tst_oauth2codeflow.cpp

// Copyright (C) 2017 The Qt Company Ltd.

// SPDX-License-Identifier: LicenseRef-Qt-Commercial OR GPL-3.0-only

#include <QtTest>

#include <QtNetworkAuth/qabstractoauthreplyhandler.h>

#include <QtNetworkAuth/qoauth2authorizationcodeflow.h>

#include <QtNetworkAuth/qoauthhttpserverreplyhandler.h>

#include "oauthtestutils.h"

using namespace Qt::StringLiterals;

using namespace std::chrono_literals;

class tst_OAuth2CodeFlow : public QObject

    Q_OBJECT

private Q_SLOTS:

    void initTestCase();

    void state();

#if QT_DEPRECATED_SINCE(6, 13)

    void accessTokenUrl();

#endif

    void getToken();

    void refreshToken();

    void getAndRefreshToken();

    void tokenRequestErrors();

    void refreshTokenErrorResponse();

    void authorizationErrors();

    void modifyTokenRequests();

    void pkce_data();

    void pkce();

    void nonce();

    void idToken();

#ifndef QOAUTH2_NO_LEGACY_SCOPE

    void scope_data();

    void scope();

#endif

    void requestedScopeTokens_data();

    void requestedScopeTokens();

    void grantedScopeTokens_data();

    void grantedScopeTokens();

    void refreshLeadTime_data();

    void refreshLeadTime();

    void alreadyExpiredTokenClientSideRefresh();

#ifndef QT_NO_SSL

    void tlsAuthentication();

#endif

    void extraTokens();

    void expirationAt();

private:

    QString testDataDir;

};

namespace Responses {

    static const auto tokenSuccess = R"(

                "access_token": "an-access-token",

                "refresh_token": "a-refresh-token",

                "token_type": "bearer",

                "expires_in": 3600

            })"_ba;

    static const auto OK_200 = "200 OK"_ba;

    ServerResponses defaults()

        ServerResponses responses;

        // responses.authBody not used by code flow tests

        responses.authHttpStatus = OK_200;

        responses.tokenBody = tokenSuccess;

        responses.tokenHttpStatus = OK_200;

        return responses;

struct ReplyHandler : QAbstractOAuthReplyHandler

    QString callback() const override

        return QLatin1String("test");

    QAbstractOAuth::Error aTokenRequestError = QAbstractOAuth::Error::NoError;

    void networkReplyFinished(QNetworkReply *reply) override

        if (aTokenRequestError != QAbstractOAuth::Error::NoError) {

            emit tokenRequestErrorOccurred(aTokenRequestError, "a token request error");

            return;

        auto data = reply->readAll();

        const QJsonDocument document = QJsonDocument::fromJson(data);

        emit tokensReceived(document.object().toVariantMap());

    void emitCallbackReceived(const QVariantMap &data)

        Q_EMIT callbackReceived(data);

    void emitTokensReceived(const QVariantMap &data)

        Q_EMIT tokensReceived(data);

};

void tst_OAuth2CodeFlow::initTestCase()

    // QLoggingCategory::setFilterRules(QStringLiteral("qt.networkauth* = true"));

#ifdef BUILTIN_TESTDATA

    testDataDir = QStringLiteral(":/shared/");

#else

    testDataDir = QFileInfo(QFINDTESTDATA("../shared/certs")).absolutePath();

    if (testDataDir.isEmpty())

        testDataDir = QCoreApplication::applicationDirPath();

    if (!testDataDir.endsWith(QLatin1String("/")))

        testDataDir += QLatin1String("/");

#endif

void tst_OAuth2CodeFlow::state()

    QOAuth2AuthorizationCodeFlow oauth2;

    oauth2.setAuthorizationUrl(QUrl{"authorizationUrl"_L1});

    oauth2.setTokenUrl(QUrl{"accessTokenUrl"_L1});

    ReplyHandler replyHandler;

    oauth2.setReplyHandler(&replyHandler);

    QSignalSpy statePropertySpy(&oauth2, &QAbstractOAuth2::stateChanged);

    QString stateParameter;

    oauth2.setModifyParametersFunction(

        [&] (QAbstractOAuth::Stage, QMultiMap<QString, QVariant> *parameters) {

            stateParameter = parameters->value(u"state"_s).toString();

});

    oauth2.grant();

    QVERIFY(!stateParameter.isEmpty()); // internally generated initial state used

    QCOMPARE(stateParameter, oauth2.state());

    QCOMPARE(stateParameter.size(), 32);

    // Test setting the 'state' property

    const QString simpleState = u"a_state"_s;

    oauth2.setState(simpleState);

    QCOMPARE(oauth2.state(), simpleState);

    QCOMPARE(statePropertySpy.size(), 1);

    QCOMPARE(statePropertySpy.at(0).at(0), simpleState);

    oauth2.grant();

    QCOMPARE(stateParameter, simpleState);

    // Test 'state' that contains illegal characters

    QTest::ignoreMessage(QtWarningMsg, "setState() contains illegal character(s), ignoring");

    oauth2.setState(u"foo€bar"_s);

    QCOMPARE(oauth2.state(), simpleState);

    QCOMPARE(statePropertySpy.size(), 1);

    // Test 'state' that requires encoding/decoding.

    // The 'state' value contains all allowed characters as defined by

    // https://datatracker.ietf.org/doc/html/rfc6749#appendix-A.5

    // state      = 1*VSCHAR

    // Where

    // VSCHAR     = %x20-7E

    const QString stateRequiringEncoding = u"! \"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~"_s;

    const QString stateAsEncoded = u"%21+%22%23%24%25%26%27%28%29%2A%2B%2C-.%2F0123456789%3A%3B%3C%3D%3E%3F%40ABCDEFGHIJKLMNOPQRSTUVWXYZ%5B%5C%5D%5E_%60abcdefghijklmnopqrstuvwxyz%7B%7C%7D~"_s;

    oauth2.setState(stateRequiringEncoding);

    QCOMPARE(oauth2.state(), stateRequiringEncoding);

    oauth2.grant();

    QCOMPARE(stateParameter, stateAsEncoded);

    // Conclude authorization stage, and check that the 'state' which we returned as encoded

    // matches the original decoded state (ie. the status changes to TemporaryCredentialsReceived)

    replyHandler.emitCallbackReceived({{"code", "acode"}, {"state", stateAsEncoded}});

    QTRY_COMPARE(oauth2.status(), QAbstractOAuth::Status::TemporaryCredentialsReceived);

#if QT_DEPRECATED_SINCE(6, 13)

QT_WARNING_PUSH

QT_WARNING_DISABLE_DEPRECATED

void tst_OAuth2CodeFlow::accessTokenUrl()

    QOAuth2AuthorizationCodeFlow oauth2;

    QCOMPARE_EQ(oauth2.accessTokenUrl(), QUrl());

    const QUrl someTokenUrl{"accessToken"_L1};

    const QUrl otherTokenUrl{"otherAccessToken"_L1};

    QSignalSpy tokenUrlChangedSpy(&oauth2, &QAbstractOAuth2::tokenUrlChanged);

    QSignalSpy accessTokenUrlChangedSpy(&oauth2,

                                        &QOAuth2AuthorizationCodeFlow::accessTokenUrlChanged);

    oauth2.setAccessTokenUrl(someTokenUrl);

    QCOMPARE_EQ(oauth2.tokenUrl(), someTokenUrl);

    QCOMPARE_EQ(oauth2.accessTokenUrl(), someTokenUrl);

    QCOMPARE_EQ(tokenUrlChangedSpy.size(), 1);

    QCOMPARE_EQ(tokenUrlChangedSpy.at(0).at(0).toUrl(), someTokenUrl);

    QCOMPARE_EQ(accessTokenUrlChangedSpy.size(), 1);

    QCOMPARE_EQ(accessTokenUrlChangedSpy.at(0).at(0).toUrl(), someTokenUrl);

    // setting the same value does not trigger any update

    tokenUrlChangedSpy.clear();

    accessTokenUrlChangedSpy.clear();

    oauth2.setAccessTokenUrl(someTokenUrl);

    QCOMPARE_EQ(oauth2.tokenUrl(), someTokenUrl);

    QCOMPARE_EQ(oauth2.accessTokenUrl(), someTokenUrl);

    QCOMPARE_EQ(tokenUrlChangedSpy.size(), 0);

    QCOMPARE_EQ(accessTokenUrlChangedSpy.size(), 0);

    // set another value

    tokenUrlChangedSpy.clear();

    accessTokenUrlChangedSpy.clear();

    oauth2.setAccessTokenUrl(otherTokenUrl);

    QCOMPARE_EQ(oauth2.tokenUrl(), otherTokenUrl);

    QCOMPARE_EQ(oauth2.accessTokenUrl(), otherTokenUrl);

    QCOMPARE_EQ(tokenUrlChangedSpy.size(), 1);

    QCOMPARE_EQ(tokenUrlChangedSpy.at(0).at(0).toUrl(), otherTokenUrl);

    QCOMPARE_EQ(accessTokenUrlChangedSpy.size(), 1);

    QCOMPARE_EQ(accessTokenUrlChangedSpy.at(0).at(0).toUrl(), otherTokenUrl);

QT_WARNING_POP

#endif

QT_WARNING_PUSH QT_WARNING_DISABLE_DEPRECATED

void tst_OAuth2CodeFlow::authorizationErrors()

    // This tests failures in authorization stage. For this test we don't need a web server

    // as we emit the final (failing) callbackReceived directly.

    // Helper to catch the expected warning messages:

    constexpr auto expectWarning = [](){

        static const QRegularExpression authStageWarning{"Authorization stage:.*"};

        QTest::ignoreMessage(QtWarningMsg, authStageWarning);

};

    QOAuth2AuthorizationCodeFlow oauth2;

    oauth2.setAuthorizationUrl(QUrl{"authorization"_L1});

#if QT_DEPRECATED_SINCE(6, 13)

    oauth2.setAccessTokenUrl(QUrl{"accessToken"_L1});

#else

    oauth2.setTokenUrl(QUrl{"accessToken"_L1});

#endif

    ReplyHandler replyHandler;

    oauth2.setReplyHandler(&replyHandler);

    QVariantMap callbackParameters;

    connect(&oauth2, &QOAuth2AuthorizationCodeFlow::authorizeWithBrowser,

            &oauth2, [&](const QUrl& /* url */) {

        replyHandler.emitCallbackReceived(callbackParameters);

});

    QSignalSpy requestFailedSpy(&oauth2, &QAbstractOAuth::requestFailed);

#if QT_DEPRECATED_SINCE(6, 13)

    QSignalSpy errorSpy(&oauth2, &QAbstractOAuth2::error);

#endif

    QSignalSpy serverReportedErrorOccurredSpy(&oauth2,

                                              &QAbstractOAuth2::serverReportedErrorOccurred);

    QSignalSpy statusSpy(&oauth2, &QAbstractOAuth2::statusChanged);

    auto clearSpies = [&](){

        requestFailedSpy.clear();

        serverReportedErrorOccurredSpy.clear();

#if QT_DEPRECATED_SINCE(6, 13)

        errorSpy.clear();

#endif

        statusSpy.clear();

};

    // Test error response from the authorization server (RFC 6749 section 5.2)

    callbackParameters = {{"error"_L1, "invalid_grant"_L1},

                          {"error_description"_L1, "The error description"_L1},

                          {"error_uri"_L1, "The error URI"_L1}};

    expectWarning();

    oauth2.grant();

#if QT_DEPRECATED_SINCE(6, 13)

    QTRY_COMPARE(errorSpy.count(), 1);

#endif

    QTRY_COMPARE(serverReportedErrorOccurredSpy.count(), 1);

    QTRY_COMPARE(requestFailedSpy.count(), 1);

#if QT_DEPRECATED_SINCE(6, 13)

    QCOMPARE(errorSpy.first().at(0).toString(), "invalid_grant"_L1);

    QCOMPARE(errorSpy.first().at(1).toString(), "The error description"_L1);

    QCOMPARE(errorSpy.first().at(2).toString(), "The error URI"_L1);

#endif

    QCOMPARE(serverReportedErrorOccurredSpy.first().at(0).toString(), "invalid_grant"_L1);

    QCOMPARE(serverReportedErrorOccurredSpy.first().at(1).toString(), "The error description"_L1);

    QCOMPARE(serverReportedErrorOccurredSpy.first().at(2).toString(), "The error URI"_L1);

    QCOMPARE(requestFailedSpy.first().at(0).value<QAbstractOAuth::Error>(),

             QAbstractOAuth::Error::ServerError);

    QVERIFY(statusSpy.isEmpty());

    QCOMPARE(oauth2.status(), QAbstractOAuth::Status::NotAuthenticated);

    // Test not providing authorization code

    clearSpies();

    callbackParameters = {{"state"_L1, "thestate"_L1}};

    expectWarning();

    oauth2.grant();

    QTRY_COMPARE(requestFailedSpy.count(), 1);

    QCOMPARE(requestFailedSpy.first().at(0).value<QAbstractOAuth::Error>(),

             QAbstractOAuth::Error::OAuthTokenNotFoundError);

#if QT_DEPRECATED_SINCE(6, 13)

    QCOMPARE(errorSpy.count(), 0);

#endif

    QCOMPARE(serverReportedErrorOccurredSpy.count(), 0);

    QVERIFY(statusSpy.isEmpty());

    QCOMPARE(oauth2.status(), QAbstractOAuth::Status::NotAuthenticated);

    // Test not providing a state

    clearSpies();

    callbackParameters = {{"code"_L1, "thecode"_L1}};

    expectWarning();

    oauth2.grant();

    QTRY_COMPARE(requestFailedSpy.count(), 1);

    QCOMPARE(requestFailedSpy.first().at(0).value<QAbstractOAuth::Error>(),

             QAbstractOAuth::Error::ServerError);

#if QT_DEPRECATED_SINCE(6, 13)

    QCOMPARE(errorSpy.count(), 0);

#endif

    QCOMPARE(serverReportedErrorOccurredSpy.count(), 0);

    QVERIFY(statusSpy.isEmpty());

    QCOMPARE(oauth2.status(), QAbstractOAuth::Status::NotAuthenticated);

    // Test state mismatch (here we use "thestate" while the actual, expected, state is a

    // random generated string varying each run

    clearSpies();

    callbackParameters = {{"code"_L1, "thecode"_L1}, {"state"_L1, "thestate"_L1}};

    expectWarning();

    oauth2.grant();

    QTRY_COMPARE(requestFailedSpy.count(), 1);

    QCOMPARE(requestFailedSpy.first().at(0).value<QAbstractOAuth::Error>(),

             QAbstractOAuth::Error::ServerError);

#if QT_DEPRECATED_SINCE(6, 13)

    QCOMPARE(errorSpy.count(), 0);

#endif

    QCOMPARE(serverReportedErrorOccurredSpy.count(), 0);

    QVERIFY(statusSpy.isEmpty());

    QCOMPARE(oauth2.status(), QAbstractOAuth::Status::NotAuthenticated);

QT_WARNING_POP

class RequestModifier : public QObject

    Q_OBJECT

public:

    RequestModifier(QObject *parent = nullptr) : QObject(parent) {}

    void handleRequestModification(QNetworkRequest &request, QAbstractOAuth::Stage stage)

        stageReceivedByModifier = stage;

        auto headers = request.headers();

        headers.append("test-header-name"_ba, valueToSet);

        request.setHeaders(headers);

    QAbstractOAuth::Stage stageReceivedByModifier =

        QAbstractOAuth::Stage::RequestingTemporaryCredentials;

    QByteArray valueToSet;

};

#define TEST_MODIFY_REQUEST_WITH_MODIFIER(STAGE_RECEIVED, VALUE_SET, VALUE_PREFIX) \

{ \

        server->receivedTokenRequests.clear(); \

        STAGE_RECEIVED = QAbstractOAuth::Stage::RequestingTemporaryCredentials; \

        VALUE_SET = QByteArray(VALUE_PREFIX) + "_access_token"; \

        oauth2.grant(); \

        /* Conclude authorization stage so that we proceed into access token request */ \

        replyHandler.emitCallbackReceived({{"code"_L1, "acode"_L1}, {"state"_L1, "a_state"_L1}}); \

        QTRY_COMPARE(STAGE_RECEIVED, QAbstractOAuth::Stage::RequestingAccessToken); \

        QTRY_COMPARE(server->receivedTokenRequests.size(), 1); \

        QTRY_COMPARE(server->receivedTokenRequests.at(0).headers.value("test-header-name"_ba), VALUE_SET); \

        QTRY_COMPARE(oauth2.status(), QAbstractOAuth::Status::Granted); \

        /* Refresh token request */ \

        VALUE_SET = QByteArray(VALUE_PREFIX) + "_refresh_token"; \

        server->receivedTokenRequests.clear(); \

        STAGE_RECEIVED = QAbstractOAuth::Stage::RequestingTemporaryCredentials; \

        oauth2.refreshTokens(); \

        QCOMPARE(oauth2.status(), QAbstractOAuth::Status::RefreshingToken); \

        QTRY_COMPARE(STAGE_RECEIVED, QAbstractOAuth::Stage::RefreshingAccessToken); \

        QTRY_COMPARE(server->receivedTokenRequests.size(), 1); \

        QTRY_COMPARE(server->receivedTokenRequests.at(0).headers.value("test-header-name"_ba), VALUE_SET); \

        QTRY_COMPARE(oauth2.status(), QAbstractOAuth::Status::Granted); \

        oauth2.clearNetworkRequestModifier(); \

} \

#define TEST_MODIFY_REQUEST_WITHOUT_MODIFIER(VALUE_SET) \

{ \

        server->receivedTokenRequests.clear(); \

        VALUE_SET = "must_not_be_set"_ba; \

        oauth2.grant(); \

        /* Conclude authorization stage so that we proceed into access token request */ \

        replyHandler.emitCallbackReceived({{"code"_L1, "acode"_L1}, {"state"_L1, "a_state"_L1}}); \

        QTRY_COMPARE(oauth2.status(), QAbstractOAuth::Status::Granted); \

        QTRY_COMPARE(server->receivedTokenRequests.size(), 1); \

        QVERIFY(server->receivedTokenRequests.at(0).headers.value("test-header-name"_ba).isEmpty()); \

        server->receivedTokenRequests.clear(); \

        oauth2.refreshTokens(); \

        QCOMPARE(oauth2.status(), QAbstractOAuth::Status::RefreshingToken); \

        QTRY_COMPARE(oauth2.status(), QAbstractOAuth::Status::Granted); \

        QTRY_COMPARE(server->receivedTokenRequests.size(), 1); \

        QVERIFY(server->receivedTokenRequests.at(0).headers.value("test-header-name"_ba).isEmpty()); \

        oauth2.clearNetworkRequestModifier(); \

} \

void tst_OAuth2CodeFlow::modifyTokenRequests()

    QOAuth2AuthorizationCodeFlow oauth2;

    std::unique_ptr<RequestModifier> context(new RequestModifier);

    QRegularExpression nullContextWarning(u".*Context object must not be null, ignoring"_s);

    QRegularExpression wrongThreadWarning(u".*Context object must reside in the same thread"_s);

    auto valueToSet = ""_ba;

    auto server = createAuthorizationServer<WebServer>(Responses::defaults());

    ReplyHandler replyHandler;

    oauth2.setReplyHandler(&replyHandler);

    oauth2.setRefreshToken(u"refresh_token"_s);

    oauth2.setAuthorizationUrl(server->authorizationEndpoint());

    oauth2.setTokenUrl(server->tokenEndpoint());

    oauth2.setState("a_state"_L1);

    QAbstractOAuth::Stage stageReceivedByModifier =

        QAbstractOAuth::Stage::RequestingTemporaryCredentials;

    auto modifierLambda = [&](QNetworkRequest &request, QAbstractOAuth::Stage stage) {

        stageReceivedByModifier = stage;

        auto headers = request.headers();

        headers.append("test-header-name"_ba, valueToSet);

        request.setHeaders(headers);

};

    std::function<void(QNetworkRequest &, QAbstractOAuth::Stage)> modifierFunc = modifierLambda;

    // Lambda with a context object

    oauth2.setNetworkRequestModifier(context.get(), modifierLambda);

    TEST_MODIFY_REQUEST_WITH_MODIFIER(stageReceivedByModifier, valueToSet, "lambda_with_context")

    // Test that the modifier will be cleared

    oauth2.clearNetworkRequestModifier();

    TEST_MODIFY_REQUEST_WITHOUT_MODIFIER(valueToSet)

    // Lambda without a context object

    QTest::ignoreMessage(QtWarningMsg, nullContextWarning);

    oauth2.setNetworkRequestModifier(nullptr, modifierLambda);

    TEST_MODIFY_REQUEST_WITHOUT_MODIFIER(valueToSet)

    // std::function with a context object

    oauth2.setNetworkRequestModifier(context.get(), modifierFunc);

    TEST_MODIFY_REQUEST_WITH_MODIFIER(stageReceivedByModifier, valueToSet, "func_with_context")

    // PMF with context object

    oauth2.setNetworkRequestModifier(context.get(), &RequestModifier::handleRequestModification);

    TEST_MODIFY_REQUEST_WITH_MODIFIER(context->stageReceivedByModifier,

                                      context->valueToSet, "pmf_with_context")

    // PMF without context object

    QTest::ignoreMessage(QtWarningMsg, nullContextWarning);

    oauth2.setNetworkRequestModifier(nullptr, &RequestModifier::handleRequestModification);

    TEST_MODIFY_REQUEST_WITHOUT_MODIFIER(context->valueToSet)

    // Destroy context object => no callback (or crash)

    oauth2.setNetworkRequestModifier(context.get(), modifierLambda);

    context.reset(nullptr);

    TEST_MODIFY_REQUEST_WITHOUT_MODIFIER(valueToSet)

    // Context object in wrong thread

    QThread thread;

    QObject objectInWrongThread;

    // Initially context object is in correct thread

    oauth2.setNetworkRequestModifier(&objectInWrongThread, modifierLambda);

    // Move to wrong thread, verify we get warnings when it's time to call the callback

    objectInWrongThread.moveToThread(&thread);

    oauth2.grant();

    QTest::ignoreMessage(QtWarningMsg, wrongThreadWarning);

    replyHandler.emitCallbackReceived({{"code"_L1, "acode"_L1}, {"state"_L1, "a_state"_L1}});

    QTRY_COMPARE(oauth2.status(), QAbstractOAuth::Status::Granted);

    // Now the context object is in wrong thread when attempting to set the modifier

    oauth2.clearNetworkRequestModifier();

    QTest::ignoreMessage(QtWarningMsg, wrongThreadWarning);

    oauth2.setNetworkRequestModifier(&objectInWrongThread, modifierLambda);

    TEST_MODIFY_REQUEST_WITHOUT_MODIFIER(valueToSet)

    // These must not compile

    // oauth2.setRequestModifier();

    // oauth2.setRequestModifier(&context, [](const QString& wrongType){});

    // oauth2.setRequestModifier(&context, [](QNetworkRequest &request, int wrongType){});

    // oauth2.setRequestModifier(&context, [](int wrongType, QAbstractOAuth::Stage stage){});

void tst_OAuth2CodeFlow::getToken()

    auto server = createAuthorizationServer<WebServer>(Responses::defaults());

    QOAuth2AuthorizationCodeFlow oauth2;

    oauth2.setAuthorizationUrl(server->authorizationEndpoint());

    oauth2.setTokenUrl(server->tokenEndpoint());

    ReplyHandler replyHandler;

    oauth2.setReplyHandler(&replyHandler);

    connect(&oauth2, &QOAuth2AuthorizationCodeFlow::authorizeWithBrowser,

            this, [&](const QUrl &url) {

        const QUrlQuery query(url.query());

        replyHandler.emitCallbackReceived(QVariantMap {

                                               { QLatin1String("code"), QLatin1String("test") },

                                               { QLatin1String("state"),

                                                 query.queryItemValue(QLatin1String("state")) }

});

});

    QSignalSpy grantedSpy(&oauth2, &QOAuth2AuthorizationCodeFlow::granted);

    oauth2.grant();

    QTRY_COMPARE(grantedSpy.size(), 1);

    QCOMPARE(oauth2.token(), "an-access-token"_L1);

void tst_OAuth2CodeFlow::refreshToken()

    auto server = createAuthorizationServer<WebServer>(Responses::defaults());

    QOAuth2AuthorizationCodeFlow oauth2;

#if QT_DEPRECATED_SINCE(6, 13)

    QT_IGNORE_DEPRECATIONS(oauth2.setAccessTokenUrl(server->tokenEndpoint());)

#else

    oauth2.setTokenUrl(server->tokenEndpoint());

#endif

    ReplyHandler replyHandler;

    oauth2.setReplyHandler(&replyHandler);

    oauth2.setRefreshToken(QLatin1String("refresh_token"));

    QSignalSpy grantedSpy(&oauth2, &QOAuth2AuthorizationCodeFlow::granted);

    oauth2.refreshTokens();

    QTRY_COMPARE(grantedSpy.size(), 1);

    QCOMPARE(oauth2.token(), QLatin1String("an-access-token"));

#if QT_DEPRECATED_SINCE(6, 13)

    // Verify that refreshAccessToken also works

    QT_IGNORE_DEPRECATIONS(oauth2.refreshAccessToken();)

    QTRY_COMPARE(grantedSpy.size(), 2);

#endif

void tst_OAuth2CodeFlow::getAndRefreshToken()

    auto server = createAuthorizationServer<WebServer>(Responses::defaults());

    QOAuth2AuthorizationCodeFlow oauth2;

    oauth2.setAuthorizationUrl(server->authorizationEndpoint());

    oauth2.setTokenUrl(server->tokenEndpoint());

    ReplyHandler replyHandler;

    oauth2.setReplyHandler(&replyHandler);

    connect(&oauth2, &QOAuth2AuthorizationCodeFlow::authorizeWithBrowser,

            this, [&](const QUrl &url) {

        const QUrlQuery query(url.query());

        replyHandler.emitCallbackReceived(QVariantMap {

                                              { QLatin1String("code"), QLatin1String("test") },

                                              { QLatin1String("state"),

                                                query.queryItemValue(QLatin1String("state")) }

});

});

    QSignalSpy grantedSpy(&oauth2, &QOAuth2AuthorizationCodeFlow::granted);

    oauth2.grant();

    QTRY_COMPARE(grantedSpy.size(), 1);

    QCOMPARE(oauth2.token(), "an-access-token"_L1);

    grantedSpy.clear();

    server->responses.tokenBody = R"(

                "access_token": "refreshed-access-token"

            })";

    oauth2.refreshTokens();

    QTRY_COMPARE(grantedSpy.size(), 1);

    QCOMPARE(oauth2.token(), QLatin1String("refreshed-access-token"));

void tst_OAuth2CodeFlow::tokenRequestErrors()

    // This test tests the token acquisition and refreshing errors.

    // Helper to catch the expected warning messages:

    constexpr auto expectWarning = [](){

        static const QRegularExpression tokenWarning{"Token request failed:.*"};

        QTest::ignoreMessage(QtWarningMsg, tokenWarning);

};

    auto server = createAuthorizationServer<WebServer>(Responses::defaults());

    QOAuth2AuthorizationCodeFlow oauth2;

    oauth2.setAuthorizationUrl(server->authorizationEndpoint());

    oauth2.setTokenUrl(server->tokenEndpoint());

    ReplyHandler replyHandler;

    oauth2.setReplyHandler(&replyHandler);

    QSignalSpy requestFailedSpy(&oauth2, &QAbstractOAuth::requestFailed);

    QSignalSpy grantedSpy(&oauth2, &QOAuth2AuthorizationCodeFlow::granted);

    QSignalSpy statusSpy(&oauth2, &QAbstractOAuth2::statusChanged);

    auto clearSpies = [&](){

        requestFailedSpy.clear();

        grantedSpy.clear();

        statusSpy.clear();

};

    connect(&oauth2, &QOAuth2AuthorizationCodeFlow::authorizeWithBrowser,

            &oauth2, [&](const QUrl &url) {

        // Successful authorization stage, after which we can test token requests.

        // For clarity: in these tests we omit browser interaction by directly triggering

        // the emission of replyhandler::callbackReceived() signal

        const QUrlQuery query(url.query());

        replyHandler.emitCallbackReceived(QVariantMap {

            { QLatin1String("code"), QLatin1String("test") },

            { QLatin1String("state"),

             query.queryItemValue(QLatin1String("state")) }

});

});

    // Check the initial state

    QVERIFY(requestFailedSpy.isEmpty());

    QVERIFY(grantedSpy.isEmpty());

    QVERIFY(statusSpy.isEmpty());

    QCOMPARE(oauth2.status(), QAbstractOAuth::Status::NotAuthenticated);

    // Try to get an access token with an invalid response

    server->responses.tokenBody = "an invalid response";

    expectWarning();

    oauth2.grant();

    QTRY_COMPARE(requestFailedSpy.size(), 1);

    QVERIFY(grantedSpy.isEmpty());

    QCOMPARE(statusSpy.size(), 1); // Authorization was successful so we get one signal

    QCOMPARE(oauth2.status(), QAbstractOAuth::Status::TemporaryCredentialsReceived);

    // Try to get an access token, but replyhandler indicates an error

    clearSpies();

    replyHandler.aTokenRequestError = QAbstractOAuth::Error::NetworkError;

    expectWarning();

    oauth2.grant();

    QTRY_COMPARE(requestFailedSpy.size(), 1);

    QVERIFY(grantedSpy.isEmpty());

    QCOMPARE(oauth2.status(), QAbstractOAuth::Status::TemporaryCredentialsReceived);

    // Make a successful access & refresh token acquisition

    replyHandler.aTokenRequestError = QAbstractOAuth::Error::NoError;

    clearSpies();

    server->responses.tokenBody = Responses::tokenSuccess;

    oauth2.grant();

    QTRY_COMPARE(grantedSpy.size(), 1);

    QCOMPARE(statusSpy.size(), 3);

    // First status change is going from TempCred back to NotAuthenticated

    QCOMPARE(statusSpy.takeFirst().at(0).value<QAbstractOAuth::Status>(),

             QAbstractOAuth::Status::NotAuthenticated);

    QCOMPARE(statusSpy.takeFirst().at(0).value<QAbstractOAuth::Status>(),

             QAbstractOAuth::Status::TemporaryCredentialsReceived);

    QCOMPARE(statusSpy.takeFirst().at(0).value<QAbstractOAuth::Status>(),

             QAbstractOAuth::Status::Granted);

    QVERIFY(requestFailedSpy.isEmpty());

    QCOMPARE(oauth2.status(), QAbstractOAuth::Status::Granted);

    QCOMPARE(oauth2.token(), u"an-access-token"_s);

    QCOMPARE(oauth2.refreshToken(), u"a-refresh-token"_s);

    // Successfully refresh access token

    clearSpies();

    oauth2.refreshTokens();

    QTRY_COMPARE(statusSpy.size(), 2);

    QCOMPARE(statusSpy.takeFirst().at(0).value<QAbstractOAuth::Status>(),

             QAbstractOAuth::Status::RefreshingToken);

    QCOMPARE(statusSpy.takeFirst().at(0).value<QAbstractOAuth::Status>(),

             QAbstractOAuth::Status::Granted);

    QCOMPARE(oauth2.status(), QAbstractOAuth::Status::Granted);

    QVERIFY(requestFailedSpy.isEmpty());

    // Failed access token refresh

    clearSpies();

    replyHandler.aTokenRequestError = QAbstractOAuth::Error::ServerError;

    expectWarning();

    oauth2.refreshTokens();

    QTRY_COMPARE(statusSpy.size(), 2);

    QCOMPARE(statusSpy.takeFirst().at(0).value<QAbstractOAuth::Status>(),

             QAbstractOAuth::Status::RefreshingToken);

    QCOMPARE(statusSpy.takeFirst().at(0).value<QAbstractOAuth::Status>(),

             QAbstractOAuth::Status::Granted); // back to granted since we have an access token

    QCOMPARE(requestFailedSpy.size(), 1);

    QCOMPARE(oauth2.status(), QAbstractOAuth::Status::Granted);

void tst_OAuth2CodeFlow::refreshTokenErrorResponse()

    auto server = createAuthorizationServer<WebServer>(Responses::defaults());

    QOAuth2AuthorizationCodeFlow oauth2;

    oauth2.setAuthorizationUrl(server->authorizationEndpoint());

    oauth2.setTokenUrl(server->tokenEndpoint());

    QOAuthHttpServerReplyHandler replyHandler;

    oauth2.setReplyHandler(&replyHandler);

    connect(&oauth2, &QOAuth2AuthorizationCodeFlow::authorizeWithBrowser,

            &oauth2, [&replyHandler](const QUrl &url) {

        const QUrlQuery query(url.query());

        emit replyHandler.callbackReceived({

            { u"code"_s, u"test"_s },

            { u"state"_s, query.queryItemValue(u"state"_s) }

});

});

    QSignalSpy grantedSpy(&oauth2, &QAbstractOAuth::granted);

    oauth2.grant();

    QTRY_COMPARE(grantedSpy.size(), 1);

    QCOMPARE(oauth2.status(), QAbstractOAuth::Status::Granted);

    QCOMPARE(oauth2.token(), u"an-access-token"_s);

    QCOMPARE(oauth2.refreshToken(), u"a-refresh-token"_s);

    server->responses.tokenHttpStatus = "400 Bad Request"_ba;

    // https://datatracker.ietf.org/doc/html/rfc6749#section-5.2

    // invalid_grant is for expired refresh tokens

    server->responses.tokenBody = R"({

        "error": "invalid_grant",

        "error_description": "Token is not active",

        "error_uri": "https://example.com/oauth/errors/invalid-grant"

    })"_ba;

    // We should get both server-side reported error as well as generic requestFailed()

    QSignalSpy serverErrorSpy(&oauth2, &QAbstractOAuth2::serverReportedErrorOccurred);

    QSignalSpy requestFailedSpy(&oauth2, &QAbstractOAuth::requestFailed);

    QSignalSpy statusSpy(&oauth2, &QAbstractOAuth::statusChanged);

    QTest::ignoreMessage(QtWarningMsg,

                         QRegularExpression{"Authorization stage: AuthenticationError:.*"});

    oauth2.refreshTokens();

    QTRY_COMPARE(serverErrorSpy.size(), 1);

    QCOMPARE(serverErrorSpy.at(0).at(0).toString(), u"invalid_grant"_s);

    QCOMPARE(serverErrorSpy.at(0).at(1).toString(), u"Token is not active"_s);

    QCOMPARE(serverErrorSpy.at(0).at(2).toUrl(),

             QUrl{u"https://example.com/oauth/errors/invalid-grant"_s});

    QCOMPARE(requestFailedSpy.size(), 1);

    QCOMPARE(requestFailedSpy.at(0).at(0).value<QAbstractOAuth::Error>(),

             QAbstractOAuth::Error::ServerError);

    QCOMPARE(statusSpy.size(), 2);

    QCOMPARE(statusSpy.at(0).at(0).value<QAbstractOAuth::Status>(),

             QAbstractOAuth::Status::RefreshingToken);

    // Since we still have access token, the flow returns back to granted

    // even if refresh failed

    QCOMPARE(statusSpy.at(1).at(0).value<QAbstractOAuth::Status>(),

             QAbstractOAuth::Status::Granted);

    QCOMPARE(oauth2.status(), QAbstractOAuth::Status::Granted);

    QCOMPARE(oauth2.token(), u"an-access-token"_s);

    QCOMPARE(oauth2.refreshToken(), u"a-refresh-token"_s);

using Method = QOAuth2AuthorizationCodeFlow::PkceMethod;

void tst_OAuth2CodeFlow::pkce_data()

    QTest::addColumn<Method>("method");

    QTest::addColumn<quint8>("verifierLength");

    QTest::addRow("none") << Method::None << quint8(43);

    QTest::addRow("plain_43") << Method::Plain << quint8(43);

    QTest::addRow("plain_77") << Method::Plain << quint8(77);

    QTest::addRow("S256_43") << Method::S256 << quint8(43);

    QTest::addRow("S256_88") << Method::S256 << quint8(88);

void tst_OAuth2CodeFlow::pkce()

    QFETCH(Method, method);

    QFETCH(quint8, verifierLength);

    static constexpr auto code_verifier = "code_verifier"_L1;

    static constexpr auto code_challenge = "code_challenge"_L1;

    static constexpr auto code_challenge_method = "code_challenge_method"_L1;

    QOAuth2AuthorizationCodeFlow oauth2;

    oauth2.setAuthorizationUrl(QUrl("authorization_url"));

    oauth2.setTokenUrl(QUrl("access_token_url"));

    oauth2.setState("a_state"_L1);

    QCOMPARE(oauth2.pkceMethod(), Method::S256); // the default

    oauth2.setPkceMethod(method, verifierLength);

    QCOMPARE(oauth2.pkceMethod(), method);

    QMultiMap<QString, QVariant> tokenRequestParms;

    oauth2.setModifyParametersFunction(

        [&] (QAbstractOAuth::Stage stage, QMultiMap<QString, QVariant> *parameters) {

            if (stage == QAbstractOAuth::Stage::RequestingAccessToken)

                tokenRequestParms = *parameters;

});

    ReplyHandler replyHandler;

    oauth2.setReplyHandler(&replyHandler);

    QSignalSpy openBrowserSpy(&oauth2, &QOAuth2AuthorizationCodeFlow::authorizeWithBrowser);

    oauth2.grant(); // Initiate authorization

    // 1. Verify the authorization URL query parameters

    QTRY_VERIFY(!openBrowserSpy.isEmpty());

    auto authParms = QUrlQuery{openBrowserSpy.takeFirst().at(0).toUrl()};

    QVERIFY(!authParms.hasQueryItem(code_verifier));

    const auto codeChallenge = authParms.queryItemValue(code_challenge).toLatin1();

    if (method == Method::None) {

        QVERIFY(!authParms.hasQueryItem(code_challenge));

        QVERIFY(!authParms.hasQueryItem(code_challenge_method));

    } else if (method == Method::Plain) {

        QCOMPARE(codeChallenge.size(), verifierLength); // With plain the challenge == verifier

        QCOMPARE(authParms.queryItemValue(code_challenge_method), "plain"_L1);

    } else { // S256

        QCOMPARE(codeChallenge.size(), 43); // SHA-256 is 32 bytes, and that in base64 is ~43 bytes

        QCOMPARE(authParms.queryItemValue(code_challenge_method), "S256"_L1);

    // Conclude authorization => starts access token request

    emit replyHandler.callbackReceived({{"code", "acode"}, {"state", "a_state"}});

    // 2. Verify the access token request parameters

    QTRY_VERIFY(!tokenRequestParms.isEmpty());

    QVERIFY(!tokenRequestParms.contains(code_challenge));

    QVERIFY(!tokenRequestParms.contains(code_challenge_method));

    // Verify the challenge received earlier was based on the verifier we receive here

    if (method == Method::None) {

        QVERIFY(!tokenRequestParms.contains(code_verifier));

    } else if (method == Method::Plain) {

        QVERIFY(tokenRequestParms.contains(code_verifier));

        QCOMPARE(tokenRequestParms.value(code_verifier).toByteArray(), codeChallenge);

    } else { // S256

        QVERIFY(tokenRequestParms.contains(code_verifier));

        const auto codeVerifier = tokenRequestParms.value(code_verifier).toByteArray();

        QCOMPARE(codeVerifier.size(), verifierLength);

        QCOMPARE(QCryptographicHash::hash(codeVerifier, QCryptographicHash::Algorithm::Sha256)

                 .toBase64(QByteArray::Base64Option::Base64UrlEncoding | QByteArray::Base64Option::OmitTrailingEquals)

                 , codeChallenge);

void tst_OAuth2CodeFlow::nonce()

    QOAuth2AuthorizationCodeFlow oauth2;

    const auto nonce = "a_nonce"_ba;

    ReplyHandler replyHandler;

    oauth2.setReplyHandler(&replyHandler);

    oauth2.setAuthorizationUrl(QUrl{"authorizationUrl"_L1});

    oauth2.setTokenUrl(QUrl{"accessTokenUrl"_L1});

    QByteArray nonceInAuthorizationUrl;

    connect(&oauth2, &QAbstractOAuth::authorizeWithBrowser, this, [&](const QUrl &url){

        QUrlQuery parameters(url);

        nonceInAuthorizationUrl = parameters.queryItemValue(u"nonce"_s).toUtf8();

});

    // Verify that nonce is set to authorization request when appropriate

    oauth2.setNonce(nonce);

    oauth2.setRequestedScopeTokens({"scope_item1"});

    // -- Nonce is always included

    oauth2.setNonceMode(QAbstractOAuth2::NonceMode::Enabled);

    oauth2.grant();

    QCOMPARE(nonceInAuthorizationUrl, nonce);

    // -- Nonce is never included

    oauth2.setNonceMode(QAbstractOAuth2::NonceMode::Disabled);

    oauth2.grant();

    QVERIFY(nonceInAuthorizationUrl.isEmpty());

    // -- Nonce is included if scope contains 'openid'

    oauth2.setNonceMode(QAbstractOAuth2::NonceMode::Automatic);

    oauth2.grant();

    QVERIFY(nonceInAuthorizationUrl.isEmpty());

    oauth2.setRequestedScopeTokens({"scope_item1", "openid"});

    oauth2.grant();

    QCOMPARE(nonceInAuthorizationUrl, nonce);

    // -- Clear nonce, one should be generated

    oauth2.setNonce("");

    QVERIFY(oauth2.nonce().isEmpty());

    oauth2.grant();

    QVERIFY(!oauth2.nonce().isEmpty());

    QCOMPARE(nonceInAuthorizationUrl, oauth2.nonce());

void tst_OAuth2CodeFlow::idToken()

    QOAuth2AuthorizationCodeFlow oauth2;

    oauth2.setRequestedScopeTokens({"openid"});

    oauth2.setAuthorizationUrl(QUrl{"authorizationUrl"_L1});

    oauth2.setTokenUrl(QUrl{"accessTokenUrl"_L1});

    oauth2.setState("a_state"_L1);

    ReplyHandler replyHandler;

    oauth2.setReplyHandler(&replyHandler);

    QSignalSpy idTokenSpy(&oauth2, &QAbstractOAuth2::idTokenChanged);

    QSignalSpy requestFailedSpy(&oauth2, &QAbstractOAuth::requestFailed);

    // Verify default token is empty

    QVERIFY(oauth2.idToken().isEmpty());

    // Test without openid and verify idToken doesn't change

    oauth2.setRequestedScopeTokens({"read"});

    oauth2.grant();

    // Conclude authorization stage in order to proceed to access token stage

    replyHandler.emitCallbackReceived({{"code"_L1, "acode"_L1}, {"state"_L1, "a_state"_L1}});

    // Conclude access token stage, during which the id token is (would be) provided

    replyHandler.emitTokensReceived({{"access_token"_L1, "at"_L1}});

    QTRY_COMPARE(oauth2.status(), QAbstractOAuth::Status::Granted);

    QVERIFY(idTokenSpy.isEmpty());

    QVERIFY(oauth2.idToken().isEmpty());

    // Test granted openid scope when none was requested (QTBUG-145561), first test:

    // - 'openid' scope not requested by client but

    // - 'openid' scope is granted by server and

    // - 'id_token' not provided by server

    oauth2.setRequestedScopeTokens({"read"});

    oauth2.grant();

    replyHandler.emitCallbackReceived({{"code"_L1, "acode"_L1}, {"state"_L1, "a_state"_L1}});

    replyHandler.emitTokensReceived({{"access_token"_L1, "at"_L1}, {"scope"_L1, "read openid"_L1}});

    QTRY_COMPARE(oauth2.status(), QAbstractOAuth::Status::Granted);

    QVERIFY(idTokenSpy.isEmpty());

    QVERIFY(oauth2.idToken().isEmpty());

    // - 'openid' scope not requested by client but

    // - 'openid' scope is granted by server and

    // - 'id_token' is provided by server

    oauth2.setRequestedScopeTokens({"read"});

    oauth2.grant();

    replyHandler.emitCallbackReceived({{"code"_L1, "acode"_L1}, {"state"_L1, "a_state"_L1}});

    replyHandler.emitTokensReceived({{"access_token"_L1, "at"_L1}, {"scope"_L1, "read openid"_L1},

                                     {"id_token"_L1, "unsolicited_id_token"_L1}});

    QTRY_COMPARE(oauth2.status(), QAbstractOAuth::Status::Granted);

    QVERIFY(!idTokenSpy.isEmpty());

    QCOMPARE(oauth2.idToken(), "unsolicited_id_token"_L1);

    idTokenSpy.clear();

    // Test with openid

    // Note: using a proper JWT or setting the matching 'nonce' is not required for this tests

    // purpose as we don't currently validate the received token, but no harm in being thorough

    auto idToken = createSignedJWT({}, {{"nonce"_L1, oauth2.nonce()}});

    oauth2.setRequestedScopeTokens({"openid"});

    oauth2.grant();

    replyHandler.emitCallbackReceived({{"code"_L1, "acode"_L1}, {"state"_L1, "a_state"_L1}});

    replyHandler.emitTokensReceived({{"access_token"_L1, "at"_L1}, {"id_token"_L1, idToken}});

    QTRY_COMPARE(oauth2.status(), QAbstractOAuth::Status::Granted);

    QCOMPARE(oauth2.idToken(), idToken);

    QCOMPARE(idTokenSpy.size(), 1);

    QCOMPARE(idTokenSpy.at(0).at(0).toByteArray(), idToken);

    idTokenSpy.clear();

    // Providing an id_token is not mandatory when refreshing tokens. Test first with the id_token

    oauth2.setRefreshToken("refresh_token"_L1);

    oauth2.refreshTokens();

    QTRY_COMPARE(oauth2.status(), QAbstractOAuth::Status::RefreshingToken);

    replyHandler.emitTokensReceived({{"access_token"_L1, "at"_L1}, {"id_token"_L1, "fresh_id"}});

    QCOMPARE(oauth2.status(), QAbstractOAuth::Status::Granted);

    QCOMPARE(idTokenSpy.size(), 1);

    QCOMPARE(oauth2.idToken(), "fresh_id"_L1);

    // Test without providing id_token (also must not clear the pre-existing id_token)

    oauth2.refreshTokens();

    QTRY_COMPARE(oauth2.status(), QAbstractOAuth::Status::RefreshingToken);

    replyHandler.emitTokensReceived({{"access_token"_L1, "at"_L1}});

    QCOMPARE(oauth2.status(), QAbstractOAuth::Status::Granted);

    QCOMPARE(idTokenSpy.size(), 1);

    QCOMPARE(oauth2.idToken(), "fresh_id"_L1);

    // Test missing id_token error

    QVERIFY(requestFailedSpy.isEmpty());

    const QRegularExpression tokenWarning{

        "Token request failed: \"'openid' scope requested and granted but ID token not received\""};

    QTest::ignoreMessage(QtWarningMsg, tokenWarning);

    oauth2.grant();

    replyHandler.emitCallbackReceived({{"code"_L1, "acode"_L1}, {"state"_L1, "a_state"_L1}});

    replyHandler.emitTokensReceived({{"access_token"_L1, "at"_L1}});

    QTRY_COMPARE(requestFailedSpy.size(), 1);

    QCOMPARE(requestFailedSpy.at(0).at(0).value<QAbstractOAuth::Error>(),

             QAbstractOAuth::Error::OAuthTokenNotFoundError);

    QCOMPARE(oauth2.status(), QAbstractOAuth::Status::TemporaryCredentialsReceived);

    // idToken is cleared on failure

    QCOMPARE(idTokenSpy.size(), 2);

    QVERIFY(oauth2.idToken().isEmpty());

#ifndef QOAUTH2_NO_LEGACY_SCOPE

QT_WARNING_PUSH QT_WARNING_DISABLE_DEPRECATED

void tst_OAuth2CodeFlow::scope_data()

    static const auto requestedScopeTokens = u"requested"_s;

    QTest::addColumn<QString>("scope");

    QTest::addColumn<QString>("granted_scope");

    QTest::addColumn<QString>("expected_scope");

    QTest::addRow("scope_returned")

        << requestedScopeTokens << requestedScopeTokens << requestedScopeTokens;

    QTest::addRow("differing_scope_returned")

        << requestedScopeTokens << u"granted"_s << u"granted"_s;

    QTest::addRow("empty_scope_returned")

        << requestedScopeTokens << u""_s << requestedScopeTokens;

void tst_OAuth2CodeFlow::scope()

    QFETCH(QString, scope);

    QFETCH(QString, granted_scope);

    QFETCH(QString, expected_scope);

    QOAuth2AuthorizationCodeFlow oauth2;

    QVERIFY(oauth2.scope().isEmpty());

    // Set the requested scope and verify it changes

    QSignalSpy scopeSpy(&oauth2, &QAbstractOAuth2::scopeChanged);

    oauth2.setScope(scope);

    QCOMPARE(scopeSpy.size(), 1);

    QCOMPARE(oauth2.scope(), scope);

    QCOMPARE(scopeSpy.at(0).at(0).toString(), scope);

    // Verify that empty authorization server 'scope' response doesn't overwrite the

    // requested scope, whereas a returned scope value does

    auto server = createAuthorizationServer<WebServer>(Responses::defaults());

    if (!granted_scope.isEmpty()) {

        server->responses.tokenBody =  R"(

                "access_token": "an-access-token",

                "refresh_token": "a-refresh-token",

                "token_type": "bearer",

                "expires_in": 3600,

                "scope": ")" + granted_scope.toLatin1() +

            "\"}";

    oauth2.setAuthorizationUrl(server->authorizationEndpoint());

#if QT_DEPRECATED_SINCE(6, 13)

    QT_IGNORE_DEPRECATIONS(oauth2.setAccessTokenUrl(server->tokenEndpoint());)

#else

    oauth2.setTokenUrl(server->tokenEndpoint());

#endif

    oauth2.setState("a_state"_L1);

    ReplyHandler replyHandler;

    oauth2.setReplyHandler(&replyHandler);

    connect(&oauth2, &QOAuth2AuthorizationCodeFlow::authorizeWithBrowser,

            this, [&](const QUrl &) {

                replyHandler.emitCallbackReceived(QVariantMap {

                    { "code"_L1, "a_code"_L1 }, { "state"_L1, "a_state"_L1 },

});

});

    oauth2.grant();

    QTRY_COMPARE(oauth2.status(), QAbstractOAuth::Status::Granted);

    QCOMPARE(oauth2.scope(), expected_scope);

    if (!granted_scope.isEmpty() && (granted_scope != scope)) {

        QCOMPARE(scopeSpy.size(), 2);

        QCOMPARE(scopeSpy.at(1).at(0).toString(), expected_scope);

    } else {

        QCOMPARE(scopeSpy.size(), 1);

QT_WARNING_POP

#endif // QOAUTH2_NO_LEGACY_SCOPE

void tst_OAuth2CodeFlow::requestedScopeTokens_data()

    const QByteArray f = "first";

    const QByteArray s = "second";

    QTest::addColumn<QSet<QByteArray>>("requested_scope");

    QTest::addColumn<QSet<QByteArray>>("expected_requested_scope");

    QTest::addRow("singlescope") << QSet{f} << QSet{f};

    QTest::addRow("multiscope")  << QSet{f, s} << QSet{f, s};

void tst_OAuth2CodeFlow::requestedScopeTokens()

    QFETCH(QSet<QByteArray>, requested_scope);

    QFETCH(QSet<QByteArray>, expected_requested_scope);

    QOAuth2AuthorizationCodeFlow oauth2;

    oauth2.setAuthorizationUrl(QUrl{"authorizationUrl"_L1});

    oauth2.setTokenUrl(QUrl{"accessTokenUrl"_L1});

    QVERIFY(oauth2.requestedScopeTokens().isEmpty());

    QSignalSpy requestedScopeTokensSpy(&oauth2, &QAbstractOAuth2::requestedScopeTokensChanged);

    QString resultingRequestScope;

    QObject::connect(&oauth2, &QAbstractOAuth2::authorizeWithBrowser, this,

                     [&resultingRequestScope](const QUrl &url) {

                         QUrlQuery queryParameters(url);

                         resultingRequestScope = queryParameters.queryItemValue(u"scope"_s);

});

    oauth2.setRequestedScopeTokens(requested_scope);

    QCOMPARE(requestedScopeTokensSpy.size(), 1);

    QCOMPARE(oauth2.requestedScopeTokens(), expected_requested_scope);

    QCOMPARE(requestedScopeTokensSpy.at(0).at(0).value<QSet<QByteArray>>(),

             expected_requested_scope);

    oauth2.grant();

    const auto scopeTokens = resultingRequestScope.toLatin1().split(' ');

    QCOMPARE_EQ(scopeTokens.size(), requested_scope.size());

    for (const auto &token : scopeTokens)

        QVERIFY2(requested_scope.contains(token), token.data());

void tst_OAuth2CodeFlow::grantedScopeTokens_data()

    const QSet<QByteArray> requestedScopeTokens = {"first", "second"};

    const QByteArray scope = "first second";

    const QByteArray granted1 = "granted1";

    const QByteArray granted2 = "granted2";

    const QByteArray grantedJoined = granted1 + " " + granted2;

    const QSet<QByteArray> grantedList = {granted1, granted2};

    QTest::addColumn<QSet<QByteArray>>("requested_scope");

    QTest::addColumn<QByteArray>("granted_scope");

    QTest::addColumn<QSet<QByteArray>>("expected_granted_scope");

    QTest::addRow("requested_scope_returned")

        << requestedScopeTokens << scope << requestedScopeTokens;

    QTest::addRow("differing_singlescope_returned")

        << requestedScopeTokens << granted1 << QSet{granted1};

    QTest::addRow("differing_multiscope_returned")

        << requestedScopeTokens << grantedJoined << grantedList;

    QTest::addRow("empty_scope_returned")

        << requestedScopeTokens << ""_ba << requestedScopeTokens;

void tst_OAuth2CodeFlow::grantedScopeTokens()

    QFETCH(QSet<QByteArray>, requested_scope);

    QFETCH(QByteArray, granted_scope);

    QFETCH(QSet<QByteArray>, expected_granted_scope);

    QOAuth2AuthorizationCodeFlow oauth2;

    QSignalSpy grantedSpy(&oauth2, &QAbstractOAuth2::grantedScopeTokensChanged);

    oauth2.setRequestedScopeTokens(requested_scope);

    oauth2.setAuthorizationUrl(QUrl{"authorizationUrl"_L1});

    oauth2.setTokenUrl(QUrl{"accessTokenUrl"_L1});

    oauth2.setState("a_state"_L1);

    ReplyHandler replyHandler;

    oauth2.setReplyHandler(&replyHandler);

    oauth2.grant();

    // Conclude authorization stage in order to proceed to access token stage

    replyHandler.emitCallbackReceived({{"code"_L1, "acode"_L1}, {"state"_L1, "a_state"_L1}});

    QVariantMap accessTokenResponseParameters;

    if (granted_scope.isEmpty())

        accessTokenResponseParameters = {{"access_token"_L1, "at"_L1}};

    else

        accessTokenResponseParameters = {{"access_token"_L1, "at"_L1}, {"scope"_L1, granted_scope}};

    // Conclude access token stage, during which the granted scope is provided

    replyHandler.emitTokensReceived(accessTokenResponseParameters);

    QTRY_COMPARE(grantedSpy.size(), 1);

    QCOMPARE(oauth2.grantedScopeTokens(), expected_granted_scope);

    QCOMPARE(grantedSpy.at(0).at(0).value<QSet<QByteArray>>(), expected_granted_scope);

void tst_OAuth2CodeFlow::refreshLeadTime_data()

    QTest::addColumn<std::chrono::seconds>("refreshLeadTime");

    QTest::addColumn<int>("expiresIn");

    QTest::addColumn<std::chrono::seconds>("waitTimeForExpiration");

    QTest::addColumn<bool>("autoRefresh");

    QTest::addColumn<bool>("expectExpirationSignal");

    QTest::addColumn<QString>("refreshToken");

    QTest::addColumn<bool>("expectRefreshRequest");

    const QString refreshToken = u"refreshToken"_s;

    // wait-time: 20s - 18s = 2s, + 1s for robustness => 3s

    QTest::addRow("validSetExpiration")

            << 18s << 20 << 3s << true  << true  << refreshToken << true;

    // wait-time calculation: 15s - 10s = 5s, + 1s for robustness => 6s

    QTest::addRow("validCalculatedExpiration")

            << 0s  << 15 << 6s << true  << true  << refreshToken << true;

    // wait-time: 5s - 10s = -5s => 2s minimum + 1s for robustness => 3s

    QTest::addRow("tooShortCalculatedExpiration")

            << 0s  << 5 << 3s  << true  << true  << refreshToken << true;

    // wait-time: 5s - 10s = -5s => 2s minimum + 1s for robustness => 3s

    QTest::addRow("tooShortSetExpiration")

            << 10s  << 5 << 3s << true  << true  << refreshToken << true;

    // wait-time: 3s - 1s = 2s, +1s for robustness => 3s

    QTest::addRow("leadTimeNearExpiration")

            << 1s  << 3 << 3s  << true  << true << refreshToken << true;

    QTest::addRow("invalidExpirationTime")

            << 1s  << 0 << 3s  << true  << false << refreshToken << false;

    // wait-time: 2s - 1s = 1s, => minimum 2s + 1s for robustness => 2s

    QTest::addRow("autoRefreshDisabled")

            << 1s  << 2 << 3s  << false << true  << refreshToken << false;

    QTest::addRow("emptyRefreshToken")

            << 18s << 20 << 3s << true  << true << QString() << false;

void tst_OAuth2CodeFlow::refreshLeadTime()

    QFETCH(std::chrono::seconds, refreshLeadTime);

    QFETCH(int, expiresIn);

    QFETCH(std::chrono::seconds, waitTimeForExpiration);

    QFETCH(bool, autoRefresh);

    QFETCH(bool, expectExpirationSignal);

    QFETCH(QString, refreshToken);

    QFETCH(bool, expectRefreshRequest);

    auto server = createAuthorizationServer<WebServer>(Responses::defaults());

    QOAuth2AuthorizationCodeFlow oauth2;

    oauth2.setAuthorizationUrl(server->authorizationEndpoint());

    oauth2.setTokenUrl(server->tokenEndpoint());

    oauth2.setState("s"_L1);

    oauth2.setRefreshLeadTime(refreshLeadTime);

    oauth2.setAutoRefresh(autoRefresh);

    ReplyHandler replyHandler;

    oauth2.setReplyHandler(&replyHandler);

    QSignalSpy expiredSpy(&oauth2, &QAbstractOAuth2::accessTokenAboutToExpire);

    QSignalSpy grantedSpy(&oauth2, &QOAuth2AuthorizationCodeFlow::granted);

    server->responses.tokenBody = R"(

            "access_token": "initial-access-token",

            "token_type": "bearer",

            "expires_in": ")" + QByteArray::number(expiresIn) + R"(",

            "scope": "s",

            "refresh_token": ")" + refreshToken.toLatin1() +

        "\"}";

    oauth2.grant();

    replyHandler.emitCallbackReceived(QVariantMap {{ "code"_L1, "c"_L1 }, { "state"_L1, "s"_L1 }});

    QTRY_COMPARE(grantedSpy.size(), 1);

    QCOMPARE(oauth2.token(), u"initial-access-token"_s);

    if (expectExpirationSignal) {

        server->responses.tokenBody = R"(

                "access_token": "refreshed-access-token",

                "token_type": "bearer",

                "expires_in": 3600,

                "scope": "s",

                "refresh_token": "a-refresh-token"

            })";

        QTRY_COMPARE_WITH_TIMEOUT(expiredSpy.size(), 1, waitTimeForExpiration);

        if (expectRefreshRequest) {

            QTRY_COMPARE(oauth2.token(), "refreshed-access-token"_L1);

            QCOMPARE(expiredSpy.size(), 1);

void tst_OAuth2CodeFlow::alreadyExpiredTokenClientSideRefresh()

    // This tests a particular corner-case where user adjusts leadTime such

    // that the pre-existing token is updated immediately

    QOAuth2AuthorizationCodeFlow oauth2;

    oauth2.setAuthorizationUrl(QUrl("authorizationEndpoint"_L1));

    oauth2.setTokenUrl(QUrl("accessTokenEndpoint"_L1));

    oauth2.setState("s"_L1);

    ReplyHandler replyHandler;

    oauth2.setReplyHandler(&replyHandler);

    QSignalSpy expiredSpy(&oauth2, &QAbstractOAuth2::accessTokenAboutToExpire);

    QSignalSpy grantedSpy(&oauth2, &QOAuth2AuthorizationCodeFlow::granted);

    oauth2.grant();

    replyHandler.emitCallbackReceived(QVariantMap {{ "code"_L1, "c"_L1 }, { "state"_L1, "s"_L1 }});

    replyHandler.emitTokensReceived({{"access_token"_L1, "at"_L1}, {"scope"_L1, "scope"},

                                     {"refresh_token"_L1, "refreshToken"_L1},

                                     {"expires_in"_L1, 3}});

    QTRY_COMPARE(grantedSpy.size(), 1);

    // Triggers an immediate expiration because from leadTime point-of-view the

    // token is either expired or should've expired already

    expiredSpy.clear();

    oauth2.setRefreshLeadTime(10s);

    QCOMPARE(expiredSpy.size(), 1);

#ifndef QT_NO_SSL

void tst_OAuth2CodeFlow::tlsAuthentication()

    if (!QSslSocket::supportsSsl())

        QSKIP("This test will fail because the backend does not support TLS");

    auto rollback = useTemporaryKeychain();

    // erros may vary, depending on backend

    const QSet<QSslError::SslError> expectedErrors{ QSslError::SelfSignedCertificate,

                                                    QSslError::CertificateUntrusted,

                                                    QSslError::HostNameMismatch };

    auto serverConfig = createSslConfiguration(testDataDir + "certs/selfsigned-server.key",

                                               testDataDir + "certs/selfsigned-server.crt");

    auto server = createAuthorizationServer<TlsWebServer>(Responses::defaults(), serverConfig);

    server->server->setExpectedSslErrors(expectedErrors);

    auto clientConfig = createSslConfiguration(testDataDir + "certs/selfsigned-client.key",

                                               testDataDir + "certs/selfsigned-client.crt");

    QNetworkAccessManager nam;

    QOAuth2AuthorizationCodeFlow oauth2;

    oauth2.setNetworkAccessManager(&nam);

    oauth2.setSslConfiguration(clientConfig);

    oauth2.setAuthorizationUrl(server->authorizationEndpoint());

    oauth2.setTokenUrl(server->tokenEndpoint());

    ReplyHandler replyHandler;

    oauth2.setReplyHandler(&replyHandler);

    connect(&oauth2, &QOAuth2AuthorizationCodeFlow::authorizeWithBrowser,

            this, [&](const QUrl &url) {

        const QUrlQuery query(url.query());

        replyHandler.emitCallbackReceived(QVariantMap {

                                               { QLatin1String("code"), QLatin1String("test") },

                                               { QLatin1String("state"),

                                                 query.queryItemValue(QLatin1String("state")) }

});

});

    connect(&nam, &QNetworkAccessManager::sslErrors, this,

        [&expectedErrors](QNetworkReply *r, const QList<QSslError> &errors) {

            // On some Windows machines the test might report all

            // three expected errors.

            QCOMPARE_GE(errors.size(), 2);

            QCOMPARE_LE(errors.size(), 3);

            for (const auto &err : errors)

                QVERIFY(expectedErrors.contains(err.error()));

            r->ignoreSslErrors();

});

    QSignalSpy grantedSpy(&oauth2, &QOAuth2AuthorizationCodeFlow::granted);

    oauth2.grant();

    QTRY_COMPARE(grantedSpy.size(), 1);

    QCOMPARE(oauth2.token(), "an-access-token"_L1);

#endif // !QT_NO_SSL

void tst_OAuth2CodeFlow::extraTokens()

    QOAuth2AuthorizationCodeFlow oauth2;

    oauth2.setAuthorizationUrl(QUrl{"authorizationUrl"_L1});

    oauth2.setTokenUrl(QUrl{"accessTokenUrl"_L1});

    oauth2.setState("a_state"_L1);

    ReplyHandler replyHandler;

    oauth2.setReplyHandler(&replyHandler);

    QSignalSpy extraTokensSpy(&oauth2, &QAbstractOAuth::extraTokensChanged);

    QVERIFY(oauth2.extraTokens().isEmpty());

    constexpr auto name1 = "name1"_L1;

    constexpr auto value1 = "value1"_L1;

    constexpr auto name2 = "name2"_L1;

    constexpr auto value2 = "value2"_L1;

    // Conclude authorization stage without extra tokens

    oauth2.grant();

    replyHandler.emitCallbackReceived({{"code"_L1, "acode"_L1}, {"state"_L1, "a_state"_L1}});

    QCOMPARE(extraTokensSpy.size(), 0);

    // Conclude authorization stage with extra tokens

    extraTokensSpy.clear();

    oauth2.grant();

    replyHandler.emitCallbackReceived({{"code"_L1, "acode"_L1}, {"state"_L1, "a_state"_L1},

                                       {name1, value1}});

    QTRY_COMPARE(extraTokensSpy.size(), 1);

    QVariantMap extraTokens = oauth2.extraTokens();

    QCOMPARE(extraTokens, extraTokensSpy.at(0).at(0).toMap());

    QCOMPARE(extraTokens.size(), 1);

    QCOMPARE(extraTokens.value(name1).toString(), value1);

    // Conclude token stage without additional extra tokens

    extraTokensSpy.clear();

    replyHandler.emitTokensReceived({{"access_token"_L1, "at"_L1}});

    QCOMPARE(extraTokensSpy.size(), 0);

    extraTokens = oauth2.extraTokens();

    QCOMPARE(extraTokens.size(), 1);

    QCOMPARE(extraTokens.value(name1).toString(), value1);

    // Conclude token stage with additional extra tokens

    extraTokensSpy.clear();

    replyHandler.emitTokensReceived({{"access_token"_L1, "at"_L1}, {name2, value2}});

    QTRY_COMPARE(extraTokensSpy.size(), 1);

    extraTokens = oauth2.extraTokens();

    QCOMPARE(extraTokens, extraTokensSpy.at(0).at(0).toMap());

    QCOMPARE(extraTokens.size(), 2);

    QCOMPARE(extraTokens.value(name1).toString(), value1);

    QCOMPARE(extraTokens.value(name2).toString(), value2);

void tst_OAuth2CodeFlow::expirationAt()

    QOAuth2AuthorizationCodeFlow oauth2;

    oauth2.setAuthorizationUrl(QUrl{"authorizationEndpoint"_L1});

    oauth2.setTokenUrl(QUrl{"tokenEndpoint"_L1});

    oauth2.setState("a_state"_L1);

    ReplyHandler replyHandler;

    oauth2.setReplyHandler(&replyHandler);

    QSignalSpy expirationAtSpy(&oauth2, &QAbstractOAuth2::expirationAtChanged);

    const auto expiresAtIsInSecondsFromNow = [&](int fromNow) -> bool {

        // For test robustness check that the time is within +/- 2 seconds

        return qAbs(

            oauth2.expirationAt().secsTo(QDateTime::currentDateTime().addSecs(fromNow))) <= 2;

};

    // Initial value

    QVERIFY(!oauth2.expirationAt().isValid());

    // Conclude authorization stage

    oauth2.grant();

    replyHandler.emitCallbackReceived({{"code"_L1, "acode"_L1}, {"state"_L1, "a_state"_L1}});

    QVERIFY(expirationAtSpy.isEmpty());

    // Test expiration in 50 seconds from now

    int expires_in = 50;

    replyHandler.emitTokensReceived({{"access_token"_L1, "at"_L1}, {"expires_in", expires_in}});

    QCOMPARE(expirationAtSpy.size(), 1);

    QCOMPARE(expirationAtSpy.at(0).at(0).toDateTime(), oauth2.expirationAt());

    QVERIFY(expiresAtIsInSecondsFromNow(expires_in));

    expirationAtSpy.clear();

    // Changes to 100 seconds from now

    expires_in = 100;

    replyHandler.emitTokensReceived({{"access_token"_L1, "at"_L1}, {"expires_in", expires_in}});

    QCOMPARE(expirationAtSpy.size(), 1);

    QCOMPARE(expirationAtSpy.at(0).at(0).toDateTime(), oauth2.expirationAt());

    QVERIFY(expiresAtIsInSecondsFromNow(expires_in));

    expirationAtSpy.clear();

    // Zero expires_in value, expiresAt should become invalid

    expires_in = 0;

    replyHandler.emitTokensReceived({{"access_token"_L1, "at"_L1}, {"expires_in", expires_in}});

    QCOMPARE(expirationAtSpy.size(), 1);

    QCOMPARE(expirationAtSpy.at(0).at(0).toDateTime(), oauth2.expirationAt());

    QVERIFY(!oauth2.expirationAt().isValid());

    expirationAtSpy.clear();

    // Negative expires_in value, expiresAt should remain invalid

    expires_in = -10;

    replyHandler.emitTokensReceived({{"access_token"_L1, "at"_L1}, {"expires_in", expires_in}});

    QCOMPARE(expirationAtSpy.size(), 0);

    QVERIFY(!oauth2.expirationAt().isValid());

    expirationAtSpy.clear();

    // Non-number expires_in value, expiresAt should remain invalid

    replyHandler.emitTokensReceived({{"access_token"_L1, "at"_L1}, {"expires_in", "garbage"}});

    QCOMPARE(expirationAtSpy.size(), 0);

    QVERIFY(!oauth2.expirationAt().isValid());

    expirationAtSpy.clear();

    // Expiration goes back to valid

    expires_in = 70;

    replyHandler.emitTokensReceived({{"access_token"_L1, "at"_L1}, {"expires_in", expires_in}});

    QCOMPARE(expirationAtSpy.size(), 1);

    QCOMPARE(expirationAtSpy.at(0).at(0).toDateTime(), oauth2.expirationAt());

    QVERIFY(expiresAtIsInSecondsFromNow(expires_in));

    expirationAtSpy.clear();

    // Expiration is not provided, expiresAt should become invalid

    replyHandler.emitTokensReceived({{"access_token"_L1, "at"_L1}});

    QCOMPARE(expirationAtSpy.size(), 1);

    QCOMPARE(expirationAtSpy.at(0).at(0).toDateTime(), oauth2.expirationAt());

    QVERIFY(!oauth2.expirationAt().isValid());

    expirationAtSpy.clear();

    // Expiration is still not provided, expiresAt should remain unchanged

    replyHandler.emitTokensReceived({{"access_token"_L1, "at"_L1}});

    QCOMPARE(expirationAtSpy.size(), 0);

    QVERIFY(!oauth2.expirationAt().isValid());

QTEST_MAIN(tst_OAuth2CodeFlow)

#include "tst_oauth2codeflow.moc"

Revision control

Copy as Markdown