test(oidc): test auto_redirect_if_standalone_oidc and RP iniiate logout

2026-08-03 21:35:54 +02:00
parent 921cbef152
commit ac32595846
7 changed files with 583 additions and 17 deletions
@@ -0,0 +1,69 @@
+# =============================================================
+# OxiCloud — SSO-only WITHOUT auto-redirect policy
+# =============================================================
+# Sibling to tests/oidc/sso-only.hurl. Both run against
+# server-with-oidc-only-no-policy.env (OXICLOUD_AUTH_METHODS=oidc but
+# OXICLOUD_AUTH_POLICIES unset) and prove the SPECIFIC posture difference
+# the auto_redirect_if_standalone_oidc policy makes:
+#
+#   * with policy (sso-only.hurl):    GET /login → 307 to /api/auth/oidc/authorize
+#   * without policy (this file):     GET /login → 200 (SPA shell)
+#
+# In this posture the SPA renders the login page with the SSO button;
+# the user clicks it to start the OIDC flow. Everything else about the
+# OIDC surface is identical, so we DON'T re-run the full OIDC dance —
+# that's covered by sso-only.hurl + oidc.hurl. This file only asserts
+# what actually differs.
+# =============================================================
+
+
+# ─────────────────────────────────────────────────────────────
+# Step 1 — Providers reports SSO-only but WITHOUT auto-redirect.
+#          The `auto_redirect_to_oidc` field on the DTO comes from
+#          AuthApplicationService::auto_redirect_to_oidc(), which
+#          requires the policy in the vector. Without it → false.
+# ─────────────────────────────────────────────────────────────
+GET {{base_url}}/api/auth/oidc/providers
+
+HTTP 200
+[Asserts]
+jsonpath "$.enabled" == true
+jsonpath "$.password_login_enabled" == false
+jsonpath "$.magic_link_login_enabled" == false
+# The load-bearing difference from sso-only.hurl:
+jsonpath "$.auto_redirect_to_oidc" == false
+
+
+# ─────────────────────────────────────────────────────────────
+# Step 2 — GET /login must NOT redirect. The middleware's
+#          `should_redirect` predicate evaluates false because
+#          `auto_redirect_to_oidc()` returns false (policy absent),
+#          so the request falls through to the SPA fallback service.
+#          Result: 200 with the SPA shell HTML.
+# ─────────────────────────────────────────────────────────────
+GET {{base_url}}/login
+[Options]
+location: false
+
+HTTP 200
+# Deliberately no Location-header assertion — we're proving its ABSENCE
+# by way of the 200 status. If the middleware had incorrectly fired the
+# redirect this would be a 307.
+
+
+# ─────────────────────────────────────────────────────────────
+# Step 3 — The authorize endpoint still works (user clicks the SSO
+#          button → SPA fetches this URL → server redirects to IdP).
+#          Same shape as sso-only.hurl Step 4; here we only assert
+#          the FIRST hop returns a valid IdP URL, which is enough to
+#          prove the OIDC surface is functional under this posture.
+# ─────────────────────────────────────────────────────────────
+GET {{base_url}}/api/auth/oidc/authorize
+[Options]
+location: false
+
+HTTP 307
+[Asserts]
+# Location points at the fake IdP's /auth endpoint with the OAuth2
+# response_type / client_id / redirect_uri / PKCE dance.
+header "Location" matches "^{{oidc_issuer}}/auth\\?response_type=code&client_id={{oidc_client_id}}&"