connector_oauth_test.go

// Copyright (c) 2026 Super Durable, Inc.
//
// Licensed under the Sustainable Use License 1.0.
// You may not use this file except in compliance with the License.
// See the LICENSE file in the repository root.
//
// SPDX-License-Identifier: LicenseRef-Sustainable-Use-1.0

package web

import (
	"context"
	"crypto/sha256"
	"encoding/base64"
	"encoding/json"
	"fmt"
	"maps"
	"net/http"
	"net/http/httptest"
	"net/url"
	"path/filepath"
	"strings"
	"testing"

	"github.com/superdurable/dex/web/api"
)

func TestConnectorOAuthCredentialDerivationRejectsNonHTTPSEndpoint(t *testing.T) {
	setup := &connectorSetup{releases: &connectorReleaseResolver{httpClient: http.DefaultClient}}
	_, err := setup.deriveConnectorOAuthCredentials(context.Background(), connectorOAuthTokenResponse{AccessToken: "secret"}, []connectorOAuthCredentialDerivation{{
		Credential: "primary_email", Endpoint: "http://provider.example/userinfo", Source: "email",
	}})
	if err == nil || !strings.Contains(err.Error(), "endpoint is invalid") {
		t.Fatalf("derive credentials error = %v", err)
	}
}

func TestConnectorOAuthRejectsHostSuppliedDerivedCredential(t *testing.T) {
	manifest := connectorReleaseManifest{}
	manifest.Spec.Auth.Fields = []connectorManifestField{{Name: "primary_email", Type: "string", Required: true}}
	manifest.Spec.Auth.OAuth2 = &connectorManifestOAuth2{CredentialDerivations: []connectorOAuthCredentialDerivation{{
		Credential: "primary_email", Endpoint: "https://provider.example/userinfo", Source: "email",
	}}}
	authMethod, _ := manifest.Spec.Auth.method("")
	err := validateManifestValueMaps(manifest, authMethod, connectorOAuthStartRequest{
		CredentialValues: map[string]json.RawMessage{"primary_email": json.RawMessage(`"spoofed@example.com"`)},
	})
	if err == nil || !strings.Contains(err.Error(), "not a host-supplied non-secret field") {
		t.Fatalf("validate derived credential error = %v", err)
	}
}

func TestConnectorOAuthStartAcceptsOnlyTheSelectedMethodConfiguration(t *testing.T) {
	manifest := connectorReleaseManifest{}
	manifest.Spec.Auth.Methods = []connectorManifestAuthMethod{
		{ID: "workspaceOAuth", Type: "oauth2", OAuth2: &connectorManifestOAuth2{}, Configuration: &connectorManifestAuthMethodConfiguration{
			Fields: []connectorManifestField{{Name: "workspaceDomain", Type: "string", Required: true}},
		}},
		{ID: "serviceAccount", Type: "serviceAccount", Configuration: &connectorManifestAuthMethodConfiguration{
			Fields: []connectorManifestField{{Name: "delegatedUser", Type: "string"}},
		}},
	}
	authMethod, _ := manifest.Spec.Auth.method("workspaceOAuth")
	for _, testCase := range []struct {
		configuration string
		isValid       bool
	}{
		{`{"workspaceDomain":"example.com"}`, true},
		{`{}`, false},
		{`{"workspaceDomain":"example.com","delegatedUser":"owner@example.com"}`, false},
	} {
		var configuration map[string]json.RawMessage
		if err := json.Unmarshal([]byte(testCase.configuration), &configuration); err != nil {
			t.Fatal(err)
		}
		err := validateManifestValueMaps(manifest, authMethod, connectorOAuthStartRequest{Configuration: configuration})
		if (err == nil) != testCase.isValid {
			t.Fatalf("configuration %s error = %v", testCase.configuration, err)
		}
	}
}

func TestConnectorOAuthClientSecretRequirementFollowsManifestField(t *testing.T) {
	authMethod := connectorManifestAuthMethod{
		OAuth2: &connectorManifestOAuth2{ClientSecretCredential: "oauth_client_secret"},
		Fields: []connectorManifestField{{Name: "oauth_client_secret", Required: false}},
	}
	if connectorOAuthClientSecretRequired(authMethod) {
		t.Fatal("optional PKCE client secret was required")
	}
	authMethod.Fields[0].Required = true
	if !connectorOAuthClientSecretRequired(authMethod) {
		t.Fatal("required confidential client secret was optional")
	}
}

func TestConnectorOAuthUsesPKCESingleUseStateAndDoesNotPersistClientOrRefreshSecret(t *testing.T) {
	testConnectorOAuthPKCEFlow(t, "/")
}

func TestConnectorOAuthRedirectsStayUnderBasePath(t *testing.T) {
	testConnectorOAuthPKCEFlow(t, "/dex/web")
}

func testConnectorOAuthPKCEFlow(t *testing.T, basePath string) {
	t.Helper()
	identity := connectorDefinitionIdentity{
		ConnectorID: "gmail", OperationID: "sendMessage", OperationKind: "mutation", ConnectionName: "sender",
		ModulePath:    "github.com/superdurable/dex-connectors-library/connectors/google/gmail",
		ModuleVersion: "v0.1.1", ConfigurationEnabled: true,
	}
	var metadata []byte
	var receivedVerifier string
	server := httptest.NewTLSServer(http.HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
		switch filepath.Base(request.URL.Path) {
		case connectorReleaseDigestName:
			digest := sha256.Sum256(metadata)
			_, err := fmt.Fprintf(response, "%x  %s\n", digest, connectorReleaseMetadataName)
			if err != nil {
				t.Error(err)
			}
		case connectorReleaseMetadataName:
			_, err := response.Write(metadata)
			if err != nil {
				t.Error(err)
			}
		case "token":
			if err := request.ParseForm(); err != nil {
				t.Error(err)
			}
			receivedVerifier = request.Form.Get("code_verifier")
			if request.Form.Get("client_secret") != "oauth-client-secret" || request.Form.Get("code") != "authorization-code" {
				t.Error("token exchange fields are missing")
			}
			response.Header().Set("Content-Type", "application/json")
			_, err := response.Write([]byte(`{"access_token":"provider-access-token","refresh_token":"must-not-persist","scope":"openid email https://www.googleapis.com/auth/gmail.send","expires_in":3600,"token_type":"Bearer"}`))
			if err != nil {
				t.Error(err)
			}
		case "userinfo":
			if request.Header.Get("Authorization") != "Bearer provider-access-token" {
				t.Error("userinfo request is missing the provider access token")
			}
			response.Header().Set("Content-Type", "application/json")
			_, err := response.Write([]byte(`{"email":"owner@example.com","email_verified":true}`))
			if err != nil {
				t.Error(err)
			}
		default:
			http.NotFound(response, request)
		}
	}))
	defer server.Close()
	release := connectorRelease{
		ConnectorID: identity.ConnectorID, ModulePath: identity.ModulePath, Version: identity.ModuleVersion,
		Tag: "connectors/google/gmail/v0.1.1", SourceSHA: "source-sha",
		ManifestSHA256: strings.Repeat("0", sha256.Size*2),
	}
	release.Manifest.APIVersion = "connectors.dex.dev/v1alpha1"
	release.Manifest.Kind = "Connector"
	release.Manifest.Metadata.Name = "gmail"
	release.Manifest.Spec.Provider = "google"
	release.Manifest.Spec.Auth.Type = "oauth2"
	release.Manifest.Spec.Auth.Fields = []connectorManifestField{
		{Name: "access_token", Type: "secretString", Required: true},
		{Name: "primary_email", Type: "string", Required: true},
	}
	release.Manifest.Spec.Auth.OAuth2 = &connectorManifestOAuth2{
		AuthorizationEndpoint: server.URL + "/authorize", TokenEndpoint: server.URL + "/token",
		Scopes: []string{"openid", "email", "https://www.googleapis.com/auth/gmail.send"},
		CredentialDerivations: []connectorOAuthCredentialDerivation{{
			Credential: "primary_email", Endpoint: server.URL + "/userinfo", Source: "email", VerifiedBy: "email_verified",
		}},
		PKCE: true,
	}
	var err error
	metadata, err = json.Marshal(release)
	if err != nil {
		t.Fatal(err)
	}
	provider := connectorTestDefinitionProvider(t, []connectorDefinitionIdentity{identity})
	setup, err := newConnectorSetup(&Config{
		BindAddress: "127.0.0.1", ConnectorSetupEnabled: true, ConnectorConfigDirectory: t.TempDir(), BasePath: basePath,
	}, provider)
	if err != nil {
		t.Fatal(err)
	}
	setup.releases.baseURL = server.URL
	setup.releases.httpClient = server.Client()

	startBody := `{"clientId":"oauth-client-id","clientSecret":"oauth-client-secret","configuration":{},"credentialValues":{},"credentialSecrets":{}}`
	startRequest := httptest.NewRequest(http.MethodPost, "/api/v2/connector-connections/gmail/sender/oauth/start", strings.NewReader(startBody))
	startRequest.SetPathValue("connectorId", "gmail")
	startRequest.SetPathValue("connectionName", "sender")
	startRequest.Host = "127.0.0.1:8802"
	startRequest.Header.Set("Origin", "http://127.0.0.1:8802")
	startRequest.Header.Set(connectorCSRFHeader, setup.csrfToken)
	startRequest.Header.Set(api.V2DefinitionRevisionHeader, "sha256:test")
	startRecorder := httptest.NewRecorder()
	setup.handleOAuthStart(startRecorder, startRequest)
	if startRecorder.Code != http.StatusOK {
		t.Fatalf("OAuth start status = %d: %s", startRecorder.Code, startRecorder.Body.String())
	}
	var startResponse struct {
		AuthorizationURL string `json:"authorizationUrl"`
	}
	if err := json.Unmarshal(startRecorder.Body.Bytes(), &startResponse); err != nil {
		t.Fatal(err)
	}
	authorizationURL, err := url.Parse(startResponse.AuthorizationURL)
	if err != nil {
		t.Fatal(err)
	}
	state := authorizationURL.Query().Get("state")
	challenge := authorizationURL.Query().Get("code_challenge")
	if state == "" || challenge == "" || authorizationURL.Query().Get("code_challenge_method") != "S256" {
		t.Fatalf("authorization URL = %s", startResponse.AuthorizationURL)
	}
	wantRedirectURI := "http://127.0.0.1:8802" + joinBasePath(basePath, "/api/v2/connector-oauth/callback")
	if redirectURI := authorizationURL.Query().Get("redirect_uri"); redirectURI != wantRedirectURI {
		t.Fatalf("OAuth redirect URI = %q, want %q", redirectURI, wantRedirectURI)
	}

	callback := httptest.NewRequest(http.MethodGet, "/api/v2/connector-oauth/callback?state="+url.QueryEscape(state)+"&code=authorization-code", nil)
	callbackRecorder := httptest.NewRecorder()
	setup.handleOAuthCallback(callbackRecorder, callback)
	if callbackRecorder.Code != http.StatusSeeOther {
		t.Fatalf("OAuth callback status = %d: %s", callbackRecorder.Code, callbackRecorder.Body.String())
	}
	if location := callbackRecorder.Header().Get("Location"); location != joinBasePath(basePath, "/v1/connectors")+"?oauth=success&connectorId=gmail&connectionName=sender" {
		t.Fatalf("OAuth callback location = %q", location)
	}
	verifierDigest := sha256.Sum256([]byte(receivedVerifier))
	if base64.RawURLEncoding.EncodeToString(verifierDigest[:]) != challenge {
		t.Fatal("PKCE verifier does not match authorization challenge")
	}
	connections, err := setup.store.list()
	if err != nil {
		t.Fatal(err)
	}
	if len(connections) != 1 || string(connections[0].Credentials["access_token"]) != `"provider-access-token"` || string(connections[0].Credentials["primary_email"]) != `"owner@example.com"` {
		t.Fatalf("saved connections = %+v", connections)
	}
	encoded, err := json.Marshal(connections)
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(string(encoded), "oauth-client-secret") || strings.Contains(string(encoded), "must-not-persist") {
		t.Fatal("client or refresh secret persisted")
	}

	secondRecorder := httptest.NewRecorder()
	setup.handleOAuthCallback(secondRecorder, callback)
	if secondRecorder.Code != http.StatusBadRequest {
		t.Fatalf("reused OAuth state status = %d", secondRecorder.Code)
	}
}

func TestConnectorOAuthReauthorizationAssignsANewAuthorizationID(t *testing.T) {
	authorization := authorizeConnectorOAuthTestRelease(t, connectorManifestOAuth2{},
		respondWithConnectorOAuthTestToken(t, http.StatusOK, `{"access_token":"provider-access-token"}`))
	requireConnectorOAuthTestCallback(t, authorization, http.StatusSeeOther, "")
	first := requireConnectorTestAuthorizationID(t, authorization.setup.store, "example", "workspace")

	reauthorization := reauthorizeConnectorOAuthTestConnection(t, authorization.setup)
	requireConnectorOAuthTestCallback(t, reauthorization, http.StatusSeeOther, "")
	if got := requireConnectorTestAuthorizationID(t, authorization.setup.store, "example", "workspace"); got == first {
		t.Fatal("OAuth reauthorization with the same access token kept the authorizationId")
	}
}

// reauthorizeConnectorOAuthTestConnection runs OAuth start and callback again on a setup from authorizeConnectorOAuthTestRelease.
func reauthorizeConnectorOAuthTestConnection(t *testing.T, setup *connectorSetup) connectorOAuthTestAuthorization {
	t.Helper()
	startRequest := httptest.NewRequest(http.MethodPost, "/api/v2/connector-connections/example/workspace/oauth/start", strings.NewReader(
		`{"clientId":"oauth-client-id","clientSecret":"oauth-client-secret","configuration":{},"credentialValues":{},"credentialSecrets":{}}`,
	))
	startRequest.SetPathValue("connectorId", "example")
	startRequest.SetPathValue("connectionName", "workspace")
	startRequest.Host = "127.0.0.1:8802"
	startRequest.Header.Set("Origin", "http://127.0.0.1:8802")
	startRequest.Header.Set(connectorCSRFHeader, setup.csrfToken)
	startRequest.Header.Set(api.V2DefinitionRevisionHeader, "sha256:test")
	startRecorder := httptest.NewRecorder()
	setup.handleOAuthStart(startRecorder, startRequest)
	if startRecorder.Code != http.StatusOK {
		t.Fatalf("reauthorization start status = %d: %s", startRecorder.Code, startRecorder.Body.String())
	}
	var startResponse struct {
		AuthorizationURL string `json:"authorizationUrl"`
	}
	if err := json.Unmarshal(startRecorder.Body.Bytes(), &startResponse); err != nil {
		t.Fatal(err)
	}
	authorizationURL, err := url.Parse(startResponse.AuthorizationURL)
	if err != nil {
		t.Fatal(err)
	}
	callback := httptest.NewRequest(http.MethodGet, "/api/v2/connector-oauth/callback?state="+
		url.QueryEscape(authorizationURL.Query().Get("state"))+"&code=authorization-code", nil)
	callbackRecorder := httptest.NewRecorder()
	setup.handleOAuthCallback(callbackRecorder, callback)
	return connectorOAuthTestAuthorization{authorizationURL: authorizationURL, callback: callbackRecorder, setup: setup}
}

func TestSlackOAuthMappingsAcceptHostAppTokenAndExtractBotAndUserTokens(t *testing.T) {
	manifest := connectorReleaseManifest{}
	manifest.Spec.Auth.Type = "oauth2"
	manifest.Spec.Auth.Fields = []connectorManifestField{
		{Name: "bot_token", Type: "secretString", Required: true},
		{Name: "user_token", Type: "secretString", Required: true},
		{Name: "app_token", Type: "secretString", Required: true},
	}
	manifest.Spec.Auth.OAuth2 = &connectorManifestOAuth2{
		Scopes: []string{"chat:write"}, UserScopes: []string{"channels:history"},
		CredentialMappings: []connectorOAuthCredentialMapping{
			{Credential: "bot_token", Source: "access_token"},
			{Credential: "user_token", Source: "authed_user.access_token"},
		},
	}
	request := connectorOAuthStartRequest{
		Configuration: map[string]json.RawMessage{}, CredentialValues: map[string]json.RawMessage{},
		CredentialSecrets: map[string]string{"app_token": "xapp-secret"},
	}
	authMethod, _ := manifest.Spec.Auth.method("")
	if err := validateManifestValueMaps(manifest, authMethod, request); err != nil {
		t.Fatal(err)
	}
	raw := map[string]any{"access_token": "xoxb-bot", "authed_user": map[string]any{"access_token": "xoxp-user"}}
	botToken, found := connectorOAuthResponseValue(raw, "access_token")
	if !found || botToken != "xoxb-bot" {
		t.Fatalf("bot token = %q, found = %v", botToken, found)
	}
	userToken, found := connectorOAuthResponseValue(raw, "authed_user.access_token")
	if !found || userToken != "xoxp-user" {
		t.Fatalf("user token = %q, found = %v", userToken, found)
	}
}

func TestSlackOAuthSavesMappedBotUserAndHostAppTokens(t *testing.T) {
	identity := connectorDefinitionIdentity{
		ConnectorID: "slack", OperationID: "postThreadReply", OperationKind: "mutation", ConnectionName: "slack-workspace",
		ModulePath: "github.com/superdurable/dex-connectors-library/connectors/slack", ModuleVersion: "v0.1.0", ConfigurationEnabled: true,
	}
	var metadata []byte
	server := httptest.NewTLSServer(http.HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
		switch filepath.Base(request.URL.Path) {
		case connectorReleaseDigestName:
			digest := sha256.Sum256(metadata)
			_, _ = fmt.Fprintf(response, "%x  %s\n", digest, connectorReleaseMetadataName)
		case connectorReleaseMetadataName:
			_, _ = response.Write(metadata)
		case "token":
			if err := request.ParseForm(); err != nil {
				t.Error(err)
			}
			if request.Form.Get("code_verifier") != "" {
				t.Error("Slack OAuth must not send a PKCE verifier")
			}
			_, _ = response.Write([]byte(`{"ok":true,"access_token":"xoxb-bot","scope":"chat:write,channels:read","authed_user":{"access_token":"xoxp-user","scope":"channels:history"}}`))
		default:
			http.NotFound(response, request)
		}
	}))
	defer server.Close()
	release := connectorRelease{
		ConnectorID: identity.ConnectorID, ModulePath: identity.ModulePath, Version: identity.ModuleVersion,
		Tag: "connectors/slack/v0.1.0", SourceSHA: "source-sha", ManifestSHA256: strings.Repeat("0", sha256.Size*2),
	}
	release.Manifest.APIVersion = "connectors.dex.dev/v1alpha1"
	release.Manifest.Kind = "Connector"
	release.Manifest.Metadata.Name = "slack"
	release.Manifest.Spec.Provider = "slack"
	release.Manifest.Spec.Auth.Type = "oauth2"
	release.Manifest.Spec.Auth.Fields = []connectorManifestField{
		{Name: "bot_token", Type: "secretString", Required: true},
		{Name: "user_token", Type: "secretString", Required: true},
		{Name: "app_token", Type: "secretString", Required: true},
	}
	release.Manifest.Spec.Auth.OAuth2 = &connectorManifestOAuth2{
		AuthorizationEndpoint: server.URL + "/authorize", TokenEndpoint: server.URL + "/token",
		Scopes: []string{"chat:write", "channels:read"}, UserScopes: []string{"channels:history"},
		CredentialMappings: []connectorOAuthCredentialMapping{
			{Credential: "bot_token", Source: "access_token"},
			{Credential: "user_token", Source: "authed_user.access_token"},
		},
	}
	var err error
	metadata, err = json.Marshal(release)
	if err != nil {
		t.Fatal(err)
	}
	setup := connectorTestSetup(t, t.TempDir(), connectorTestDefinitionProvider(t, []connectorDefinitionIdentity{identity}))
	setup.releases.baseURL = server.URL
	setup.releases.httpClient = server.Client()
	startRequest := httptest.NewRequest(http.MethodPost, "/api/v2/connector-connections/slack/slack-workspace/oauth/start", strings.NewReader(
		`{"clientId":"client","clientSecret":"secret","configuration":{},"credentialValues":{},"credentialSecrets":{"app_token":"xapp-app"}}`,
	))
	startRequest.SetPathValue("connectorId", "slack")
	startRequest.SetPathValue("connectionName", "slack-workspace")
	startRequest.Host = "127.0.0.1:8802"
	startRequest.Header.Set("Origin", "http://127.0.0.1:8802")
	startRequest.Header.Set(connectorCSRFHeader, setup.csrfToken)
	startRequest.Header.Set(api.V2DefinitionRevisionHeader, "sha256:test")
	startRecorder := httptest.NewRecorder()
	setup.handleOAuthStart(startRecorder, startRequest)
	if startRecorder.Code != http.StatusOK {
		t.Fatalf("OAuth start status = %d: %s", startRecorder.Code, startRecorder.Body.String())
	}
	var startResponse struct {
		AuthorizationURL string `json:"authorizationUrl"`
	}
	if err := json.Unmarshal(startRecorder.Body.Bytes(), &startResponse); err != nil {
		t.Fatal(err)
	}
	authorizationURL, err := url.Parse(startResponse.AuthorizationURL)
	if err != nil {
		t.Fatal(err)
	}
	if authorizationURL.Query().Get("code_challenge") != "" || authorizationURL.Query().Get("user_scope") != "channels:history" {
		t.Fatalf("Slack authorization URL = %s", startResponse.AuthorizationURL)
	}
	callback := httptest.NewRequest(http.MethodGet, "/api/v2/connector-oauth/callback?state="+url.QueryEscape(authorizationURL.Query().Get("state"))+"&code=authorization-code", nil)
	callbackRecorder := httptest.NewRecorder()
	setup.handleOAuthCallback(callbackRecorder, callback)
	if callbackRecorder.Code != http.StatusSeeOther {
		t.Fatalf("OAuth callback status = %d: %s", callbackRecorder.Code, callbackRecorder.Body.String())
	}
	connection, found, err := setup.store.get("slack", "slack-workspace")
	if err != nil || !found {
		t.Fatalf("Slack connection found = %v, err = %v", found, err)
	}
	if string(connection.Credentials["bot_token"]) != `"xoxb-bot"` ||
		string(connection.Credentials["user_token"]) != `"xoxp-user"` ||
		string(connection.Credentials["app_token"]) != `"xapp-app"` {
		t.Fatalf("saved Slack credentials = %+v", connection.Credentials)
	}
}

func TestConnectorOAuthTokenExchangeAcceptsRFC6749ScopeAndStatusVariants(t *testing.T) {
	tests := []struct {
		name               string
		providerStatusCode int
		providerBody       string
		wantStatusCode     int
		wantErrorCode      string
	}{
		{
			name: "201 Created grants the listed scopes", providerStatusCode: http.StatusCreated,
			providerBody:   `{"access_token":"provider-access-token","token_type":"bearer","scope":"read write"}`,
			wantStatusCode: http.StatusSeeOther,
		},
		{
			name: "omitted scope grants the requested scopes", providerStatusCode: http.StatusOK,
			providerBody:   `{"access_token":"provider-access-token","token_type":"bearer"}`,
			wantStatusCode: http.StatusSeeOther,
		},
		{
			name: "null scope grants the requested scopes", providerStatusCode: http.StatusOK,
			providerBody:   `{"access_token":"provider-access-token","scope":null}`,
			wantStatusCode: http.StatusSeeOther,
		},
		{
			name: "scopes array grants the listed scopes", providerStatusCode: http.StatusOK,
			providerBody:   `{"access_token":"provider-access-token","scopes":["oauth","read","write"]}`,
			wantStatusCode: http.StatusSeeOther,
		},
		{
			name: "scope string takes precedence over a scopes array", providerStatusCode: http.StatusOK,
			providerBody:   `{"access_token":"provider-access-token","scope":"read,write","scopes":["read"]}`,
			wantStatusCode: http.StatusSeeOther,
		},
		{
			name: "present scope without a required scope", providerStatusCode: http.StatusOK,
			providerBody:   `{"access_token":"provider-access-token","scope":"read"}`,
			wantStatusCode: http.StatusBadRequest, wantErrorCode: "CONNECTOR_OAUTH_SCOPE_INSUFFICIENT",
		},
		{
			name: "present scope without a required scope ignores a scopes array", providerStatusCode: http.StatusOK,
			providerBody:   `{"access_token":"provider-access-token","scope":"read","scopes":["read","write"]}`,
			wantStatusCode: http.StatusBadRequest, wantErrorCode: "CONNECTOR_OAUTH_SCOPE_INSUFFICIENT",
		},
		{
			name: "empty scope grants no scopes", providerStatusCode: http.StatusOK,
			providerBody:   `{"access_token":"provider-access-token","scope":""}`,
			wantStatusCode: http.StatusBadRequest, wantErrorCode: "CONNECTOR_OAUTH_SCOPE_INSUFFICIENT",
		},
		{
			name: "scopes array without a required scope", providerStatusCode: http.StatusOK,
			providerBody:   `{"access_token":"provider-access-token","scopes":["read"]}`,
			wantStatusCode: http.StatusBadRequest, wantErrorCode: "CONNECTOR_OAUTH_SCOPE_INSUFFICIENT",
		},
		{
			name: "scopes that is not a string array grants no scopes", providerStatusCode: http.StatusOK,
			providerBody:   `{"access_token":"provider-access-token","scopes":"read write"}`,
			wantStatusCode: http.StatusBadRequest, wantErrorCode: "CONNECTOR_OAUTH_SCOPE_INSUFFICIENT",
		},
		{
			name: "4xx error response", providerStatusCode: http.StatusBadRequest,
			providerBody:   `{"error":"invalid_grant"}`,
			wantStatusCode: http.StatusBadGateway, wantErrorCode: "CONNECTOR_OAUTH_TOKEN_EXCHANGE_FAILED",
		},
		{
			name: "3xx response with a token", providerStatusCode: http.StatusMultipleChoices,
			providerBody:   `{"access_token":"provider-access-token","scope":"read write"}`,
			wantStatusCode: http.StatusBadGateway, wantErrorCode: "CONNECTOR_OAUTH_TOKEN_EXCHANGE_FAILED",
		},
		{
			name: "5xx response with a token", providerStatusCode: http.StatusInternalServerError,
			providerBody:   `{"access_token":"provider-access-token","scope":"read write"}`,
			wantStatusCode: http.StatusBadGateway, wantErrorCode: "CONNECTOR_OAUTH_TOKEN_EXCHANGE_FAILED",
		},
		{
			name: "2xx response with an error", providerStatusCode: http.StatusOK,
			providerBody:   `{"ok":false,"error":"invalid_code"}`,
			wantStatusCode: http.StatusBadGateway, wantErrorCode: "CONNECTOR_OAUTH_TOKEN_EXCHANGE_FAILED",
		},
	}
	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			authorization := authorizeConnectorOAuthTestRelease(t, connectorManifestOAuth2{Scopes: []string{"read", "write"}},
				respondWithConnectorOAuthTestToken(t, test.providerStatusCode, test.providerBody))
			requireConnectorOAuthTestCallback(t, authorization, test.wantStatusCode, test.wantErrorCode)
		})
	}
}

func TestConnectorOAuthOpenIDConnectScopesAreProvenByTheirIssuedTokens(t *testing.T) {
	tests := []struct {
		name           string
		providerBody   string
		wantStatusCode int
		wantErrorCode  string
	}{
		{
			name:           "Microsoft scope without offline_access or openid, with both tokens",
			providerBody:   `{"access_token":"provider-access-token","scope":"Mail.Read","refresh_token":"provider-refresh-token","id_token":"provider-id-token"}`,
			wantStatusCode: http.StatusSeeOther,
		},
		{
			name:           "listed offline_access and openid need no tokens",
			providerBody:   `{"access_token":"provider-access-token","scope":"Mail.Read offline_access openid"}`,
			wantStatusCode: http.StatusSeeOther,
		},
		{
			name:           "unlisted offline_access without a refresh token",
			providerBody:   `{"access_token":"provider-access-token","scope":"Mail.Read","id_token":"provider-id-token"}`,
			wantStatusCode: http.StatusBadRequest, wantErrorCode: "CONNECTOR_OAUTH_SCOPE_INSUFFICIENT",
		},
		{
			name:           "unlisted offline_access with a blank refresh token",
			providerBody:   `{"access_token":"provider-access-token","scope":"Mail.Read","refresh_token":" ","id_token":"provider-id-token"}`,
			wantStatusCode: http.StatusBadRequest, wantErrorCode: "CONNECTOR_OAUTH_SCOPE_INSUFFICIENT",
		},
		{
			name:           "unlisted openid without an ID token",
			providerBody:   `{"access_token":"provider-access-token","scope":"Mail.Read","refresh_token":"provider-refresh-token"}`,
			wantStatusCode: http.StatusBadRequest, wantErrorCode: "CONNECTOR_OAUTH_SCOPE_INSUFFICIENT",
		},
		{
			name:           "issued tokens do not prove other scopes",
			providerBody:   `{"access_token":"provider-access-token","scope":"User.Read","refresh_token":"provider-refresh-token","id_token":"provider-id-token"}`,
			wantStatusCode: http.StatusBadRequest, wantErrorCode: "CONNECTOR_OAUTH_SCOPE_INSUFFICIENT",
		},
	}
	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			authorization := authorizeConnectorOAuthTestRelease(t,
				connectorManifestOAuth2{Scopes: []string{"offline_access", "openid", "Mail.Read"}},
				respondWithConnectorOAuthTestToken(t, http.StatusOK, test.providerBody))
			requireConnectorOAuthTestCallback(t, authorization, test.wantStatusCode, test.wantErrorCode)
		})
	}
}

func TestConnectorOAuthUserScopesRequireASlackUserGrant(t *testing.T) {
	tests := []struct {
		name           string
		providerBody   string
		wantStatusCode int
		wantErrorCode  string
	}{
		{
			name:           "user grant with the required scope",
			providerBody:   `{"ok":true,"access_token":"provider-access-token","scope":"chat:write","authed_user":{"access_token":"provider-user-access-token","scope":"channels:history"}}`,
			wantStatusCode: http.StatusSeeOther,
		},
		{
			name:           "user token without scope grants the requested user scopes",
			providerBody:   `{"ok":true,"access_token":"provider-access-token","scope":"chat:write","authed_user":{"access_token":"provider-user-access-token"}}`,
			wantStatusCode: http.StatusSeeOther,
		},
		{
			name:           "user grant scope without a required user scope",
			providerBody:   `{"ok":true,"access_token":"provider-access-token","scope":"chat:write","authed_user":{"access_token":"provider-user-access-token","scope":"users:read"}}`,
			wantStatusCode: http.StatusBadRequest, wantErrorCode: "CONNECTOR_OAUTH_SCOPE_INSUFFICIENT",
		},
		{
			name:           "user identity without a user token or scope",
			providerBody:   `{"ok":true,"access_token":"provider-access-token","scope":"chat:write","authed_user":{"id":"U0123"}}`,
			wantStatusCode: http.StatusBadRequest, wantErrorCode: "CONNECTOR_OAUTH_SCOPE_INSUFFICIENT",
		},
		{
			name:           "missing authed_user",
			providerBody:   `{"ok":true,"access_token":"provider-access-token","scope":"chat:write"}`,
			wantStatusCode: http.StatusBadRequest, wantErrorCode: "CONNECTOR_OAUTH_SCOPE_INSUFFICIENT",
		},
	}
	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			authorization := authorizeConnectorOAuthTestRelease(t,
				connectorManifestOAuth2{Scopes: []string{"chat:write"}, UserScopes: []string{"channels:history"}},
				respondWithConnectorOAuthTestToken(t, http.StatusOK, test.providerBody))
			requireConnectorOAuthTestCallback(t, authorization, test.wantStatusCode, test.wantErrorCode)
		})
	}
}

func TestConnectorOAuthTokenRequestFollowsManifestEncodingAndClientAuthentication(t *testing.T) {
	tests := []struct {
		name                    string
		tokenRequestEncoding    string
		tokenEndpointAuthMethod string
		wantContentType         string
		wantClientSecretBasic   bool
	}{
		{name: "defaults", wantContentType: "application/x-www-form-urlencoded"},
		{
			name: "declared defaults", tokenRequestEncoding: "form", tokenEndpointAuthMethod: "client_secret_post",
			wantContentType: "application/x-www-form-urlencoded",
		},
		{name: "json encoding", tokenRequestEncoding: "json", wantContentType: "application/json"},
		{
			name: "client_secret_basic", tokenEndpointAuthMethod: "client_secret_basic",
			wantContentType: "application/x-www-form-urlencoded", wantClientSecretBasic: true,
		},
		{
			name: "json encoding with client_secret_basic", tokenRequestEncoding: "json", tokenEndpointAuthMethod: "client_secret_basic",
			wantContentType: "application/json", wantClientSecretBasic: true,
		},
	}
	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			var sentContentType string
			var sentParameters map[string]string
			var sentBasicClientID, sentBasicClientSecret string
			var hasBasicCredentials bool
			authorization := authorizeConnectorOAuthTestRelease(t, connectorManifestOAuth2{
				Scopes: []string{"read"}, PKCE: true,
				TokenRequestEncoding: test.tokenRequestEncoding, TokenEndpointAuthMethod: test.tokenEndpointAuthMethod,
			}, func(response http.ResponseWriter, request *http.Request) {
				sentContentType = request.Header.Get("Content-Type")
				sentBasicClientID, sentBasicClientSecret, hasBasicCredentials = request.BasicAuth()
				sentParameters = readConnectorOAuthTestTokenRequest(t, request)
				respondWithConnectorOAuthTestToken(t, http.StatusOK, `{"access_token":"provider-access-token","scope":"read"}`)(response, request)
			})
			requireConnectorOAuthTestCallback(t, authorization, http.StatusSeeOther, "")
			if sentContentType != test.wantContentType {
				t.Fatalf("token request Content-Type = %q, want %q", sentContentType, test.wantContentType)
			}
			wantParameters := map[string]string{
				"grant_type": "authorization_code", "code": "authorization-code",
				"redirect_uri":  "http://127.0.0.1:8802/api/v2/connector-oauth/callback",
				"code_verifier": sentParameters["code_verifier"],
			}
			if test.wantClientSecretBasic {
				if !hasBasicCredentials || sentBasicClientID != "oauth-client-id" || sentBasicClientSecret != "oauth-client-secret" {
					t.Fatalf("token request Basic credentials = %q, %q, %v", sentBasicClientID, sentBasicClientSecret, hasBasicCredentials)
				}
			} else {
				if hasBasicCredentials {
					t.Fatal("client_secret_post token request sent Basic credentials")
				}
				wantParameters["client_id"] = "oauth-client-id"
				wantParameters["client_secret"] = "oauth-client-secret"
			}
			if sentParameters["code_verifier"] == "" || !maps.Equal(sentParameters, wantParameters) {
				t.Fatalf("token request parameters = %v, want %v", sentParameters, wantParameters)
			}
		})
	}
}

func TestConnectorOAuthRejectsUnsupportedTokenRequestDeclarationsAtStart(t *testing.T) {
	for _, oauth2 := range []connectorManifestOAuth2{
		{Scopes: []string{"read"}, TokenRequestEncoding: "multipart"},
		{Scopes: []string{"read"}, TokenEndpointAuthMethod: "private_key_jwt"},
	} {
		_, startRecorder := startConnectorOAuthTestRelease(t, oauth2, func(response http.ResponseWriter, request *http.Request) {
			t.Error("token endpoint was called for an unsupported declaration")
		})
		var errorBody struct {
			Code string `json:"code"`
		}
		if err := json.Unmarshal(startRecorder.Body.Bytes(), &errorBody); err != nil {
			t.Fatal(err)
		}
		if startRecorder.Code != http.StatusBadGateway || errorBody.Code != "CONNECTOR_RELEASE_INVALID" {
			t.Fatalf("OAuth start for %+v = %d: %s", oauth2, startRecorder.Code, startRecorder.Body.String())
		}
	}
}

func TestConnectorOAuthWithoutScopesOmitsTheScopeParameter(t *testing.T) {
	for _, testCase := range []struct {
		scopes       []string
		providerBody string
	}{
		{providerBody: `{"access_token":"provider-access-token","token_type":"bearer"}`},
		{scopes: []string{}, providerBody: `{"access_token":"provider-access-token","scope":""}`},
	} {
		authorization := authorizeConnectorOAuthTestRelease(t, connectorManifestOAuth2{Scopes: testCase.scopes},
			respondWithConnectorOAuthTestToken(t, http.StatusOK, testCase.providerBody))
		requireConnectorOAuthTestCallback(t, authorization, http.StatusSeeOther, "")
		if _, hasScope := authorization.authorizationURL.Query()["scope"]; hasScope {
			t.Fatalf("authorization URL = %s", authorization.authorizationURL)
		}
	}
	authorization := authorizeConnectorOAuthTestRelease(t, connectorManifestOAuth2{Scopes: []string{"read", "write"}},
		respondWithConnectorOAuthTestToken(t, http.StatusOK, `{"access_token":"provider-access-token"}`))
	requireConnectorOAuthTestCallback(t, authorization, http.StatusSeeOther, "")
	if scope := authorization.authorizationURL.Query().Get("scope"); scope != "read write" {
		t.Fatalf("authorization scope = %q", scope)
	}
}

type connectorOAuthTestAuthorization struct {
	authorizationURL *url.URL
	callback         *httptest.ResponseRecorder
	setup            *connectorSetup
}

// authorizeConnectorOAuthTestRelease runs OAuth start and callback against a TLS provider whose token endpoint is handleToken.
func authorizeConnectorOAuthTestRelease(
	t *testing.T,
	oauth2 connectorManifestOAuth2,
	handleToken http.HandlerFunc,
) connectorOAuthTestAuthorization {
	t.Helper()
	setup, startRecorder := startConnectorOAuthTestRelease(t, oauth2, handleToken)
	if startRecorder.Code != http.StatusOK {
		t.Fatalf("OAuth start status = %d: %s", startRecorder.Code, startRecorder.Body.String())
	}
	var startResponse struct {
		AuthorizationURL string `json:"authorizationUrl"`
	}
	if err := json.Unmarshal(startRecorder.Body.Bytes(), &startResponse); err != nil {
		t.Fatal(err)
	}
	authorizationURL, err := url.Parse(startResponse.AuthorizationURL)
	if err != nil {
		t.Fatal(err)
	}
	callback := httptest.NewRequest(http.MethodGet, "/api/v2/connector-oauth/callback?state="+
		url.QueryEscape(authorizationURL.Query().Get("state"))+"&code=authorization-code", nil)
	callbackRecorder := httptest.NewRecorder()
	setup.handleOAuthCallback(callbackRecorder, callback)
	return connectorOAuthTestAuthorization{authorizationURL: authorizationURL, callback: callbackRecorder, setup: setup}
}

func startConnectorOAuthTestRelease(
	t *testing.T,
	oauth2 connectorManifestOAuth2,
	handleToken http.HandlerFunc,
) (*connectorSetup, *httptest.ResponseRecorder) {
	t.Helper()
	identity := connectorDefinitionIdentity{
		ConnectorID: "example", OperationID: "createRecord", OperationKind: "mutation", ConnectionName: "workspace",
		ModulePath:    "github.com/superdurable/dex-connectors-library/connectors/example",
		ModuleVersion: "v0.1.0", ConfigurationEnabled: true,
	}
	var metadata []byte
	server := httptest.NewTLSServer(http.HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
		switch filepath.Base(request.URL.Path) {
		case connectorReleaseDigestName:
			digest := sha256.Sum256(metadata)
			if _, err := fmt.Fprintf(response, "%x  %s\n", digest, connectorReleaseMetadataName); err != nil {
				t.Error(err)
			}
		case connectorReleaseMetadataName:
			if _, err := response.Write(metadata); err != nil {
				t.Error(err)
			}
		case "token":
			handleToken(response, request)
		default:
			http.NotFound(response, request)
		}
	}))
	t.Cleanup(server.Close)
	release := connectorRelease{
		ConnectorID: identity.ConnectorID, ModulePath: identity.ModulePath, Version: identity.ModuleVersion,
		Tag: "connectors/example/v0.1.0", SourceSHA: "source-sha", ManifestSHA256: strings.Repeat("0", sha256.Size*2),
	}
	release.Manifest.APIVersion = "connectors.dex.dev/v1alpha1"
	release.Manifest.Kind = "Connector"
	release.Manifest.Metadata.Name = identity.ConnectorID
	release.Manifest.Spec.Provider = "example"
	release.Manifest.Spec.Auth.Type = "oauth2"
	release.Manifest.Spec.Auth.Fields = []connectorManifestField{{Name: "access_token", Type: "secretString", Required: true}}
	oauth2.AuthorizationEndpoint = server.URL + "/authorize"
	oauth2.TokenEndpoint = server.URL + "/token"
	release.Manifest.Spec.Auth.OAuth2 = &oauth2
	var err error
	metadata, err = json.Marshal(release)
	if err != nil {
		t.Fatal(err)
	}
	setup := connectorTestSetup(t, t.TempDir(), connectorTestDefinitionProvider(t, []connectorDefinitionIdentity{identity}))
	setup.releases.baseURL = server.URL
	setup.releases.httpClient = server.Client()
	startRequest := httptest.NewRequest(http.MethodPost, "/api/v2/connector-connections/example/workspace/oauth/start", strings.NewReader(
		`{"clientId":"oauth-client-id","clientSecret":"oauth-client-secret","configuration":{},"credentialValues":{},"credentialSecrets":{}}`,
	))
	startRequest.SetPathValue("connectorId", identity.ConnectorID)
	startRequest.SetPathValue("connectionName", identity.ConnectionName)
	startRequest.Host = "127.0.0.1:8802"
	startRequest.Header.Set("Origin", "http://127.0.0.1:8802")
	startRequest.Header.Set(connectorCSRFHeader, setup.csrfToken)
	startRequest.Header.Set(api.V2DefinitionRevisionHeader, "sha256:test")
	startRecorder := httptest.NewRecorder()
	setup.handleOAuthStart(startRecorder, startRequest)
	return setup, startRecorder
}

func respondWithConnectorOAuthTestToken(t *testing.T, statusCode int, body string) http.HandlerFunc {
	return func(response http.ResponseWriter, request *http.Request) {
		response.Header().Set("Content-Type", "application/json")
		response.WriteHeader(statusCode)
		if _, err := response.Write([]byte(body)); err != nil {
			t.Error(err)
		}
	}
}

// readConnectorOAuthTestTokenRequest decodes a form or JSON token request body into its parameters.
func readConnectorOAuthTestTokenRequest(t *testing.T, request *http.Request) map[string]string {
	t.Helper()
	parameters := map[string]string{}
	if request.Header.Get("Content-Type") == "application/json" {
		if err := json.NewDecoder(request.Body).Decode(&parameters); err != nil {
			t.Error(err)
		}
		return parameters
	}
	if err := request.ParseForm(); err != nil {
		t.Error(err)
	}
	for name := range request.PostForm {
		parameters[name] = request.PostForm.Get(name)
	}
	return parameters
}

// requireConnectorOAuthTestCallback checks the callback outcome. A redirect must have saved the provider access token.
func requireConnectorOAuthTestCallback(
	t *testing.T,
	authorization connectorOAuthTestAuthorization,
	wantStatusCode int,
	wantErrorCode string,
) {
	t.Helper()
	if authorization.callback.Code != wantStatusCode {
		t.Fatalf("OAuth callback status = %d, want %d: %s", authorization.callback.Code, wantStatusCode, authorization.callback.Body.String())
	}
	if wantStatusCode != http.StatusSeeOther {
		var errorBody struct {
			Code string `json:"code"`
		}
		if err := json.Unmarshal(authorization.callback.Body.Bytes(), &errorBody); err != nil {
			t.Fatal(err)
		}
		if errorBody.Code != wantErrorCode {
			t.Fatalf("OAuth callback error code = %q, want %q", errorBody.Code, wantErrorCode)
		}
		return
	}
	connection, found, err := authorization.setup.store.get("example", "workspace")
	if err != nil || !found {
		t.Fatalf("OAuth connection found = %v, err = %v", found, err)
	}
	if string(connection.Credentials["access_token"]) != `"provider-access-token"` {
		t.Fatalf("saved OAuth credentials = %+v", connection.Credentials)
	}
}