From 2fa206f2adb801b4e128bb67b0cec6a76ac15304 Mon Sep 17 00:00:00 2001
From: Severiano Badajoz <sbadajoz@chanzuckerberg.com>
Date: Fri, 23 Oct 2020 14:51:48 -0700
Subject: [PATCH] Add token invalidation tests to oauth tests (#1941)

* add tests

* run black

* run black and add disclaimer that tweaked errors on server

* lint

* change to get so it will return None

* tweak existing token instead of new one

* Trigger

* token is dict

* jsonify dict before encoding

* json dump instead of jsonify

* encode into bytes object

* use correct id token

* decode byte to string
---
 server/test/unit/auth/test_oauth.py | 26 ++++++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/server/test/unit/auth/test_oauth.py b/server/test/unit/auth/test_oauth.py
index f5a85cb5..1096ef1a 100644
--- a/server/test/unit/auth/test_oauth.py
+++ b/server/test/unit/auth/test_oauth.py
@@ -59,7 +59,12 @@ def logout():
 
 @mock_oauth_app.route("/.well-known/jwks.json")
 def jwks():
-    data = dict(alg="RS256", kty="RSA", use="sig", kid="fake_kid",)
+    data = dict(
+        alg="RS256",
+        kty="RSA",
+        use="sig",
+        kid="fake_kid",
+    )
     return make_response(jsonify(dict(keys=[data])))
 
 
@@ -147,6 +152,21 @@ class AuthTest(unittest.TestCase):
                 self.assertNotEqual(access_token_before, access_token_after)
                 self.assertNotEqual(id_token_before, id_token_after)
 
+                # invalid cookie fails
+                # (THIS CURRENTLY 500's ON THE SERVER, BUT SHOULD RETURN EMPTY USERINFO OR 401)
+                session.cookies.set(cookie_key, "TEST_" + cookie)
+                userinfo = session.get(f"{server}/d/pbmc3k.cxg/api/v0.2/userinfo").json()
+                self.assertIsNone(userinfo.get("userinfo"))
+
+                # invalid id_token fails
+                test_token = token
+                test_token["id_token"] = "TEST_" + id_token_after
+                encoded_cookie = base64.b64encode(json.dumps(test_token).encode()).decode()
+                session.cookies.set(cookie_key, encoded_cookie)
+                userinfo = session.get(f"{server}/d/pbmc3k.cxg/api/v0.2/userinfo").json()
+                self.assertFalse(userinfo["userinfo"]["is_authenticated"])
+                self.assertIsNone(userinfo["userinfo"]["username"])
+
             r = session.get(logout_uri)
             # check that the logout redirect worked
             self.assertEqual(r.history[0].status_code, 302)
@@ -161,7 +181,9 @@ class AuthTest(unittest.TestCase):
         # test with session cookies
         app_config = AppConfig()
         app_config.update_server_config(app__flask_secret_key="secret")
-        app_config.update_server_config(authentication__params_oauth__session_cookie=True,)
+        app_config.update_server_config(
+            authentication__params_oauth__session_cookie=True,
+        )
         self.auth_flow(app_config)
 
     def test_auth_oauth_cookie(self):