth2cli.DefaultLocalServerSuccessHTML)
88 | }()
89 | wg.Wait()
90 | }
91 |
92 | func TestRedirectURLHostname(t *testing.T) {
93 | ctx, cancel := context.WithTimeout(context.TODO(), 1*time.Second)
94 | defer cancel()
95 | openBrowserCh := make(chan string)
96 | var wg sync.WaitGroup
97 | wg.Add(1)
98 | go func() {
99 | defer wg.Done()
100 | defer close(openBrowserCh)
101 | // Start a local server and get a token.
102 | testServer := httptest.NewServer(&authserver.Handler{
103 | TestingT: t,
104 | NewAuthorizationResponse: func(req authserver.AuthorizationRequest) string {
105 | if want := "email profile"; req.Scope != want {
106 | t.Errorf("scope wants %s but %s", want, req.Scope)
107 | return fmt.Sprintf("%s?error=invalid_scope", req.RedirectURI)
108 | }
109 | if !assertRedirectURI(t, req.RedirectURI, "http", "127.0.0.1", "") {
110 | return fmt.Sprintf("%s?error=invalid_redirect_uri", req.RedirectURI)
111 | }
112 | return fmt.Sprintf("%s?state=%s&code=%s", req.RedirectURI, req.State, "AUTH_CODE")
113 | },
114 | NewTokenResponse: func(req authserver.TokenRequest) (int, string) {
115 | if want := "AUTH_CODE"; req.Code != want {
116 | t.Errorf("code wants %s but %s", want, req.Code)
117 | return 400, invalidGrantResponse
118 | }
119 | return 200, validTokenResponse
120 | },
121 | })
122 | defer testServer.Close()
123 | cfg := oauth2cli.Config{
124 | OAuth2Config: oauth2.Config{
125 | ClientID: "YOUR_CLIENT_ID",
126 | ClientSecret: "YOUR_CLIENT_SECRET",
127 | Scopes: []string{"email", "profile"},
128 | Endpoint: oauth2.Endpoint{
129 | AuthURL: testServer.URL + "/auth",
130 | TokenURL: testServer.URL + "/token",
131 | },
132 | },
133 | RedirectURLHostname: "127.0.0.1",
134 | LocalServerReadyChan: openBrowserCh,
135 | LocalServerMiddleware: loggingMiddleware(t),
136 | Logf: t.Logf,
137 | }
138 | token, err := oauth2cli.GetToken(ctx, cfg)
139 | if err != nil {
140 | t.Errorf("could not get a token: %s", err)
141 | return
142 | }
143 | if token.AccessToken != "ACCESS_TOKEN" {
144 | t.Errorf("AccessToken wants %s but %s", "ACCESS_TOKEN", token.AccessToken)
145 | }
146 | if token.RefreshToken != "REFRESH_TOKEN" {
147 | t.Errorf("RefreshToken wants %s but %s", "REFRESH_TOKEN", token.RefreshToken)
148 | }
149 | }()
150 | wg.Add(1)
151 | go func() {
152 | defer wg.Done()
153 | toURL, ok := <-openBrowserCh
154 | if !ok {
155 | t.Errorf("server already closed")
156 | return
157 | }
158 | client.GetAndVerify(t, toURL, 200, oauth2cli.DefaultLocalServerSuccessHTML)
159 | }()
160 | wg.Wait()
161 | }
162 |
163 | func TestSuccessRedirect(t *testing.T) {
164 | ctx, cancel := context.WithTimeout(context.TODO(), 1*time.Second)
165 | defer cancel()
166 | openBrowserCh := make(chan string)
167 | var wg sync.WaitGroup
168 | wg.Add(1)
169 | go func() {
170 | defer wg.Done()
171 | defer close(openBrowserCh)
172 | // start a local server of oauth2 endpoint
173 | testServer := httptest.NewServer(&authserver.Handler{
174 | TestingT: t,
175 | NewAuthorizationResponse: func(req authserver.AuthorizationRequest) string {
176 | if want := "email profile"; req.Scope != want {
177 | t.Errorf("scope wants %s but %s", want, req.Scope)
178 | return fmt.Sprintf("%s?error=invalid_scope", req.RedirectURI)
179 | }
180 | if !assertRedirectURI(t, req.RedirectURI, "http", "localhost", "") {
181 | return fmt.Sprintf("%s?error=invalid_redirect_uri", req.RedirectURI)
182 | }
183 | return fmt.Sprintf("%s?state=%s&code=%s", req.RedirectURI, req.State, "AUTH_CODE")
184 | },
185 | NewTokenResponse: func(req authserver.TokenRequest) (int, string) {
186 | if want := "AUTH_CODE"; req.Code != want {
187 | t.Errorf("code wants %s but %s", want, req.Code)
188 | return 400, invalidGrantResponse
189 | }
190 | return 200, validTokenResponse
191 | },
192 | })
193 | defer testServer.Close()
194 | // start a local server to be redirected
195 | sr := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
196 | if r.URL.Path == "/success" && r.Method == "GET" {
197 | _, _ = w.Write([]byte("success page"))
198 | return
199 | }
200 | http.NotFound(w, r)
201 | }))
202 | defer sr.Close()
203 | // get a token
204 | cfg := oauth2cli.Config{
205 | OAuth2Config: oauth2.Config{
206 | ClientID: "YOUR_CLIENT_ID",
207 | ClientSecret: "YOUR_CLIENT_SECRET",
208 | Scopes: []string{"email", "profile"},
209 | Endpoint: oauth2.Endpoint{
210 | AuthURL: testServer.URL + "/auth",
211 | TokenURL: testServer.URL + "/token",
212 | },
213 | },
214 | LocalServerReadyChan: openBrowserCh,
215 | LocalServerMiddleware: loggingMiddleware(t),
216 | SuccessRedirectURL: sr.URL + "/success",
217 | FailureRedirectURL: sr.URL + "/failure",
218 | Logf: t.Logf,
219 | }
220 | token, err := oauth2cli.GetToken(ctx, cfg)
221 | if err != nil {
222 | t.Errorf("could not get a token: %s", err)
223 | return
224 | }
225 | if token.AccessToken != "ACCESS_TOKEN" {
226 | t.Errorf("AccessToken wants %s but %s", "ACCESS_TOKEN", token.AccessToken)
227 | }
228 | if token.RefreshToken != "REFRESH_TOKEN" {
229 | t.Errorf("RefreshToken wants %s but %s", "REFRESH_TOKEN", token.RefreshToken)
230 | }
231 | }()
232 | wg.Add(1)
233 | go func() {
234 | defer wg.Done()
235 | toURL, ok := <-openBrowserCh
236 | if !ok {
237 | t.Errorf("server already closed")
238 | return
239 | }
240 | client.GetAndVerify(t, toURL, 200, "success page")
241 | }()
242 | wg.Wait()
243 | }
244 |
245 | func assertRedirectURI(t *testing.T, actualURI, scheme, hostname, path string) bool {
246 | redirect, err := url.Parse(actualURI)
247 | if err != nil {
248 | t.Errorf("could not parse redirect_uri: %s", err)
249 | return false
250 | }
251 | if redirect.Scheme != scheme {
252 | t.Errorf("redirect_uri wants scheme %s but was %s", scheme, redirect.Scheme)
253 | return false
254 | }
255 | if actualHostname := redirect.Hostname(); actualHostname != hostname {
256 | t.Errorf("redirect_uri wants hostname %s but was %s", hostname, actualHostname)
257 | return false
258 | }
259 | if actualPath := redirect.Path; actualPath != path {
260 | t.Errorf("redirect_uri wants path %s but was %s", path, actualPath)
261 | return false
262 | }
263 | return true
264 | }
265 |
266 | func loggingMiddleware(t *testing.T) func(h http.Handler) http.Handler {
267 | return func(h http.Handler) http.Handler {
268 | return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
269 | t.Logf("oauth2cli-local-server: %s %s", r.Method, r.URL)
270 | h.ServeHTTP(w, r)
271 | })
272 | }
273 | }
274 |
--------------------------------------------------------------------------------
/e2e_test/error_test.go:
--------------------------------------------------------------------------------
1 | package e2e_test
2 |
3 | import (
4 | "context"
5 | "fmt"
6 | "net/http"
7 | "net/http/httptest"
8 | "sync"
9 | "testing"
10 | "time"
11 |
12 | "github.com/int128/oauth2cli"
13 | "github.com/int128/oauth2cli/e2e_test/authserver"
14 | "github.com/int128/oauth2cli/e2e_test/client"
15 | "golang.org/x/oauth2"
16 | )
17 |
18 | func TestErrorAuthorizationResponse(t *testing.T) {
19 | ctx, cancel := context.WithTimeout(context.TODO(), 1*time.Second)
20 | defer cancel()
21 | openBrowserCh := make(chan string)
22 | var wg sync.WaitGroup
23 | wg.Add(1)
24 | go func() {
25 | defer wg.Done()
26 | defer close(openBrowserCh)
27 | // Start a local server and get a token.
28 | testServer := httptest.NewServer(&authserver.Handler{
29 | TestingT: t,
30 | NewAuthorizationResponse: func(req authserver.AuthorizationRequest) string {
31 | return fmt.Sprintf("%s?error=server_error", req.RedirectURI)
32 | },
33 | NewTokenResponse: func(req authserver.TokenRequest) (int, string) {
34 | return 500, "should not reach here"
35 | },
36 | })
37 | defer testServer.Close()
38 | cfg := oauth2cli.Config{
39 | OAuth2Config: oauth2.Config{
40 | ClientID: "YOUR_CLIENT_ID",
41 | ClientSecret: "YOUR_CLIENT_SECRET",
42 | Scopes: []string{"email", "profile"},
43 | Endpoint: oauth2.Endpoint{
44 | AuthURL: testServer.URL + "/auth",
45 | TokenURL: testServer.URL + "/token",
46 | },
47 | },
48 | LocalServerReadyChan: openBrowserCh,
49 | Logf: t.Logf,
50 | }
51 | _, err := oauth2cli.GetToken(ctx, cfg)
52 | if err == nil {
53 | t.Errorf("GetToken wants error but was nil")
54 | return
55 | }
56 | t.Logf("expected error: %s", err)
57 | }()
58 | wg.Add(1)
59 | go func() {
60 | defer wg.Done()
61 | toURL, ok := <-openBrowserCh
62 | if !ok {
63 | t.Errorf("server already closed")
64 | return
65 | }
66 | client.GetAndVerify(t, toURL, 500, "authorization error\n")
67 | }()
68 | wg.Wait()
69 | }
70 |
71 | func TestFailureRedirect(t *testing.T) {
72 | ctx, cancel := context.WithTimeout(context.TODO(), 1*time.Second)
73 | defer cancel()
74 |
75 | // start a local server of oauth2 endpoint
76 | authzServer := httptest.NewServer(&authserver.Handler{
77 | TestingT: t,
78 | NewAuthorizationResponse: func(req authserver.AuthorizationRequest) string {
79 | return fmt.Sprintf("%s?error=server_error", req.RedirectURI)
80 | },
81 | NewTokenResponse: func(req authserver.TokenRequest) (int, string) {
82 | return 500, "should not reach here"
83 | },
84 | })
85 | defer authzServer.Close()
86 |
87 | // start a local server to be redirected
88 | pageServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
89 | if r.URL.Path == "/failure" && r.Method == "GET" {
90 | _, _ = w.Write([]byte("failure page"))
91 | return
92 | }
93 | http.NotFound(w, r)
94 | }))
95 | defer pageServer.Close()
96 |
97 | openBrowserCh := make(chan string)
98 | var wg sync.WaitGroup
99 | wg.Add(1)
100 | go func() {
101 | defer wg.Done()
102 | defer close(openBrowserCh)
103 | // get a token
104 | cfg := oauth2cli.Config{
105 | OAuth2Config: oauth2.Config{
106 | ClientID: "YOUR_CLIENT_ID",
107 | ClientSecret: "YOUR_CLIENT_SECRET",
108 | Scopes: []string{"email", "profile"},
109 | Endpoint: oauth2.Endpoint{
110 | AuthURL: authzServer.URL + "/auth",
111 | TokenURL: authzServer.URL + "/token",
112 | },
113 | },
114 | LocalServerReadyChan: openBrowserCh,
115 | SuccessRedirectURL: pageServer.URL + "/success",
116 | FailureRedirectURL: pageServer.URL + "/failure",
117 | Logf: t.Logf,
118 | }
119 | _, err := oauth2cli.GetToken(ctx, cfg)
120 | if err == nil {
121 | t.Errorf("GetToken wants error but was nil")
122 | return
123 | }
124 | t.Logf("expected error: %s", err)
125 | }()
126 | wg.Add(1)
127 | go func() {
128 | defer wg.Done()
129 | toURL, ok := <-openBrowserCh
130 | if !ok {
131 | t.Errorf("server already closed")
132 | return
133 | }
134 | client.GetAndVerify(t, toURL, 200, "failure page")
135 | }()
136 | wg.Wait()
137 | }
138 |
139 | func TestErrorTokenResponse(t *testing.T) {
140 | ctx, cancel := context.WithTimeout(context.TODO(), 1*time.Second)
141 | defer cancel()
142 | openBrowserCh := make(chan string)
143 | var wg sync.WaitGroup
144 | wg.Add(1)
145 | go func() {
146 | defer wg.Done()
147 | defer close(openBrowserCh)
148 | // Start a local server and get a token.
149 | testServer := httptest.NewServer(&authserver.Handler{
150 | TestingT: t,
151 | NewAuthorizationResponse: func(req authserver.AuthorizationRequest) string {
152 | return fmt.Sprintf("%s?state=%s&code=%s", req.RedirectURI, req.State, "AUTH_CODE")
153 | },
154 | NewTokenResponse: func(req authserver.TokenRequest) (int, string) {
155 | return 400, `{"error":"invalid_request"}`
156 | },
157 | })
158 | defer testServer.Close()
159 | cfg := oauth2cli.Config{
160 | OAuth2Config: oauth2.Config{
161 | ClientID: "YOUR_CLIENT_ID",
162 | ClientSecret: "YOUR_CLIENT_SECRET",
163 | Scopes: []string{"email", "profile"},
164 | Endpoint: oauth2.Endpoint{
165 | AuthURL: testServer.URL + "/auth",
166 | TokenURL: testServer.URL + "/token",
167 | },
168 | },
169 | LocalServerReadyChan: openBrowserCh,
170 | Logf: t.Logf,
171 | }
172 | _, err := oauth2cli.GetToken(ctx, cfg)
173 | if err == nil {
174 | t.Errorf("GetToken wants error but nil")
175 | return
176 | }
177 | t.Logf("expected error: %s", err)
178 | }()
179 | wg.Add(1)
180 | go func() {
181 | defer wg.Done()
182 | toURL, ok := <-openBrowserCh
183 | if !ok {
184 | t.Errorf("server already closed")
185 | return
186 | }
187 | client.GetAndVerify(t, toURL, 200, oauth2cli.DefaultLocalServerSuccessHTML)
188 | }()
189 | wg.Wait()
190 | }
191 |
--------------------------------------------------------------------------------
/e2e_test/localserveropts_test.go:
--------------------------------------------------------------------------------
1 | package e2e_test
2 |
3 | import (
4 | "context"
5 | "fmt"
6 | "net/http/httptest"
7 | "sync"
8 | "testing"
9 | "time"
10 |
11 | "github.com/int128/oauth2cli"
12 | "github.com/int128/oauth2cli/e2e_test/authserver"
13 | "github.com/int128/oauth2cli/e2e_test/client"
14 | "golang.org/x/oauth2"
15 | )
16 |
17 | func TestLocalServerCallbackPath(t *testing.T) {
18 | ctx, cancel := context.WithTimeout(context.TODO(), 1*time.Second)
19 | defer cancel()
20 | openBrowserCh := make(chan string)
21 | var wg sync.WaitGroup
22 | wg.Add(1)
23 | go func() {
24 | defer wg.Done()
25 | defer close(openBrowserCh)
26 | // Start a local server and get a token.
27 | testServer := httptest.NewServer(&authserver.Handler{
28 | TestingT: t,
29 | NewAuthorizationResponse: func(req authserver.AuthorizationRequest) string {
30 | if want := "email profile"; req.Scope != want {
31 | t.Errorf("scope wants %s but %s", want, req.Scope)
32 | return fmt.Sprintf("%s?error=invalid_scope", req.RedirectURI)
33 | }
34 | if !assertRedirectURI(t, req.RedirectURI, "http", "localhost", "/callback") {
35 | return fmt.Sprintf("%s?error=invalid_redirect_uri", req.RedirectURI)
36 | }
37 | return fmt.Sprintf("%s?state=%s&code=%s", req.RedirectURI, req.State, "AUTH_CODE")
38 | },
39 | NewTokenResponse: func(req authserver.TokenRequest) (int, string) {
40 | if want := "AUTH_CODE"; req.Code != want {
41 | t.Errorf("code wants %s but %s", want, req.Code)
42 | return 400, invalidGrantResponse
43 | }
44 | return 200, validTokenResponse
45 | },
46 | })
47 | defer testServer.Close()
48 | cfg := oauth2cli.Config{
49 | OAuth2Config: oauth2.Config{
50 | ClientID: "YOUR_CLIENT_ID",
51 | ClientSecret: "YOUR_CLIENT_SECRET",
52 | Scopes: []string{"email", "profile"},
53 | Endpoint: oauth2.Endpoint{
54 | AuthURL: testServer.URL + "/auth",
55 | TokenURL: testServer.URL + "/token",
56 | },
57 | },
58 | LocalServerCallbackPath: "/callback",
59 | LocalServerReadyChan: openBrowserCh,
60 | LocalServerMiddleware: loggingMiddleware(t),
61 | Logf: t.Logf,
62 | }
63 | token, err := oauth2cli.GetToken(ctx, cfg)
64 | if err != nil {
65 | t.Errorf("could not get a token: %s", err)
66 | return
67 | }
68 | if token.AccessToken != "ACCESS_TOKEN" {
69 | t.Errorf("AccessToken wants %s but %s", "ACCESS_TOKEN", token.AccessToken)
70 | }
71 | if token.RefreshToken != "REFRESH_TOKEN" {
72 | t.Errorf("RefreshToken wants %s but %s", "REFRESH_TOKEN", token.RefreshToken)
73 | }
74 | }()
75 | wg.Add(1)
76 | go func() {
77 | defer wg.Done()
78 | toURL, ok := <-openBrowserCh
79 | if !ok {
80 | t.Errorf("server already closed")
81 | return
82 | }
83 | client.GetAndVerify(t, toURL, 200, oauth2cli.DefaultLocalServerSuccessHTML)
84 | }()
85 | wg.Wait()
86 | }
87 |
--------------------------------------------------------------------------------
/e2e_test/pkce_test.go:
--------------------------------------------------------------------------------
1 | package e2e_test
2 |
3 | import (
4 | "context"
5 | "fmt"
6 | "net/http/httptest"
7 | "sync"
8 | "testing"
9 | "time"
10 |
11 | "github.com/int128/oauth2cli"
12 | "github.com/int128/oauth2cli/e2e_test/authserver"
13 | "github.com/int128/oauth2cli/e2e_test/client"
14 | "golang.org/x/oauth2"
15 | )
16 |
17 | func TestPKCE(t *testing.T) {
18 | ctx, cancel := context.WithTimeout(context.TODO(), 1*time.Second)
19 | defer cancel()
20 | openBrowserCh := make(chan string)
21 | var wg sync.WaitGroup
22 | wg.Add(1)
23 | go func() {
24 | defer wg.Done()
25 | defer close(openBrowserCh)
26 | // PKCE test fixture: https://tools.ietf.org/html/rfc7636
27 | const codeChallenge = "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"
28 | const codeVerifier = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
29 | // Start a local server and get a token.
30 | testServer := httptest.NewServer(&authserver.Handler{
31 | TestingT: t,
32 | NewAuthorizationResponse: func(req authserver.AuthorizationRequest) string {
33 | if req.Raw.Get("code_challenge_method") != "S256" {
34 | t.Errorf("code_challenge_method wants S256 but was %s", req.Raw.Get("code_challenge_method"))
35 | }
36 | if req.Raw.Get("code_challenge") != codeChallenge {
37 | t.Errorf("code_challenge wants %s but was %s", codeChallenge, req.Raw.Get("code_challenge"))
38 | }
39 | if want := "email profile"; req.Scope != want {
40 | t.Errorf("scope wants %s but %s", want, req.Scope)
41 | return fmt.Sprintf("%s?error=invalid_scope", req.RedirectURI)
42 | }
43 | if !assertRedirectURI(t, req.RedirectURI, "http", "localhost", "") {
44 | return fmt.Sprintf("%s?error=invalid_redirect_uri", req.RedirectURI)
45 | }
46 | return fmt.Sprintf("%s?state=%s&code=%s", req.RedirectURI, req.State, "AUTH_CODE")
47 | },
48 | NewTokenResponse: func(req authserver.TokenRequest) (int, string) {
49 | if req.Raw.Get("code_verifier") != codeVerifier {
50 | t.Errorf("code_verifier wants %s but was %s", codeVerifier, req.Raw.Get("code_verifier"))
51 | }
52 | if want := "AUTH_CODE"; req.Code != want {
53 | t.Errorf("code wants %s but %s", want, req.Code)
54 | return 400, invalidGrantResponse
55 | }
56 | return 200, validTokenResponse
57 | },
58 | })
59 | defer testServer.Close()
60 | cfg := oauth2cli.Config{
61 | OAuth2Config: oauth2.Config{
62 | ClientID: "YOUR_CLIENT_ID",
63 | ClientSecret: "YOUR_CLIENT_SECRET",
64 | Scopes: []string{"email", "profile"},
65 | Endpoint: oauth2.Endpoint{
66 | AuthURL: testServer.URL + "/auth",
67 | TokenURL: testServer.URL + "/token",
68 | },
69 | },
70 | AuthCodeOptions: []oauth2.AuthCodeOption{
71 | oauth2.SetAuthURLParam("code_challenge_method", "S256"),
72 | oauth2.SetAuthURLParam("code_challenge", codeChallenge),
73 | },
74 | TokenRequestOptions: []oauth2.AuthCodeOption{
75 | oauth2.SetAuthURLParam("code_verifier", codeVerifier),
76 | },
77 | LocalServerReadyChan: openBrowserCh,
78 | LocalServerMiddleware: loggingMiddleware(t),
79 | Logf: t.Logf,
80 | }
81 | token, err := oauth2cli.GetToken(ctx, cfg)
82 | if err != nil {
83 | t.Errorf("could not get a token: %s", err)
84 | return
85 | }
86 | if token.AccessToken != "ACCESS_TOKEN" {
87 | t.Errorf("AccessToken wants %s but %s", "ACCESS_TOKEN", token.AccessToken)
88 | }
89 | if token.RefreshToken != "REFRESH_TOKEN" {
90 | t.Errorf("RefreshToken wants %s but %s", "REFRESH_TOKEN", token.RefreshToken)
91 | }
92 | }()
93 | wg.Add(1)
94 | go func() {
95 | defer wg.Done()
96 | toURL, ok := <-openBrowserCh
97 | if !ok {
98 | t.Errorf("server already closed")
99 | return
100 | }
101 | client.GetAndVerify(t, toURL, 200, oauth2cli.DefaultLocalServerSuccessHTML)
102 | }()
103 | wg.Wait()
104 | }
105 |
--------------------------------------------------------------------------------
/e2e_test/testdata/Makefile:
--------------------------------------------------------------------------------
1 | EXPIRY := 3650
2 | OUTPUT_DIR := testdata
3 | TARGETS := ca.key
4 | TARGETS += ca.crt
5 | TARGETS += server.key
6 | TARGETS += server.crt
7 |
8 | .PHONY: all
9 | all: $(TARGETS)
10 |
11 | ca.key:
12 | openssl genrsa -out $@ 2048
13 | ca.csr: ca.key
14 | openssl req -new -key ca.key -out $@ -subj "/CN=hello-ca" -config openssl.cnf
15 | ca.crt: ca.key ca.csr
16 | openssl x509 -req -in ca.csr -signkey ca.key -out $@ -days $(EXPIRY)
17 | server.key:
18 | openssl genrsa -out $@ 2048
19 | server.csr: openssl.cnf server.key
20 | openssl req -new -key server.key -out $@ -subj "/CN=localhost" -config openssl.cnf
21 | server.crt: openssl.cnf server.csr ca.crt ca.key
22 | openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out $@ -sha256 -days $(EXPIRY) -extensions v3_req -extfile openssl.cnf
23 |
24 | .PHONY: clean
25 | clean:
26 | -rm -v $(TARGETS)
27 |
--------------------------------------------------------------------------------
/e2e_test/testdata/ca.crt:
--------------------------------------------------------------------------------
1 | -----BEGIN CERTIFICATE-----
2 | MIICojCCAYoCCQD71keGa3mFIDANBgkqhkiG9w0BAQUFADATMREwDwYDVQQDDAho
3 | ZWxsby1jYTAeFw0yMTEwMDkxMzI1MjJaFw0zMTEwMDcxMzI1MjJaMBMxETAPBgNV
4 | BAMMCGhlbGxvLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4vLw
5 | WJbFRUbC4dVKKIptPRSE3rjoTAnPSDQyNFbpK7+4Lkj5brURbxU8TtGG2y7XKRcZ
6 | mErD5s5k6f0kinw+ctcUdVEpVuqj1dKUpQsceh8h9MJofcKo/bWRHQyavdfFJV65
7 | 4CTWeVwHDd/YVe3Nknmu8znLIBLOxMwUy5opHfpTY6AZH6G7WVa7UJAIe0ZD7vQR
8 | vOHalI4ahA8gZgEeOItP8TOO3IuziXt8RZ/yr9+9on7vK0F8Rs8E8YNEW0wB9Ic4
9 | wMd0TboMqeHobcbOqAMWKfuWefO2S++A1XYxR7gp+uIXFDmUJh6baVo3jm/Lququ
10 | BQ/GGeN0l7YbPiirIwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQAoR1B7jeldx5s1
11 | ICvbv6wDr7Oka1VZSFiK+Rns8syAmYUnoPIeU52ROOvPskFXcOwm/u3CPvyGTebf
12 | zrOJtl47L4Yua/nuKLA1hbomqho39itXBh1N2L9ycUOs+7UighfttiQy6fTRowYi
13 | /Ehg0t4ML2ql1V15h0aJf+e5EWFeCFDmdPc9geTaozjQIB1uNYcJ/4Zn8fKnufgn
14 | ZN16LNpFo+MKPGOimc1Gc7ZA3EUU3MacJK5SvoMP8NNxAztXUMI9ZtMJ6HLGG7LO
15 | WC/LnZnnCS2HRYop4xgb0IYQlPxQP+A6OWYpIzFSXOM4nYhxWViwpstj8GcO/kxu
16 | 33OSC148
17 | -----END CERTIFICATE-----
18 |
--------------------------------------------------------------------------------
/e2e_test/testdata/ca.csr:
--------------------------------------------------------------------------------
1 | -----BEGIN CERTIFICATE REQUEST-----
2 | MIICrDCCAZQCAQAwEzERMA8GA1UEAwwIaGVsbG8tY2EwggEiMA0GCSqGSIb3DQEB
3 | AQUAA4IBDwAwggEKAoIBAQDi8vBYlsVFRsLh1Uooim09FITeuOhMCc9INDI0Vukr
4 | v7guSPlutRFvFTxO0YbbLtcpFxmYSsPmzmTp/SSKfD5y1xR1USlW6qPV0pSlCxx6
5 | HyH0wmh9wqj9tZEdDJq918UlXrngJNZ5XAcN39hV7c2Sea7zOcsgEs7EzBTLmikd
6 | +lNjoBkfobtZVrtQkAh7RkPu9BG84dqUjhqEDyBmAR44i0/xM47ci7OJe3xFn/Kv
7 | 372ifu8rQXxGzwTxg0RbTAH0hzjAx3RNugyp4ehtxs6oAxYp+5Z587ZL74DVdjFH
8 | uCn64hcUOZQmHptpWjeOb8uq6q4FD8YZ43SXths+KKsjAgMBAAGgVDBSBgkqhkiG
9 | 9w0BCQ4xRTBDMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgXgMBQGA1UdEQQNMAuCCWxv
10 | Y2FsaG9zdDATBgNVHSUEDDAKBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAQEA
11 | VT2dfITMyjyzlEkuaF97E0a96I1nB/sdl+oU7OobUkbUPzFZtG6B0DUTEXhIxVcu
12 | dF4EULUBfQ1b+9IiC3St+xjklc/Gmk84XnqLFXXs94oMk63Y/w4zUYsWWwo1Pf4C
13 | sOZEUJkwwUFLZPRB3aDxsBaFFy2pm3pfXqzOdBdVG06u8/Ibuk6gT/ynlUiZMxbH
14 | vDgNhfmX3YAOyBCB8qgAy4wJ5e4kDRdOLccVcMS+xH9LTL0ce5JyAdUGv6uEfU9v
15 | W6A276dYcrVLvIeASY3VI3UAAryytzM8Vh4nv7/0gb7zfdZJ6/DT3JLMYJER37iK
16 | ML+tfaTi/vqBnteek5AkqQ==
17 | -----END CERTIFICATE REQUEST-----
18 |
--------------------------------------------------------------------------------
/e2e_test/testdata/ca.key:
--------------------------------------------------------------------------------
1 | -----BEGIN RSA PRIVATE KEY-----
2 | MIIEpAIBAAKCAQEA4vLwWJbFRUbC4dVKKIptPRSE3rjoTAnPSDQyNFbpK7+4Lkj5
3 | brURbxU8TtGG2y7XKRcZmErD5s5k6f0kinw+ctcUdVEpVuqj1dKUpQsceh8h9MJo
4 | fcKo/bWRHQyavdfFJV654CTWeVwHDd/YVe3Nknmu8znLIBLOxMwUy5opHfpTY6AZ
5 | H6G7WVa7UJAIe0ZD7vQRvOHalI4ahA8gZgEeOItP8TOO3IuziXt8RZ/yr9+9on7v
6 | K0F8Rs8E8YNEW0wB9Ic4wMd0TboMqeHobcbOqAMWKfuWefO2S++A1XYxR7gp+uIX
7 | FDmUJh6baVo3jm/LququBQ/GGeN0l7YbPiirIwIDAQABAoIBAQCiJqPVF/xgz/sj
8 | 8gnnR2hfcM6yd3j6AzRHyYtpXAODT5sf7uHQ2KxZKtoJEqmA50mxwSB3cEviF+uA
9 | R28ZR0YzNTsXy2J3CHUArFGqTnMNSjsvrsuLt06Y32aMU9on9AeW+MRjws4+raMY
10 | pavjUWJE2o5GmC9qfiWf9JSTGFVyZXVI7RhA5KY6iYJpF/yr6Ydbsuz82SaTRTRV
11 | CIWPZ58Q14SDB2pW0OOSRH1NnJXgxKTgHLCdV+hzx7YIHkDnwbRLl1Hu927L2nFH
12 | 64titcykbr5A2YaVvSPrwhD3rL4JgQNFvbwHNxYIA6ZMHZGFlACz277YpraKCxqJ
13 | t+bv3MhxAoGBAPE9X/IZhG6copTDPOQYg31AgL75nYISmkg/vrycknHiMisV59TV
14 | 0HrNKqkbUSlRcv100Rh71ErysQjK6YLFIFGLXMjHB/Qciad3HDL5eNGy5+VMl/kq
15 | 6CQe/GAUD+MEl/PG/aUaU3K2zufe6afi/nTeJ50bnjEKfvumMtjdNIXbAoGBAPDV
16 | uP9nRZ/5Q9KP6f5RhvmKjpb6UhDlelfW3h4JgxAqSmWn69dtbOFoYMT7nmhfuoXn
17 | vtZoACmBu/h9HIk/Vnr2UbMgkBtxEOuL5L0flDem00LX0yMF82Fygi7sHFeOF2DF
18 | ejr7c3SZzGUMy0Y+r+Bdi+Sexop86wskT6xKOQZZAoGAfbdXTcpAeohELbRFAjVI
19 | KLi5n0xj6coZ/rbBhnct1g1jyZJD22WFnMlYhwIGXLrmavE6mkDF1Dz/Ry6/W/ew
20 | rO4sbzFRksRgdBYdau8ZKGbMdHFi7WWPzmsbaFJsKQlWyqKTwjui6zAbSTigmW4w
21 | 3uR6zmP7H2Fx5WCqNNuqKGsCgYBFXnor7tYqLwUvGE7g9yC2rgdGS5Hp1f94X6aY
22 | 5kp/FH9bapPO+HDdOFBvTL6i97flLAxW+5vYWMsI1xiqG7lQL7T2sJFxpg6mmiPn
23 | qbnqkb3WSg5Bz0v8LJx84XuEaKQpNphvdtAZrNcn4BiJAjNsn+VUk7tCVprpGatt
24 | R+/G+QKBgQCoxqMbv5GGBMp4qkBtK8l8xqAa3VtL2tj+sJyEvYM2sMU6GrUxMxxB
25 | KloVFq3vqwlMTsGmXpA+B6zCZazjoQHYbPNkkfrNnY2Ki6Msb7fbJN8xVqYXwetd
26 | 8uBnsW0qkAYUhXzYcnFn51gtKJcEqKOOEM/QSXvEf0w87GdrOxgMRw==
27 | -----END RSA PRIVATE KEY-----
28 |
--------------------------------------------------------------------------------
/e2e_test/testdata/ca.srl:
--------------------------------------------------------------------------------
1 | 9E770A10DAC66371
2 |
--------------------------------------------------------------------------------
/e2e_test/testdata/openssl.cnf:
--------------------------------------------------------------------------------
1 | [ req ]
2 | distinguished_name = req_distinguished_name
3 | req_extensions = v3_req
4 |
5 | [ req_distinguished_name ]
6 |
7 | [ v3_req ]
8 | basicConstraints = CA:FALSE
9 | keyUsage = nonRepudiation, digitalSignature, keyEncipherment
10 | subjectAltName = @alt_names
11 | extendedKeyUsage = serverAuth
12 |
13 | [alt_names]
14 | DNS.1 = localhost
15 |
--------------------------------------------------------------------------------
/e2e_test/testdata/server.crt:
--------------------------------------------------------------------------------
1 | -----BEGIN CERTIFICATE-----
2 | MIIC7zCCAdegAwIBAgIJAJ53ChDaxmNxMA0GCSqGSIb3DQEBCwUAMBMxETAPBgNV
3 | BAMMCGhlbGxvLWNhMB4XDTIxMTAwOTEzMjUyMloXDTMxMTAwNzEzMjUyMlowFDES
4 | MBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
5 | AQEAu2KtLTftALlcoN+oCwQhC18BN8YKsj5INZfuIZfK/4YJb1W7Ko7NJ3MvAAoH
6 | LwRXu0BPSe8AhBdK4MplAuOWOzV0oCaCjvbjKbMDZXZcbPLeBQIYm0WVCy62UJhg
7 | L3OwOB3Z4kKTf64BI9eexQ8kmpQBYFkwngx5WE4RxMlRaZ21fIO0WpDvDPArFZGl
8 | gMyU8A/Fyj6Fivd5uAH20PWbiHYCnqmspsFJRIkhfiTIDR8SuzkMLKvkyAfy1VN8
9 | hiuVGXK0ccGLT+M8eA3ccpwMEXDULEE3fTWMiUR5ls102H3WXyxlBqIULvP1R0yD
10 | RFaa+pUzhSHff4jtfuL87ByezwIDAQABo0UwQzAJBgNVHRMEAjAAMAsGA1UdDwQE
11 | AwIF4DAUBgNVHREEDTALgglsb2NhbGhvc3QwEwYDVR0lBAwwCgYIKwYBBQUHAwEw
12 | DQYJKoZIhvcNAQELBQADggEBAL5nUEmDQhYcAHPaLAK5fjlGINatRjA2zFts5D/0
13 | fTE8WtamxALTF5r6A9strp/8V6r0MqPkA5dacs7BmP/hFxkCFqJDc62xOs/uP/Bg
14 | fekD0EV8q6nqhUQA/EbtOJSe9Y3ETtvRMjavnUwjfB/zfhaoyyhwpccwYQ1FCZxh
15 | 4iyW+eXqOzBTFGED356Q8itEPuv0ra2PKEelISd9+eSCQTp+ehabc2Vfc1/7v3K6
16 | It3hW7JvFlzkXIATjAiPWT4+8Yq/abu/eEJB3eUuI64t8VQwqpfioAnqUw1ppJ5k
17 | C8wMNPjliIsp6ahTzlJzN0CGeE8lRgspgPNbLf8qHMmJYGg=
18 | -----END CERTIFICATE-----
19 |
--------------------------------------------------------------------------------
/e2e_test/testdata/server.csr:
--------------------------------------------------------------------------------
1 | -----BEGIN CERTIFICATE REQUEST-----
2 | MIICrTCCAZUCAQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0B
3 | AQEFAAOCAQ8AMIIBCgKCAQEAu2KtLTftALlcoN+oCwQhC18BN8YKsj5INZfuIZfK
4 | /4YJb1W7Ko7NJ3MvAAoHLwRXu0BPSe8AhBdK4MplAuOWOzV0oCaCjvbjKbMDZXZc
5 | bPLeBQIYm0WVCy62UJhgL3OwOB3Z4kKTf64BI9eexQ8kmpQBYFkwngx5WE4RxMlR
6 | aZ21fIO0WpDvDPArFZGlgMyU8A/Fyj6Fivd5uAH20PWbiHYCnqmspsFJRIkhfiTI
7 | DR8SuzkMLKvkyAfy1VN8hiuVGXK0ccGLT+M8eA3ccpwMEXDULEE3fTWMiUR5ls10
8 | 2H3WXyxlBqIULvP1R0yDRFaa+pUzhSHff4jtfuL87ByezwIDAQABoFQwUgYJKoZI
9 | hvcNAQkOMUUwQzAJBgNVHRMEAjAAMAsGA1UdDwQEAwIF4DAUBgNVHREEDTALggls
10 | b2NhbGhvc3QwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggEB
11 | ADwpPkbMK5684yx2Ntrt+KHkgzGCSiLa4V4zDtJ8g/HmibVVA93SUHHoq4IdIOI7
12 | iMzK50zbUU67rsPKo8UkdDIguyZEgdxVhppipNc7Fhq+6J5iZfeue2p9UwWlvlQ2
13 | VGV+EH/JPPos2nlHosmvXLMnWUc9sJA5TZAjkR/R3FOgKH3YyzZf3Wkvb8mlE4GA
14 | /sgAEwF5AD4iOP6m9TX6tBojwWJm6//TOocK+2bfo1SP8fxBCyAPDZV0PRjZr5xo
15 | /riB3vXJAMnEgP++h4NFEebesfz0r7WUaSp1744ch3ina5MDywO8aZxmzfVVf8a4
16 | T1ZXITzljsZXGdX4cq+gA88=
17 | -----END CERTIFICATE REQUEST-----
18 |
--------------------------------------------------------------------------------
/e2e_test/testdata/server.key:
--------------------------------------------------------------------------------
1 | -----BEGIN RSA PRIVATE KEY-----
2 | MIIEowIBAAKCAQEAu2KtLTftALlcoN+oCwQhC18BN8YKsj5INZfuIZfK/4YJb1W7
3 | Ko7NJ3MvAAoHLwRXu0BPSe8AhBdK4MplAuOWOzV0oCaCjvbjKbMDZXZcbPLeBQIY
4 | m0WVCy62UJhgL3OwOB3Z4kKTf64BI9eexQ8kmpQBYFkwngx5WE4RxMlRaZ21fIO0
5 | WpDvDPArFZGlgMyU8A/Fyj6Fivd5uAH20PWbiHYCnqmspsFJRIkhfiTIDR8SuzkM
6 | LKvkyAfy1VN8hiuVGXK0ccGLT+M8eA3ccpwMEXDULEE3fTWMiUR5ls102H3WXyxl
7 | BqIULvP1R0yDRFaa+pUzhSHff4jtfuL87ByezwIDAQABAoIBAB2k/sComFYE/SJ2
8 | P59+h7vEy+yG6CpKsCHKZ2HpIbRLADMc3P9emBYlosnezEQj670z71dC+FHtXWsy
9 | mchbOOklC85KSV1UsZtnNqJWl0ilI3qnWj02RN4ABde6Q30+UCKQlme1IKCSZpvF
10 | ANksDB5oS89yTL60On4925HGR5rtkuoUshh2XH0D2R1YjUsvOus0C8OpGYlMekpt
11 | kWVxxIfH0aPyMAeeDHXY/rK9cpbzIgWgMlgSRACGz0Bwq1PBYNCrlNJOjExkc/ZE
12 | 6hyG/yo7gPm4NRzZO4gzI8qnC/h0IdY7ctAT2gYGMPI41nytWVLVr9iQxazOGsMs
13 | 9JY/qAECgYEA5Qrfab5oBQO8QdMHZ6HJc/MhdTTllCPtqAM6tkNx7JSgiKOdq4+i
14 | I1F6FH8viw+ZhEbpEey02iJNXmkQKBtdLNoQvlMboT89AKSu2Y3c5Oyy6P+zVgPj
15 | Iutzg69XYXpXTHIqwqIl8h/+JAWrIcEsI37qeZl7EG333QQyPS73nscCgYEA0XCp
16 | 6q4ftJ6HHiswse1R/ZHlDmr0qqCRobuyBZ09Hbqj3HShom2wCQOERZhWSrV6qxPc
17 | 0Vq3I3eifIpKJnsVzPAQcW5eDCpPT7WFt8vUl7StDKAUoCn0k3UoXkFEh4c8A1lS
18 | AOw4uR+MKfABj5kx0yIDJ2VQupXRquqyiFnhF7kCgYBZmBs0ngrKi1+E0CvBWgQX
19 | my+nTX3QqQ05/6ljypYx2SHC0V3H0nO2JRUAF5BdcUi3+ZUKMfG8slZZa/ep+KpF
20 | 9Tc/e/r+5GHUcpcC+v9BfWWuxvc72mFrM3cIN/qSYuzrNm2LnSoCwIkFRkJe/dVq
21 | PSczUdpV3u5qQk30qP6r2QKBgQC+rldU3ZDqLcaQtfvQkmOqe/DSLphw3F2apTtQ
22 | Fzc0YN+c7+bU7g5uNnBvuGEgBZgYN648QN4qAVrDDliyLi/L9OjTjQs9AixRQs/q
23 | ZT45nHpM21XL+Ea/FdRZ9AxDY+FEn0akpmyCRvGioOua5HvTYM0ESh60sYBBnwpK
24 | T6I6qQKBgBBxAHe3wc9wqJOQxURNMFgPZx5hj+A6yTsUHGO2yrM5Ey8RdtLD4y+o
25 | 6+6a9dd6pO18g7nVqPFmGF0albR5kEVoZHdHdUKmyAvq6RIv6g6eaiWKQg2GHEbH
26 | 3XVbeV7jnXria94W/VDsBpzGSEO0KXuGbzPLDJtPWyMrKyFBN2RN
27 | -----END RSA PRIVATE KEY-----
28 |
--------------------------------------------------------------------------------
/e2e_test/tls_test.go:
--------------------------------------------------------------------------------
1 | package e2e_test
2 |
3 | import (
4 | "context"
5 | "fmt"
6 | "net/http/httptest"
7 | "sync"
8 | "testing"
9 | "time"
10 |
11 | "github.com/int128/oauth2cli"
12 | "github.com/int128/oauth2cli/e2e_test/authserver"
13 | "github.com/int128/oauth2cli/e2e_test/client"
14 | "golang.org/x/oauth2"
15 | )
16 |
17 | func TestTLS(t *testing.T) {
18 | ctx, cancel := context.WithTimeout(context.TODO(), 1*time.Second)
19 | defer cancel()
20 | openBrowserCh := make(chan string)
21 | var wg sync.WaitGroup
22 | wg.Add(1)
23 | go func() {
24 | defer wg.Done()
25 | defer close(openBrowserCh)
26 | // Start a local server and get a token.
27 | testServer := httptest.NewServer(&authserver.Handler{
28 | TestingT: t,
29 | NewAuthorizationResponse: func(req authserver.AuthorizationRequest) string {
30 | if want := "email profile"; req.Scope != want {
31 | t.Errorf("scope wants %s but %s", want, req.Scope)
32 | return fmt.Sprintf("%s?error=invalid_scope", req.RedirectURI)
33 | }
34 | if !assertRedirectURI(t, req.RedirectURI, "https", "localhost", "") {
35 | return fmt.Sprintf("%s?error=invalid_redirect_uri", req.RedirectURI)
36 | }
37 | return fmt.Sprintf("%s?state=%s&code=%s", req.RedirectURI, req.State, "AUTH_CODE")
38 | },
39 | NewTokenResponse: func(req authserver.TokenRequest) (int, string) {
40 | if want := "AUTH_CODE"; req.Code != want {
41 | t.Errorf("code wants %s but %s", want, req.Code)
42 | return 400, invalidGrantResponse
43 | }
44 | return 200, validTokenResponse
45 | },
46 | })
47 | defer testServer.Close()
48 | cfg := oauth2cli.Config{
49 | OAuth2Config: oauth2.Config{
50 | ClientID: "YOUR_CLIENT_ID",
51 | ClientSecret: "YOUR_CLIENT_SECRET",
52 | Scopes: []string{"email", "profile"},
53 | Endpoint: oauth2.Endpoint{
54 | AuthURL: testServer.URL + "/auth",
55 | TokenURL: testServer.URL + "/token",
56 | },
57 | },
58 | LocalServerCertFile: "testdata/server.crt",
59 | LocalServerKeyFile: "testdata/server.key",
60 | LocalServerReadyChan: openBrowserCh,
61 | LocalServerMiddleware: loggingMiddleware(t),
62 | Logf: t.Logf,
63 | }
64 | token, err := oauth2cli.GetToken(ctx, cfg)
65 | if err != nil {
66 | t.Errorf("could not get a token: %s", err)
67 | return
68 | }
69 | if token.AccessToken != "ACCESS_TOKEN" {
70 | t.Errorf("AccessToken wants %s but %s", "ACCESS_TOKEN", token.AccessToken)
71 | }
72 | if token.RefreshToken != "REFRESH_TOKEN" {
73 | t.Errorf("RefreshToken wants %s but %s", "REFRESH_TOKEN", token.RefreshToken)
74 | }
75 | }()
76 | wg.Add(1)
77 | go func() {
78 | defer wg.Done()
79 | toURL, ok := <-openBrowserCh
80 | if !ok {
81 | t.Errorf("server already closed")
82 | return
83 | }
84 | client.GetAndVerify(t, toURL, 200, oauth2cli.DefaultLocalServerSuccessHTML)
85 | }()
86 | wg.Wait()
87 | }
88 |
--------------------------------------------------------------------------------
/example/README.md:
--------------------------------------------------------------------------------
1 | # oauth2cli example
2 |
3 | This is an example application using oauth2cli.
4 |
5 | To build this application,
6 |
7 | ```sh
8 | go build
9 | ```
10 |
11 | ## Google
12 |
13 | Create your OAuth client.
14 |
15 | 1. Open https://console.cloud.google.com/apis/credentials
16 | 1. Create an OAuth client ID where the application type is other.
17 |
18 | Run this application.
19 |
20 | ```sh
21 | ./example -client-id xxx.apps.googleusercontent.com -client-secret xxxxxxxx
22 | ```
23 |
24 | ```console
25 | 2019/10/03 00:01:35 Open http://localhost:53753
26 | ...
27 | 2019/10/03 00:01:40 You got a valid token until 2019-10-03 01:01:40.083238 +0900 JST m=+3604.526750517
28 | ```
29 |
30 | It will automatically open the browser and you can log in to Google.
31 |
32 | ### Use a TLS certificate
33 |
34 | You can set a certificate and key for the local server.
35 |
36 | ```sh
37 | ./example -client-id xxx.apps.googleusercontent.com -client-secret xxxxxxxx \
38 | -local-server-cert ../e2e_test/testdata/cert.pem -local-server-key ../e2e_test/testdata/cert-key.pem
39 | ```
40 |
41 | ## GitHub
42 |
43 | Create your OAuth App.
44 | Set the callback URL to `http://localhost`.
45 |
46 | Run this application.
47 |
48 | ```sh
49 | ./example -auth-url https://github.com/login/oauth/authorize -token-url https://github.com/login/oauth/access_token -client-id xxxxxxxx -client-secret xxxxxxxx
50 | ```
51 |
52 | ```console
53 | 09:52:45.384489 main.go:84: Open http://localhost:61865
54 | 09:52:45.384507 server.go:36: oauth2cli: starting a server at 127.0.0.1:61865
55 | 09:52:45.491072 server.go:135: oauth2cli: sending redirect to https://github.com/login/oauth/authorize?client_id=...
56 | ```
57 |
58 | You can set `-scopes` flag to request the scopes.
59 | See https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps.
60 |
61 | It will automatically open the browser and you can log in to GitHub.
62 |
--------------------------------------------------------------------------------
/example/main.go:
--------------------------------------------------------------------------------
1 | package main
2 |
3 | import (
4 | "context"
5 | "flag"
6 | "fmt"
7 | "log"
8 | "os"
9 | "strings"
10 |
11 | "github.com/int128/oauth2cli"
12 | "github.com/pkg/browser"
13 | "golang.org/x/oauth2"
14 | "golang.org/x/sync/errgroup"
15 | )
16 |
17 | func init() {
18 | log.SetFlags(log.Lshortfile | log.Lmicroseconds)
19 | }
20 |
21 | type cmdOptions struct {
22 | authURL string
23 | tokenURL string
24 | clientID string
25 | clientSecret string
26 | scopes string
27 | localServerCert string
28 | localServerKey string
29 | }
30 |
31 | func main() {
32 | var o cmdOptions
33 | flag.StringVar(&o.authURL, "auth-url", "https://accounts.google.com/o/oauth2/auth", "Authorization URL of the endpoint")
34 | flag.StringVar(&o.tokenURL, "token-url", "https://oauth2.googleapis.com/token", "Authorization URL of the endpoint")
35 | flag.StringVar(&o.clientID, "client-id", "", "OAuth Client ID")
36 | flag.StringVar(&o.clientSecret, "client-secret", "", "OAuth Client Secret (optional)")
37 | flag.StringVar(&o.scopes, "scopes", "email", "Scopes to request, comma separated")
38 | flag.StringVar(&o.localServerCert, "local-server-cert", "", "Path to a certificate file for the local server (optional)")
39 | flag.StringVar(&o.localServerKey, "local-server-key", "", "Path to a key file for the local server (optional)")
40 | flag.Parse()
41 | if o.clientID == "" {
42 | log.Printf(`You need to set oauth2 credentials.
43 | Open https://console.cloud.google.com/apis/credentials and create a client.
44 | Then set the following options:`)
45 | flag.PrintDefaults()
46 | os.Exit(1)
47 | return
48 | }
49 | if o.localServerCert != "" {
50 | log.Printf("Using the TLS certificate: %s", o.localServerCert)
51 | }
52 |
53 | ready := make(chan string, 1)
54 | defer close(ready)
55 | pkceVerifier := oauth2.GenerateVerifier()
56 | cfg := oauth2cli.Config{
57 | OAuth2Config: oauth2.Config{
58 | ClientID: o.clientID,
59 | ClientSecret: o.clientSecret,
60 | Endpoint: oauth2.Endpoint{
61 | AuthURL: o.authURL,
62 | TokenURL: o.tokenURL,
63 | },
64 | Scopes: strings.Split(o.scopes, ","),
65 | },
66 | AuthCodeOptions: []oauth2.AuthCodeOption{oauth2.S256ChallengeOption(pkceVerifier)},
67 | TokenRequestOptions: []oauth2.AuthCodeOption{oauth2.VerifierOption(pkceVerifier)},
68 | LocalServerReadyChan: ready,
69 | LocalServerCertFile: o.localServerCert,
70 | LocalServerKeyFile: o.localServerKey,
71 | Logf: log.Printf,
72 | }
73 |
74 | ctx := context.Background()
75 | eg, ctx := errgroup.WithContext(ctx)
76 | eg.Go(func() error {
77 | select {
78 | case url := <-ready:
79 | log.Printf("Open %s", url)
80 | if err := browser.OpenURL(url); err != nil {
81 | log.Printf("could not open the browser: %s", err)
82 | }
83 | return nil
84 | case <-ctx.Done():
85 | return fmt.Errorf("context done while waiting for authorization: %w", ctx.Err())
86 | }
87 | })
88 | eg.Go(func() error {
89 | token, err := oauth2cli.GetToken(ctx, cfg)
90 | if err != nil {
91 | return fmt.Errorf("could not get a token: %w", err)
92 | }
93 | log.Printf("You got a valid token until %s", token.Expiry)
94 | return nil
95 | })
96 | if err := eg.Wait(); err != nil {
97 | log.Fatalf("authorization error: %s", err)
98 | }
99 | }
100 |
--------------------------------------------------------------------------------
/go.mod:
--------------------------------------------------------------------------------
1 | module github.com/int128/oauth2cli
2 |
3 | go 1.23.0
4 |
5 | toolchain go1.24.4
6 |
7 | require (
8 | github.com/google/go-cmp v0.7.0
9 | github.com/int128/listener v1.3.0
10 | github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
11 | golang.org/x/oauth2 v0.30.0
12 | golang.org/x/sync v0.15.0
13 | )
14 |
15 | require golang.org/x/sys v0.1.0 // indirect
16 |
--------------------------------------------------------------------------------
/go.sum:
--------------------------------------------------------------------------------
1 | github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
2 | github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
3 | github.com/int128/listener v1.3.0 h1:ZFePbpzFUt1i6hBSY15rzqo8tHZHJPPQkqCtgOAwS8g=
4 | github.com/int128/listener v1.3.0/go.mod h1:zF9mx2wn+2J/7Idmxi5kgqrGgERr6vr8fK8KqENrRZ0=
5 | github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
6 | github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
7 | golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
8 | golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
9 | golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
10 | golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
11 | golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
12 | golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
13 |
--------------------------------------------------------------------------------
/oauth2cli.go:
--------------------------------------------------------------------------------
1 | // Package oauth2cli provides better user experience on OAuth 2.0 and OpenID Connect (OIDC) on CLI.
2 | // It allows simple and easy user interaction with Authorization Code Grant Flow and a local server.
3 | package oauth2cli
4 |
5 | import (
6 | "context"
7 | "fmt"
8 | "net/http"
9 |
10 | "github.com/int128/oauth2cli/oauth2params"
11 | "golang.org/x/oauth2"
12 | )
13 |
14 | var noopMiddleware = func(h http.Handler) http.Handler { return h }
15 |
16 | // DefaultLocalServerSuccessHTML is a default response body on authorization success.
17 | const DefaultLocalServerSuccessHTML = `
18 |
19 |
20 |
21 |
22 | You can close this window.
45 |