hyperscale-stack / security / 38007901732

92%

master: 97%

Pull #89

github

test(oauth2): pin opt-in rotation and every-grant profile checks

Two behaviors of the rotation change had no test that would notice a
regression. An explicit RotateRefreshTokens opt-in under Profile20 must
still rotate at runtime, yet the suite kept passing when rotation
followed the profile alone or when Profile20 skipped it: the opt-in was
only exercised without a generator, where it fails closed. NewServer
must check every registered grant, yet the suite kept passing when the
check stopped after the first grant or returned on the first validator
that accepted the profile.

New tests rotate under Profile20 with the opt-in, both at the grant and
through the token endpoint: the replacement is returned, the presented
token is consumed, and replaying it is refused as reuse. Another builds
servers whose offending grant comes second, a legacy grant after a
refresh grant that can rotate and a refresh grant that cannot rotate
after client_credentials, and expects NewServer to refuse both.

The CHANGELOG now names sender-constrained refresh tokens as the
alternative RFC 9700 §2.2.2 allows for public clients, and the security
considerations say that NewServer also refuses the grant under Profile20
when RotateRefreshTokens is set. Refs #78.

28 of 28 new or added lines in 2 files covered. (100.0%)

3936 of 4287 relevant lines covered (91.81%)

13.19 hits per line