tst_oauth2deviceflow.cpp

qt/qtnetworkauth/tests/auto/oauth2deviceflow/tst_oauth2deviceflow.cpp (file symbol)

Enable keyboard shortcuts

Revision control

Copy as Markdown

// Copyright (C) 2024 The Qt Company Ltd.

// SPDX-License-Identifier: LicenseRef-Qt-Commercial OR GPL-3.0-only

#include <QtTest/qtestcase.h>

#include <QtTest>

#include "oauthtestutils.h"

#include "private/qoauth2deviceauthorizationflow_p.h"

#include <QtNetworkAuth/qoauth2deviceauthorizationflow.h>

#ifndef QT_NO_SSL

#include <QtNetwork/qsslkey.h>

#endif

#include <QtCore/qoperatingsystemversion.h>

#include <QtCore/qsystemdetection.h>

#include <QtCore/qcryptographichash.h>

using namespace Qt::StringLiterals;

using namespace std::chrono_literals;

using Error = QAbstractOAuth::Error;

using Status = QAbstractOAuth::Status;

using Stage = QAbstractOAuth::Stage;

class tst_OAuth2DeviceFlow : public QObject

    Q_OBJECT

private Q_SLOTS:

    void initTestCase();

    void getAndRefreshToken();

    void clientError();

    void authorizationErrors();

    void tokenRequestErrors();

    void idToken();

    void nonce();

    void requestedScopeTokens_data();

    void requestedScopeTokens();

    void grantedScopeTokens_data();

    void grantedScopeTokens();

    void refreshLeadTime_data();

    void refreshLeadTime();

    void modifyTokenRequests();

    void userCodeExpiration();

    void startStopTokenPolling();

    void destruction_data();

    void destruction();

    void changeNetworkAccessManager();

#ifndef QT_NO_SSL

    void tlsAuthentication();

#endif

private:

    QString testDataDir;

};

namespace Responses {

    // Basic successful authorization response. Note that interval is 50,

    // which maps to 50ms if DeviceFlow useAutoTestDurations is true, and 50s

    // otherwise.

    static const auto authorizationSuccess = R"(

            "device_code": "a-device-code",

            "user_code": "a-user-code",

            "verification_uri": "a-verification-uri",

            "verification_uri_complete": "a-verification-uri-complete",

            "expires_in": 1800,

            "interval": 50

        })"_ba;

    static const auto tokenSuccess = R"(

            "access_token": "an-access-token",

            "refresh_token": "a-refresh-token",

            "token_type": "bearer",

            "expires_in": 3600

        })"_ba;

    static const auto tokenAuthorizationPending = R"(

            "error": "authorization_pending",

            "error_description": "User hasnt authorized yet",

            "error_uri": "an-error-uri"

        })"_ba;

    static const auto tokenExpired =  R"(

            "error": "expired_token",

            "error_description": "code expired",

            "error_uri": "an-error-uri"

        })"_ba;

    static const auto OK_200 = "200 OK"_ba;

    static const auto BR_400 = "400 Bad Request"_ba;

    static QByteArray authorizationResponseWithTimes(int interval, int expiration) {

        return R"(

            "device_code": "a-device-code",

            "user_code": "a-user-code",

            "verification_uri": "a-verification-uri",

            "verification_uri_complete": "a-verification-uri-complete",

            "interval": )" + QByteArray::number(interval) + "," +

            R"("expires_in": )" + QByteArray::number(expiration) +

        "}";

};

    ServerResponses defaults()

        ServerResponses responses;

        responses.authBody = authorizationSuccess;

        responses.authHttpStatus = OK_200;

        responses.tokenBody = tokenSuccess;

        responses.tokenHttpStatus = OK_200;

        return responses;

};

// This class is used to access flow class's private class, in order to make

// the class use milliseconds instead of seconds for expirations and intervals,

// making these autotest finish in a more pragmatic timeframe

class DeviceFlow : public QOAuth2DeviceAuthorizationFlow

public:

    QOAuth2DeviceAuthorizationFlowPrivate *flowPrivate()

        return static_cast<QOAuth2DeviceAuthorizationFlowPrivate*>(d_ptr.get());

};

static void expectWarning(const QString &warningText)

    const QRegularExpression warning(warningText);

    QTest::ignoreMessage(QtWarningMsg, warning);

};

void tst_OAuth2DeviceFlow::initTestCase()

    // QLoggingCategory::setFilterRules(QStringLiteral("qt.networkauth* = true"));

#ifdef BUILTIN_TESTDATA

    testDataDir = QStringLiteral(":/shared/");

#else

    testDataDir = QFileInfo(QFINDTESTDATA("../shared/certs")).absolutePath();

    if (testDataDir.isEmpty())

        testDataDir = QCoreApplication::applicationDirPath();

    if (!testDataDir.endsWith(QLatin1String("/")))

        testDataDir += QLatin1String("/");

#endif

class RequestModifier : public QObject

    Q_OBJECT

public:

    RequestModifier(QObject *parent = nullptr) : QObject(parent) {}

    void handleRequestModification(QNetworkRequest &request, Stage stage)

        stagesReceivedByModifier.append(stage);

        auto headers = request.headers();

        headers.append("test-header-name"_ba, valueToSet);

        request.setHeaders(headers);

    QList<Stage> stagesReceivedByModifier;

    QByteArray valueToSet;

};

#define TEST_MODIFY_REQUEST_WITH_MODIFIER(STAGES_RECEIVED, VALUE_SET, VALUE_PREFIX) \

do { \

    server->receivedAuthorizationRequests.clear(); \

    server->receivedTokenRequests.clear(); \

    STAGES_RECEIVED.clear(); \

    VALUE_SET = QByteArray(VALUE_PREFIX) + "_authorization_and_access_token"; \

    oauth2.grant(); \

    QTRY_COMPARE(STAGES_RECEIVED.size(), 2); \

    QCOMPARE(STAGES_RECEIVED.at(0), Stage::RequestingAuthorization); \

    QCOMPARE(STAGES_RECEIVED.at(1), Stage::RequestingAccessToken); \

    QTRY_COMPARE(server->receivedAuthorizationRequests.size(), 1); \

    QCOMPARE(server->receivedAuthorizationRequests.at(0).headers.value("test-header-name"_ba), VALUE_SET); \

    QTRY_COMPARE(server->receivedTokenRequests.size(), 1); \

    QCOMPARE(server->receivedTokenRequests.at(0).headers.value("test-header-name"_ba), VALUE_SET); \

    QTRY_COMPARE(oauth2.status(), Status::Granted); \

    /* Refresh token request */ \

    VALUE_SET = QByteArray(VALUE_PREFIX) + "_refresh_token"; \

    server->receivedTokenRequests.clear(); \

    STAGES_RECEIVED.clear(); \

    requestFailedSpy.clear(); \

    oauth2.refreshTokens(); \

    QVERIFY(requestFailedSpy.isEmpty()); \

    QCOMPARE(oauth2.status(), Status::RefreshingToken); \

    QTRY_COMPARE(STAGES_RECEIVED.size(), 1); \

    QCOMPARE(STAGES_RECEIVED.at(0), Stage::RefreshingAccessToken); \

    QTRY_COMPARE(server->receivedTokenRequests.size(), 1); \

    QCOMPARE(server->receivedTokenRequests.at(0).headers.value("test-header-name"_ba), VALUE_SET); \

    QTRY_COMPARE(oauth2.status(), Status::Granted); \

    oauth2.clearNetworkRequestModifier(); \

} while (false) \

#define TEST_MODIFY_REQUEST_WITHOUT_MODIFIER(VALUE_SET) \

do { \

    server->receivedAuthorizationRequests.clear(); \

    server->receivedTokenRequests.clear(); \

    VALUE_SET = "must_not_be_set"_ba; \

    oauth2.grant(); \

    QTRY_COMPARE(oauth2.status(), Status::Granted); \

    QTRY_COMPARE(server->receivedAuthorizationRequests.size(), 1); \

    QVERIFY(server->receivedAuthorizationRequests.at(0).headers.value("test-header-name"_ba).isEmpty()); \

    QTRY_COMPARE(server->receivedTokenRequests.size(), 1); \

    QVERIFY(server->receivedTokenRequests.at(0).headers.value("test-header-name"_ba).isEmpty()); \

    server->receivedTokenRequests.clear(); \

    requestFailedSpy.clear(); \

    oauth2.refreshTokens(); \

    QVERIFY(requestFailedSpy.isEmpty()); \

    QCOMPARE(oauth2.status(), Status::RefreshingToken); \

    QTRY_COMPARE(oauth2.status(), Status::Granted); \

    QTRY_COMPARE(server->receivedTokenRequests.size(), 1); \

    QVERIFY(server->receivedTokenRequests.at(0).headers.value("test-header-name"_ba).isEmpty()); \

    oauth2.clearNetworkRequestModifier(); \

} while (false) \

void tst_OAuth2DeviceFlow::modifyTokenRequests()

    std::unique_ptr<RequestModifier> context(new RequestModifier);

    QRegularExpression nullContextWarning(u".*Context object must not be null, ignoring"_s);

    QRegularExpression wrongThreadWarning(u".*Context object must reside in the same thread"_s);

    auto valueToSet = ""_ba;

    auto server = createAuthorizationServer<WebServer>(Responses::defaults());

    DeviceFlow oauth2;

    oauth2.flowPrivate()->useAutoTestDurations = true;

    oauth2.setAuthorizationUrl(server->authorizationEndpoint());

    oauth2.setTokenUrl(server->tokenEndpoint());

    oauth2.setRefreshToken(u"refresh_token"_s);

    QSignalSpy requestFailedSpy(&oauth2, &QOAuth2DeviceAuthorizationFlow::requestFailed);

    QList<Stage> stagesReceivedByModifier;

    auto modifierLambda = [&](QNetworkRequest &request, Stage stage) {

        stagesReceivedByModifier.append(stage);

        auto headers = request.headers();

        headers.append("test-header-name"_ba, valueToSet);

        request.setHeaders(headers);

};

    std::function<void(QNetworkRequest &, Stage)> modifierFunc = modifierLambda;

    // Lambda with a context object

    oauth2.setNetworkRequestModifier(context.get(), modifierLambda);

    TEST_MODIFY_REQUEST_WITH_MODIFIER(stagesReceivedByModifier,

                                      valueToSet, "lambda_with_context");

    // Test that the modifier will be cleared

    oauth2.clearNetworkRequestModifier();

    TEST_MODIFY_REQUEST_WITHOUT_MODIFIER(valueToSet);

    // Lambda without a context object

    QTest::ignoreMessage(QtWarningMsg, nullContextWarning);

    oauth2.setNetworkRequestModifier(nullptr, modifierLambda);

    TEST_MODIFY_REQUEST_WITHOUT_MODIFIER(valueToSet);

    // std::function with a context object

    oauth2.setNetworkRequestModifier(context.get(), modifierFunc);

    TEST_MODIFY_REQUEST_WITH_MODIFIER(stagesReceivedByModifier, valueToSet, "func_with_context");

    // PMF with context object

    oauth2.setNetworkRequestModifier(context.get(), &RequestModifier::handleRequestModification);

    TEST_MODIFY_REQUEST_WITH_MODIFIER(context->stagesReceivedByModifier,

                                      context->valueToSet, "pmf_with_context");

    // PMF without context object

    QTest::ignoreMessage(QtWarningMsg, nullContextWarning);

    oauth2.setNetworkRequestModifier(nullptr, &RequestModifier::handleRequestModification);

    TEST_MODIFY_REQUEST_WITHOUT_MODIFIER(context->valueToSet);

    // Destroy context object => no callback (or crash)

    oauth2.setNetworkRequestModifier(context.get(), modifierLambda);

    context.reset(nullptr);

    TEST_MODIFY_REQUEST_WITHOUT_MODIFIER(valueToSet);

    // Context object in wrong thread

    QThread thread;

    QObject objectInWrongThread;

    // Initially context object is in correct thread

    oauth2.setNetworkRequestModifier(&objectInWrongThread, modifierLambda);

    // Move to wrong thread, verify we get warnings when it's time to call the callback

    objectInWrongThread.moveToThread(&thread);

    QTest::ignoreMessage(QtWarningMsg, wrongThreadWarning);

    oauth2.grant();

    QTRY_COMPARE(oauth2.status(), Status::Granted);

    // Now the context object is in wrong thread when attempting to set the modifier

    oauth2.clearNetworkRequestModifier();

    QTest::ignoreMessage(QtWarningMsg, wrongThreadWarning);

    oauth2.setNetworkRequestModifier(&objectInWrongThread, modifierLambda);

    TEST_MODIFY_REQUEST_WITHOUT_MODIFIER(valueToSet);

void tst_OAuth2DeviceFlow::userCodeExpiration()

    auto responses = Responses::defaults();

    responses.tokenBody = Responses::tokenAuthorizationPending;

    responses.tokenHttpStatus = Responses::BR_400;

    auto server = createAuthorizationServer<WebServer>(responses);

    QOAuth2DeviceAuthorizationFlow oauth2;

    oauth2.setAuthorizationUrl(server->authorizationEndpoint());

    oauth2.setTokenUrl(server->tokenEndpoint());

    QSignalSpy requestFailedSpy(&oauth2, &QAbstractOAuth::requestFailed);

    QSignalSpy statusSpy(&oauth2, &QAbstractOAuth::statusChanged);

    QSignalSpy grantedSpy(&oauth2, &QAbstractOAuth::granted);

    QSignalSpy codeExpirationSpy(&oauth2,

                                 &QOAuth2DeviceAuthorizationFlow::userCodeExpirationAtChanged);

    const auto clearTestData = [&](){

        server->receivedAuthorizationRequests.clear();

        server->receivedTokenRequests.clear();

        requestFailedSpy.clear();

        codeExpirationSpy.clear();

        statusSpy.clear();

        grantedSpy.clear();

};

    // Initial expiration

    QCOMPARE(oauth2.userCodeExpirationAt(), QDateTime());

    // Code would expire before first poll request

    server->responses.authBody = Responses::authorizationResponseWithTimes(100, 50);

    expectWarning("code expired");

    oauth2.grant();

    QTRY_COMPARE(requestFailedSpy.size(), 1);

    QCOMPARE(requestFailedSpy.at(0).at(0).value<Error>(), Error::ExpiredError);

    QCOMPARE(codeExpirationSpy.size(), 1);

    // The expiration is expressed as seconds from 'now'. To robustly compare the time

    // that device flow class calculates vs. what this test case calculates, verify

    // the expiration with two seconds tolerance

    QVERIFY(

        qAbs(oauth2.userCodeExpirationAt().secsTo(QDateTime::currentDateTime().addSecs(50))) <= 2);

    QCOMPARE(codeExpirationSpy.at(0).at(0).toDateTime(), oauth2.userCodeExpirationAt());

    QCOMPARE(server->receivedAuthorizationRequests.size(), 1);

    QCOMPARE(server->receivedTokenRequests.size(), 0);

    QCOMPARE(oauth2.status(), Status::NotAuthenticated);

    // Code expires while polling

    clearTestData();

    server->responses.authBody = Responses::authorizationResponseWithTimes(1, 4);

    expectWarning("code expired");

    oauth2.grant();

    QTRY_COMPARE(requestFailedSpy.size(), 1);

    QCOMPARE(requestFailedSpy.at(0).at(0).value<Error>(), Error::ExpiredError);

    QCOMPARE(codeExpirationSpy.size(), 2);

    QCOMPARE(codeExpirationSpy.at(0).at(0).toDateTime(), QDateTime()); // grant() resets properties

    QCOMPARE(codeExpirationSpy.at(1).at(0).toDateTime(), oauth2.userCodeExpirationAt());

    QCOMPARE(server->receivedAuthorizationRequests.size(), 1);

    QVERIFY(server->receivedTokenRequests.size() > 1); // first at 1s, then at 2s, ...

    QCOMPARE(oauth2.status(), Status::TemporaryCredentialsReceived);

    // Code expiration is indicated by authorization server's token response

    clearTestData();

    server->responses.tokenBody = Responses::tokenExpired;

    expectWarning("code expired");

    oauth2.grant();

    QTRY_COMPARE(requestFailedSpy.size(), 1);

    QCOMPARE(requestFailedSpy.at(0).at(0).value<Error>(), Error::ExpiredError);

void tst_OAuth2DeviceFlow::startStopTokenPolling()

    auto responses = Responses::defaults();

    responses.tokenHttpStatus = Responses::BR_400;

    responses.tokenBody = Responses::tokenAuthorizationPending;

    auto server = createAuthorizationServer<WebServer>(responses);

    DeviceFlow oauth2;

    oauth2.setAuthorizationUrl(server->authorizationEndpoint());

    oauth2.setTokenUrl(server->tokenEndpoint());

    oauth2.flowPrivate()->useAutoTestDurations = true;

    QSignalSpy pollingSpy(&oauth2, &QOAuth2DeviceAuthorizationFlow::pollingChanged);

    QSignalSpy requestFailedSpy(&oauth2, &QAbstractOAuth::requestFailed);

    auto clearTestVariables = [&](){

        pollingSpy.clear();

        requestFailedSpy.clear();

        server->receivedAuthorizationRequests.clear();

        server->receivedTokenRequests.clear();

};

    // Initial state

    QVERIFY(!oauth2.isPolling());

    oauth2.stopTokenPolling(); // Mustn't cause harm

    // Flow doesn't yet have device code

    expectWarning(u"missing device code for polling"_s);

    QVERIFY(!oauth2.startTokenPolling());

    QVERIFY(!oauth2.isPolling());

    QVERIFY(pollingSpy.isEmpty());

    QCOMPARE(requestFailedSpy.size(), 1);

    // Successful start of flow, enters polling automatically

    clearTestVariables();

    oauth2.grant();

    QTRY_COMPARE(pollingSpy.size(), 1);

    QVERIFY(pollingSpy.at(0).at(0).toBool());

    QCOMPARE(server->receivedAuthorizationRequests.size(), 1);

    QVERIFY(oauth2.isPolling());

    QCOMPARE(oauth2.status(), Status::TemporaryCredentialsReceived);

    QVERIFY(requestFailedSpy.isEmpty());

    // Stop polling

    clearTestVariables();

    oauth2.stopTokenPolling();

    QTRY_COMPARE(pollingSpy.size(), 1);

    QVERIFY(!pollingSpy.at(0).at(0).toBool());

    QVERIFY(!oauth2.isPolling());

    QCOMPARE(oauth2.status(), Status::TemporaryCredentialsReceived);

    QVERIFY(requestFailedSpy.isEmpty());

    // Resume polling manually

    clearTestVariables();

    QVERIFY(oauth2.startTokenPolling());

    QTRY_COMPARE(pollingSpy.size(), 1);

    QVERIFY(pollingSpy.at(0).at(0).toBool());

    QTRY_COMPARE(server->receivedTokenRequests.size(), 1);

    QCOMPARE(server->receivedAuthorizationRequests.size(), 0);

    QVERIFY(oauth2.isPolling());

    QCOMPARE(oauth2.status(), Status::TemporaryCredentialsReceived);

    QVERIFY(requestFailedSpy.isEmpty());

    // Polling already active, no impact

    QVERIFY(oauth2.startTokenPolling());

    QVERIFY(oauth2.isPolling());

    QTRY_COMPARE(server->receivedTokenRequests.size(), 2);

    QVERIFY(requestFailedSpy.isEmpty());

    // Empty token endpoint URL during polling

    clearTestVariables();

    QVERIFY(oauth2.isPolling());

    oauth2.setTokenUrl(QUrl());

    expectWarning("token URL is empty");

    QTRY_COMPARE(requestFailedSpy.size(), 1);

    QCOMPARE(requestFailedSpy.at(0).at(0).value<Error>(), Error::ClientError);

    QVERIFY(!oauth2.isPolling());

    QCOMPARE(oauth2.status(), Status::TemporaryCredentialsReceived);

    // Attempt to start polling with empty token URL

    clearTestVariables();

    expectWarning("token URL is empty");

    QVERIFY(!oauth2.startTokenPolling());

    QTRY_COMPARE(requestFailedSpy.size(), 1);

    QCOMPARE(requestFailedSpy.at(0).at(0).value<Error>(), Error::ClientError);

    QVERIFY(!oauth2.isPolling());

    QCOMPARE(oauth2.status(), Status::TemporaryCredentialsReceived);

void tst_OAuth2DeviceFlow::getAndRefreshToken()

    static constexpr auto clientId = "a-client-id"_L1;

    static constexpr auto scope = "a-scope";

    static constexpr auto accessToken = "an-access-token"_L1;

    static constexpr auto clientSecret = "a-client-secret"_L1;

    static constexpr auto deviceCode = "a-device-code"_L1;

    static constexpr auto userCode = "a-user-code"_L1;

    static constexpr auto refreshToken = "a-refresh-token"_L1;

    static constexpr auto refreshToken2 = "a-refresh-token-2"_L1;

    static constexpr auto verificationUrl = "a-verification-uri"_L1;

    static constexpr auto completeVerificationUrl = "a-verification-uri-complete"_L1;

    auto server = createAuthorizationServer<WebServer>(Responses::defaults());

    DeviceFlow oauth2;

    oauth2.flowPrivate()->useAutoTestDurations = true;

    oauth2.setClientIdentifier(clientId);

    oauth2.setClientIdentifierSharedKey(clientSecret);

    oauth2.setRequestedScopeTokens({scope});

    QSignalSpy grantedSpy(&oauth2, &QOAuth2DeviceAuthorizationFlow::granted);

    QSignalSpy statusSpy(&oauth2, &QAbstractOAuth::statusChanged);

    QSignalSpy userCodeSpy(&oauth2, &QOAuth2DeviceAuthorizationFlow::userCodeChanged);

    QSignalSpy verificationUrlSpy(&oauth2, &QOAuth2DeviceAuthorizationFlow::verificationUrlChanged);

    QSignalSpy completeVerificationUrlSpy(

        &oauth2, &QOAuth2DeviceAuthorizationFlow::completeVerificationUrlChanged);

    QSignalSpy authorizationUrlSpy(&oauth2,

                                   &QOAuth2DeviceAuthorizationFlow::authorizationUrlChanged);

    QSignalSpy tokenSpy(&oauth2, &QOAuth2DeviceAuthorizationFlow::tokenChanged);

    QSignalSpy refreshTokenSpy(&oauth2, &QOAuth2DeviceAuthorizationFlow::refreshTokenChanged);

    QSignalSpy requestFailedSpy(&oauth2, &QOAuth2DeviceAuthorizationFlow::requestFailed);

    // Initial values

    QCOMPARE(oauth2.status(), Status::NotAuthenticated);

    QVERIFY(oauth2.userCode().isEmpty());

    QVERIFY(oauth2.verificationUrl().isEmpty());

    QVERIFY(oauth2.completeVerificationUrl().isEmpty());

    // Set authorization url

    const auto authorizationUrl = server->authorizationEndpoint();

    oauth2.setAuthorizationUrl(authorizationUrl);

    QCOMPARE(oauth2.authorizationUrl(), authorizationUrl);

    QCOMPARE(authorizationUrlSpy.size(), 1);

    QCOMPARE(authorizationUrlSpy.at(0).at(0).toUrl(), authorizationUrl);

    // Get access token (and refresh token)

    const auto tokenUrl = server->tokenEndpoint();

    oauth2.setTokenUrl(tokenUrl);

    oauth2.grant();

    QTRY_COMPARE(grantedSpy.size(), 1);

    QCOMPARE(oauth2.status(), Status::Granted);

    // Verify requests that the authorization server received

    QTRY_COMPARE(server->receivedAuthorizationRequests.size(), 1);

        // Authorization request

        QUrlQuery query(QUrl::fromPercentEncoding(server->receivedAuthorizationRequests.at(0).body));

        QCOMPARE(query.queryItems().size(), 2);

        QCOMPARE(query.queryItemValue("client_id"_L1), clientId);

        QCOMPARE(query.queryItemValue("scope"_L1), scope);

    QTRY_COMPARE(server->receivedTokenRequests.size(), 1);

        // Access token poll request

        QUrlQuery query(QUrl::fromPercentEncoding(server->receivedTokenRequests.at(0).body));

        QCOMPARE(query.queryItems().size(), 4);

        QCOMPARE(query.queryItemValue("grant_type"_L1),

                 "urn:ietf:params:oauth:grant-type:device_code"_L1);

        QCOMPARE(query.queryItemValue("device_code"_L1), deviceCode);

        QCOMPARE(query.queryItemValue("client_id"_L1), clientId);

        QCOMPARE(query.queryItemValue("client_secret"_L1), clientSecret);

    // Verify that appropriate properties changed

    QCOMPARE(statusSpy.size(), 2);

    QCOMPARE(statusSpy.at(0).at(0).value<Status>(), Status::TemporaryCredentialsReceived);

    QCOMPARE(statusSpy.at(1).at(0).value<Status>(), Status::Granted);

    QCOMPARE(oauth2.userCode(), userCode);

    QCOMPARE(userCodeSpy.size(), 1);

    QCOMPARE(userCodeSpy.at(0).at(0).toString(), userCode);

    QCOMPARE(oauth2.verificationUrl(), QUrl(verificationUrl));

    QCOMPARE(verificationUrlSpy.size(), 1);

    QCOMPARE(verificationUrlSpy.at(0).at(0).toUrl(), QUrl(verificationUrl));

    QCOMPARE(oauth2.completeVerificationUrl(), QUrl(completeVerificationUrl));

    QCOMPARE(completeVerificationUrlSpy.size(), 1);

    QCOMPARE(completeVerificationUrlSpy.at(0).at(0).toUrl(), QUrl(completeVerificationUrl));

    QCOMPARE(oauth2.token(), accessToken);

    QCOMPARE(tokenSpy.size(), 1);

    QCOMPARE(tokenSpy.at(0).at(0).toString(), accessToken);

    QCOMPARE(oauth2.refreshToken(), refreshToken);

    QCOMPARE(refreshTokenSpy.size(), 1);

    QCOMPARE(refreshTokenSpy.at(0).at(0).toString(), refreshToken);

    // Manually set the refresh token, and then use it to refresh the access token

    oauth2.setRefreshToken(refreshToken2);

    QCOMPARE(refreshTokenSpy.size(), 2);

    QCOMPARE(refreshTokenSpy.at(1).at(0).toString(), refreshToken2);

    statusSpy.clear();

    server->receivedTokenRequests.clear();

    requestFailedSpy.clear();

    oauth2.refreshTokens();

    QVERIFY(requestFailedSpy.isEmpty());

    QTRY_COMPARE(statusSpy.size(), 2);

    QCOMPARE(server->receivedTokenRequests.size(), 1);

        // Refresh request

        QUrlQuery query(QUrl::fromPercentEncoding(server->receivedTokenRequests.at(0).body));

        QCOMPARE(query.queryItems().size(), 4);

        QCOMPARE(query.queryItemValue("grant_type"_L1), "refresh_token"_L1);

        QCOMPARE(query.queryItemValue("refresh_token"_L1), refreshToken2);

        QCOMPARE(query.queryItemValue("client_id"_L1), clientId);

        QCOMPARE(query.queryItemValue("client_secret"_L1), clientSecret);

    QCOMPARE(statusSpy.at(0).at(0).value<Status>(), Status::RefreshingToken);

    QCOMPARE(statusSpy.at(1).at(0).value<Status>(), Status::Granted);

    QCOMPARE(oauth2.status(), Status::Granted);

    QCOMPARE(grantedSpy.size(), 2);

    // The refresh token is also renewed

    QCOMPARE(oauth2.refreshToken(), refreshToken);

    QCOMPARE(oauth2.token(), accessToken);

void tst_OAuth2DeviceFlow::clientError()

    DeviceFlow oauth2;

    oauth2.flowPrivate()->useAutoTestDurations = true;

    QSignalSpy requestFailedSpy(&oauth2, &QAbstractOAuth::requestFailed);

    // Authorization URL missing with grant()

    expectWarning("No authorization URL");

    oauth2.grant();

    QTRY_COMPARE(requestFailedSpy.size(), 1);

    QCOMPARE(requestFailedSpy.at(0).at(0).value<Error>(), Error::ClientError);

    // Token URL missing with grant()

    requestFailedSpy.clear();

    oauth2.setAuthorizationUrl(QUrl("an-authorization-url"));

    expectWarning("No token URL");

    oauth2.grant();

    QTRY_COMPARE(requestFailedSpy.size(), 1);

    QCOMPARE(requestFailedSpy.at(0).at(0).value<Error>(), Error::ClientError);

    // Refresh token missing for refreshing

    requestFailedSpy.clear();

    expectWarning("empty refresh token");

    oauth2.refreshTokens();

    QTRY_COMPARE(requestFailedSpy.size(), 1);

    QCOMPARE(requestFailedSpy.at(0).at(0).value<Error>(), Error::ClientError);

    // Token URL missing for refreshing

    requestFailedSpy.clear();

    oauth2.setRefreshToken("a-refresh-token"_L1);

    expectWarning("No token URL");

    oauth2.refreshTokens();

    QTRY_COMPARE(requestFailedSpy.size(), 1);

    QCOMPARE(requestFailedSpy.at(0).at(0).value<Error>(), Error::ClientError);

    auto server = createAuthorizationServer<WebServer>(Responses::defaults());

    // Refresh while polling

    requestFailedSpy.clear();

    oauth2.setAuthorizationUrl(server->authorizationEndpoint());

    oauth2.setTokenUrl(server->tokenEndpoint());

    oauth2.grant();

    QTRY_VERIFY(oauth2.isPolling());

    expectWarning("polling in progress");

    oauth2.refreshTokens();

    QCOMPARE(requestFailedSpy.size(), 1);

    QCOMPARE(requestFailedSpy.at(0).at(0).value<Error>(), Error::ClientError);

    // Clear tokenUrl while polling

    requestFailedSpy.clear();

    QVERIFY(oauth2.isPolling());

    expectWarning("token URL is empty");

    oauth2.setTokenUrl({});

    QTRY_COMPARE(requestFailedSpy.size(), 1);

    QCOMPARE(requestFailedSpy.at(0).at(0).value<Error>(), Error::ClientError);

    // Refresh while refreshing, no client error

    requestFailedSpy.clear();

    oauth2.stopTokenPolling();

    oauth2.setTokenUrl(server->tokenEndpoint());

    oauth2.refreshTokens();

    oauth2.refreshTokens();

    oauth2.refreshTokens();

    QVERIFY(requestFailedSpy.isEmpty());

QT_WARNING_PUSH QT_WARNING_DISABLE_DEPRECATED

void tst_OAuth2DeviceFlow::authorizationErrors()

    auto server = createAuthorizationServer<WebServer>(Responses::defaults());

    QOAuth2DeviceAuthorizationFlow oauth2;

    oauth2.setAuthorizationUrl(server->authorizationEndpoint());

    oauth2.setTokenUrl(QUrl("not-needed"_L1));

    QSignalSpy statusSpy(&oauth2, &QAbstractOAuth::statusChanged);

    QSignalSpy requestFailedSpy(&oauth2, &QAbstractOAuth::requestFailed);

#if QT_DEPRECATED_SINCE(6, 13)

    QSignalSpy errorSpy(&oauth2, &QAbstractOAuth2::error);

#endif

    QSignalSpy serverReportedErrorOccurredSpy(&oauth2,

                                              &QAbstractOAuth2::serverReportedErrorOccurred);

    const auto clearSpies = [&](){

        requestFailedSpy.clear();

        serverReportedErrorOccurredSpy.clear();

#if QT_DEPRECATED_SINCE(6, 13)

        errorSpy.clear();

#endif

        statusSpy.clear();

};

    // Error response from the authorization server (RFC 6749 section 5.2)

    server->responses.authBody = R"(

                "error": "an-error",

                "error_description": "an-error-description",

                "error_uri": "an-error-uri"

)";

    server->responses.authHttpStatus = Responses::BR_400;

    oauth2.grant();

    expectWarning("Authorization stage:.*");

#if QT_DEPRECATED_SINCE(6, 13)

    QTRY_COMPARE(errorSpy.size(), 1);

#endif

    QTRY_COMPARE(serverReportedErrorOccurredSpy.size(), 1);

    QTRY_COMPARE(requestFailedSpy.size(), 1);

#if QT_DEPRECATED_SINCE(6, 13)

    QCOMPARE(errorSpy.at(0).at(0).toString(), "an-error"_L1);

    QCOMPARE(errorSpy.at(0).at(1).toString(), "an-error-description"_L1);

    QCOMPARE(errorSpy.at(0).at(2).toString(), "an-error-uri"_L1);

#endif

    QCOMPARE(serverReportedErrorOccurredSpy.at(0).at(0).toString(), "an-error"_L1);

    QCOMPARE(serverReportedErrorOccurredSpy.at(0).at(1).toString(), "an-error-description"_L1);

    QCOMPARE(serverReportedErrorOccurredSpy.at(0).at(2).toString(), "an-error-uri"_L1);

    QCOMPARE(requestFailedSpy.at(0).at(0).value<Error>(), Error::ServerError);

    QVERIFY(statusSpy.isEmpty());

    QCOMPARE(oauth2.status(), Status::NotAuthenticated);

    const auto checkAuthorizationError = [&]()

        clearSpies();

        oauth2.grant();

        expectWarning("Authorization stage:.*");

        QTRY_COMPARE(requestFailedSpy.size(), 1);

        QCOMPARE(requestFailedSpy.at(0).at(0).value<Error>(), Error::OAuthTokenNotFoundError);

        QVERIFY(statusSpy.isEmpty());

        QCOMPARE(oauth2.status(), Status::NotAuthenticated);

        // Other error signals should not have been emitted

#if QT_DEPRECATED_SINCE(6, 13)

        QCOMPARE(errorSpy.size(), 0);

#endif

        QCOMPARE(serverReportedErrorOccurredSpy.size(), 0);

        QVERIFY(statusSpy.isEmpty());

};

    // Missing user code value

    server->responses.authBody = R"(

            "user_code": "",

            "device_code": "a-device-code",

            "verification_uri": "a-verification-uri",

            "expires_in": 1800

        })";

    checkAuthorizationError();

    // Missing user code field

    server->responses.authBody = R"(

            "device_code": "a-device-code",

            "verification_uri": "a-verification-uri",

            "expires_in": 1800

        })";

    checkAuthorizationError();

    // Missing device code value

    server->responses.authBody = R"(

            "user_code": "a-user-code",

            "device_code": "",

            "verification_uri": "a-verification-uri",

            "expires_in": 1800

        })";

    checkAuthorizationError();

    // Missing device code field

    server->responses.authBody = R"(

            "user_code": "a-user-code",

            "verification_uri": "a-verification-uri",

            "expires_in": 1800

        })";

    checkAuthorizationError();

    // Missing expiration value

    server->responses.authBody = R"(

            "user_code": "a-user-code",

            "device_code": "a-device-code",

            "verification_uri": "a-verification-uri",

            "expires_in": 0

        })";

    checkAuthorizationError();

    // Missing expiration field

    server->responses.authBody = R"(

            "user_code": "a-user-code",

            "device_code": "a-device-code",

            "verification_uri": "a-verification-uri"

        })";

    checkAuthorizationError();

    // Missing verification uri value

    server->responses.authBody = R"(

            "user_code": "a-user-code",

            "device_code": "a-device-code",

            "verification_uri": "",

            "expires_in": 1800

        })";

    checkAuthorizationError();

    // Missing verification uri field

    server->responses.authBody = R"(

            "user_code": "a-user-code",

            "device_code": "a-device-code",

            "expires_in": 1800

        })";

    checkAuthorizationError();

QT_WARNING_POP

void tst_OAuth2DeviceFlow::tokenRequestErrors()

    auto server = createAuthorizationServer<WebServer>(Responses::defaults());

    DeviceFlow oauth2;

    oauth2.flowPrivate()->useAutoTestDurations = true;

    oauth2.setAuthorizationUrl(server->authorizationEndpoint());

    oauth2.setTokenUrl(server->tokenEndpoint());

    QSignalSpy requestFailedSpy(&oauth2, &QAbstractOAuth::requestFailed);

    QSignalSpy grantedSpy(&oauth2, &QOAuth2DeviceAuthorizationFlow::granted);

    QSignalSpy statusSpy(&oauth2, &QAbstractOAuth2::statusChanged);

    auto clearTestVariables = [&](){

        requestFailedSpy.clear();

        grantedSpy.clear();

        statusSpy.clear();

        server->receivedAuthorizationRequests.clear();

        server->receivedTokenRequests.clear();

};

    // Invalid access token response

    server->responses.tokenHttpStatus = Responses::OK_200;

    server->responses.tokenBody = "not the expected json response";

    expectWarning("Token request failed");

    oauth2.grant();

    QTRY_COMPARE(requestFailedSpy.size(), 1);

    QCOMPARE(server->receivedAuthorizationRequests.size(), 1);

    QCOMPARE(server->receivedTokenRequests.size(), 1);

    QCOMPARE(requestFailedSpy.at(0).at(0).value<Error>(), Error::ServerError);

    QVERIFY(grantedSpy.isEmpty());

    QCOMPARE(statusSpy.size(), 1);

    QCOMPARE(statusSpy.at(0).at(0).value<Status>(), Status::TemporaryCredentialsReceived);

    QCOMPARE(oauth2.status(), Status::TemporaryCredentialsReceived);

    // Access token error response (RFC 6749 section 5.2)

    server->responses.tokenBody = R"(

                "error": "an-error",

                "error_description": "an-error-description",

                "error_uri": "an-error-uri"

)";

    server->responses.tokenHttpStatus = Responses::BR_400;

    clearTestVariables();

    expectWarning("Token request failed");

    oauth2.grant();

    QTRY_COMPARE(requestFailedSpy.size(), 1);

    QCOMPARE(requestFailedSpy.at(0).at(0).value<Error>(), Error::ServerError);

    QCOMPARE(server->receivedAuthorizationRequests.size(), 1);

    QCOMPARE(server->receivedTokenRequests.size(), 1);

    QVERIFY(grantedSpy.isEmpty());

    QCOMPARE(statusSpy.size(), 2);

    QCOMPARE(statusSpy.at(0).at(0).value<Status>(), Status::NotAuthenticated);

    QCOMPARE(statusSpy.at(1).at(0).value<Status>(), Status::TemporaryCredentialsReceived);

    QCOMPARE(oauth2.status(), Status::TemporaryCredentialsReceived);

    // Missing access token

    server->responses.tokenBody = R"(

            "refresh_token": "a-refresh-token",

            "token_type": "bearer",

            "expires_in": 3600

        })";

    server->responses.tokenHttpStatus = Responses::OK_200;

    clearTestVariables();

    expectWarning("token not received");

    oauth2.grant();

    QTRY_COMPARE(requestFailedSpy.size(), 1);

    QCOMPARE(server->receivedTokenRequests.size(), 1);

    QCOMPARE(requestFailedSpy.at(0).at(0).value<Error>(), Error::OAuthTokenNotFoundError);

    QCOMPARE(grantedSpy.size(), 0);

    QCOMPARE(oauth2.status(), Status::TemporaryCredentialsReceived);

    // authorization_pending

    // https://datatracker.ietf.org/doc/html/rfc8628#section-3.5

    server->responses.tokenBody = Responses::tokenAuthorizationPending;

    server->responses.tokenHttpStatus = Responses::BR_400;

    clearTestVariables();

    oauth2.grant();

    // Verify that retries (polls) are received (more than one token poll)

    QTRY_VERIFY(server->receivedTokenRequests.size() > 1);

    QCOMPARE(requestFailedSpy.size(), 0);

    // Change to OK response and verify token is handled successfully

    server->responses.tokenHttpStatus = Responses::OK_200;

    server->responses.tokenBody = Responses::tokenSuccess;

    QTRY_COMPARE(oauth2.status(), Status::Granted);

    // slow_down

    // https://datatracker.ietf.org/doc/html/rfc8628#section-3.5

    server->responses.tokenBody = R"(

                "error": "slow_down",

                "error_description": "You're polling too fast"

)";

    server->responses.tokenHttpStatus = Responses::BR_400;

    clearTestVariables();

    oauth2.grant();

    // Verify that retries (polls) are received (more than one token poll)

    QTRY_VERIFY(server->receivedTokenRequests.size() > 1);

    QCOMPARE(requestFailedSpy.size(), 0);

    // Change to OK response and verify token is handled successfully

    server->responses.tokenHttpStatus = Responses::OK_200;

    server->responses.tokenBody = Responses::tokenSuccess;

    QTRY_COMPARE(oauth2.status(), Status::Granted);

    // Failed access token refresh (missing access token)

    server->responses.tokenBody = R"(

            "token_type": "bearer",

            "expires_in": 3600

        })";

    server->responses.tokenHttpStatus = Responses::OK_200;

    clearTestVariables();

    expectWarning("token not received");

    oauth2.refreshTokens();

    QCOMPARE(oauth2.status(), QAbstractOAuth2::Status::RefreshingToken);

    QTRY_COMPARE(requestFailedSpy.size(), 1);

    QCOMPARE(server->receivedTokenRequests.size(), 1);

    QCOMPARE(requestFailedSpy.at(0).at(0).value<Error>(), Error::OAuthTokenNotFoundError);

    QCOMPARE(oauth2.status(), Status::Granted); // Because we still have valid access token

    // Network error

    clearTestVariables();

    server->server->close();

    expectWarning("network error");

    oauth2.grant();

    QTRY_COMPARE(requestFailedSpy.size(), 1);

    QCOMPARE(requestFailedSpy.at(0).at(0).value<Error>(), Error::NetworkError);

    QCOMPARE(grantedSpy.size(), 0);

    QCOMPARE(oauth2.status(), Status::NotAuthenticated);

void tst_OAuth2DeviceFlow::nonce()

    const auto nonce = "a_nonce"_ba;

    auto server = createAuthorizationServer<WebServer>(Responses::defaults());

    QOAuth2DeviceAuthorizationFlow oauth2;

    oauth2.setRequestedScopeTokens({"openid"});

    oauth2.setAuthorizationUrl(server->authorizationEndpoint());

    oauth2.setTokenUrl(server->tokenEndpoint());

    // Verify that nonce is set to authorization request when appropriate

    oauth2.setNonce(nonce);

    oauth2.setRequestedScopeTokens({"scope_item1"});

    // -- Nonce is always included

    oauth2.setNonceMode(QAbstractOAuth2::NonceMode::Enabled);

    oauth2.grant();

    QTRY_COMPARE(server->receivedAuthorizationRequests.size(), 1);

    QUrlQuery parameters;

    parameters.setQuery(server->receivedAuthorizationRequests.at(0).body);

    QCOMPARE(parameters.queryItemValue(u"nonce"_s).toUtf8(), nonce);

    // -- Nonce is never included

    oauth2.setNonceMode(QAbstractOAuth2::NonceMode::Disabled);

    server->receivedAuthorizationRequests.clear();

    oauth2.grant();

    QTRY_COMPARE(server->receivedAuthorizationRequests.size(), 1);

    parameters.setQuery(server->receivedAuthorizationRequests.at(0).body);

    QVERIFY(parameters.queryItemValue(u"nonce"_s).toUtf8().isEmpty());

    // -- Nonce is included if scope contains 'openid'

    oauth2.setNonceMode(QAbstractOAuth2::NonceMode::Automatic);

    server->receivedAuthorizationRequests.clear();

    oauth2.grant();

    QTRY_COMPARE(server->receivedAuthorizationRequests.size(), 1);

    parameters.setQuery(server->receivedAuthorizationRequests.at(0).body);

    QVERIFY(parameters.queryItemValue(u"nonce"_s).toUtf8().isEmpty());

    oauth2.setRequestedScopeTokens({"scope_item1", "openid"});

    server->receivedAuthorizationRequests.clear();

    oauth2.grant();

    QTRY_COMPARE(server->receivedAuthorizationRequests.size(), 1);

    parameters.setQuery(server->receivedAuthorizationRequests.at(0).body);

    QCOMPARE(parameters.queryItemValue(u"nonce"_s).toUtf8(), nonce);

    // -- Clear nonce, one should be generated

    oauth2.setNonce("");

    QVERIFY(oauth2.nonce().isEmpty());

    server->receivedAuthorizationRequests.clear();

    oauth2.grant();

    QTRY_COMPARE(server->receivedAuthorizationRequests.size(), 1);

    QVERIFY(!oauth2.nonce().isEmpty());

    parameters.setQuery(server->receivedAuthorizationRequests.at(0).body);

    QCOMPARE(parameters.queryItemValue(u"nonce"_s).toUtf8(), oauth2.nonce());

void tst_OAuth2DeviceFlow::idToken()

    auto server = createAuthorizationServer<WebServer>(Responses::defaults());

    DeviceFlow oauth2;

    oauth2.flowPrivate()->useAutoTestDurations = true;

    oauth2.setRequestedScopeTokens({"openid"});

    oauth2.setAuthorizationUrl(server->authorizationEndpoint());

    oauth2.setTokenUrl(server->tokenEndpoint());

    QSignalSpy idTokenSpy(&oauth2, &QAbstractOAuth2::idTokenChanged);

    QSignalSpy requestFailedSpy(&oauth2, &QAbstractOAuth::requestFailed);

    // Verify default token is empty

    QVERIFY(oauth2.idToken().isEmpty());

    // Test without openid and verify idToken doesn't change

    oauth2.setRequestedScopeTokens({"read"});

    oauth2.grant();

    QTRY_COMPARE(oauth2.status(), Status::Granted);

    QVERIFY(idTokenSpy.isEmpty());

    QVERIFY(oauth2.idToken().isEmpty());

    // Test with openid

    // Note: using a proper JWT or setting the matching 'nonce' is not required for this tests

    // purpose as we don't currently validate the received token, but no harm in being thorough

    auto idToken = createSignedJWT({}, {{"nonce"_L1, oauth2.nonce()}});

    oauth2.setRequestedScopeTokens({"openid"});

    server->responses.tokenBody = R"(

            "access_token": "an-access-token",

            "refresh_token": "a-refresh-token",

            "token_type": "bearer",

            "expires_in": 3600,

            "id_token": ")" + idToken.toLatin1() +

        "\"}";

    oauth2.grant();

    QTRY_COMPARE(oauth2.status(), Status::Granted);

    QCOMPARE(oauth2.idToken(), idToken);

    QCOMPARE(idTokenSpy.size(), 1);

    QCOMPARE(idTokenSpy.at(0).at(0).toByteArray(), idToken);

    // Test missing id_token error

    QVERIFY(requestFailedSpy.isEmpty());

    expectWarning("ID token not received");

    server->responses.tokenBody = Responses::tokenSuccess;

    oauth2.grant();

    QTRY_COMPARE(requestFailedSpy.size(), 1);

    QCOMPARE(requestFailedSpy.at(0).at(0).value<Error>(), Error::OAuthTokenNotFoundError);

    QCOMPARE(oauth2.status(), Status::TemporaryCredentialsReceived);

    // idToken is cleared on failure

    QCOMPARE(idTokenSpy.size(), 2);

    QVERIFY(oauth2.idToken().isEmpty());

void tst_OAuth2DeviceFlow::requestedScopeTokens_data()

    const QByteArray f = "first";

    const QByteArray s = "second";

    QTest::addColumn<QSet<QByteArray>>("requested_scope");

    QTest::addColumn<QSet<QByteArray>>("expected_requested_scope");

    QTest::addRow("singlescope") << QSet{f} << QSet{f};

    QTest::addRow("multiscope")  << QSet{f, s} << QSet{f, s};

void tst_OAuth2DeviceFlow::requestedScopeTokens()

    QFETCH(QSet<QByteArray>, requested_scope);

    QFETCH(QSet<QByteArray>, expected_requested_scope);

    auto server = createAuthorizationServer<WebServer>(Responses::defaults());

    QOAuth2DeviceAuthorizationFlow oauth2;

    oauth2.setAuthorizationUrl(server->authorizationEndpoint());

    oauth2.setTokenUrl(server->tokenEndpoint());

    QVERIFY(oauth2.requestedScopeTokens().isEmpty());

    QSignalSpy requestedScopeTokensSpy(&oauth2, &QAbstractOAuth2::requestedScopeTokensChanged);

    oauth2.setRequestedScopeTokens(requested_scope);

    QCOMPARE(requestedScopeTokensSpy.size(), 1);

    QCOMPARE(oauth2.requestedScopeTokens(), expected_requested_scope);

    QCOMPARE(requestedScopeTokensSpy.at(0).at(0).value<QSet<QByteArray>>(),

             expected_requested_scope);

    oauth2.grant();

    QTRY_COMPARE(server->receivedAuthorizationRequests.size(), 1);

    QUrlQuery parameters(server->receivedAuthorizationRequests.at(0).body);

    const auto scopeTokens = parameters.queryItemValue(u"scope"_s).toLatin1().split(' ');

    QCOMPARE_EQ(scopeTokens.size(), requested_scope.size());

    for (const auto &token : scopeTokens)

        QVERIFY2(requested_scope.contains(token), token.data());

void tst_OAuth2DeviceFlow::grantedScopeTokens_data()

    const QSet<QByteArray> requestedScopeTokens = {"first", "second"};

    const QByteArray scope = "first second";

    const QByteArray granted1 = "granted1";

    const QByteArray granted2 = "granted2";

    const QByteArray grantedJoined = granted1 + " " + granted2;

    const QSet<QByteArray> grantedList = {granted1, granted2};

    QTest::addColumn<QSet<QByteArray>>("requested_scope");

    QTest::addColumn<QByteArray>("granted_scope");

    QTest::addColumn<QSet<QByteArray>>("expected_granted_scope");

    QTest::addRow("requested_scope_returned")

        << requestedScopeTokens << scope << requestedScopeTokens;

    QTest::addRow("differing_singlescope_returned")

        << requestedScopeTokens << granted1 << QSet<QByteArray>{granted1};

    QTest::addRow("differing_multiscope_returned")

        << requestedScopeTokens << grantedJoined << grantedList;

    QTest::addRow("empty_scope_returned")

        << requestedScopeTokens << ""_ba << requestedScopeTokens;

void tst_OAuth2DeviceFlow::grantedScopeTokens()

    QFETCH(QSet<QByteArray>, requested_scope);

    QFETCH(QByteArray, granted_scope);

    QFETCH(QSet<QByteArray>, expected_granted_scope);

    auto server = createAuthorizationServer<WebServer>(Responses::defaults());

    DeviceFlow oauth2;

    oauth2.flowPrivate()->useAutoTestDurations = true;

    oauth2.setAuthorizationUrl(server->authorizationEndpoint());

    oauth2.setTokenUrl(server->tokenEndpoint());

    QSignalSpy grantedSpy(&oauth2, &QAbstractOAuth2::grantedScopeTokensChanged);

    oauth2.setRequestedScopeTokens(requested_scope);

    if (!granted_scope.isEmpty()) {

        server->responses.tokenBody =  R"(

            "access_token": "an-access-token",

            "refresh_token": "a-refresh-token",

            "token_type": "bearer",

            "expires_in": 3600,

            "scope": ")" + granted_scope +

        "\"}";

    oauth2.grant();

    QTRY_COMPARE(grantedSpy.size(), 1);

    QCOMPARE(oauth2.grantedScopeTokens(), expected_granted_scope);

    QCOMPARE(grantedSpy.at(0).at(0).value<QSet<QByteArray>>(), expected_granted_scope);

void tst_OAuth2DeviceFlow::refreshLeadTime_data()

    QTest::addColumn<std::chrono::seconds>("refreshLeadTime");

    QTest::addColumn<int>("expiresIn");

    QTest::addColumn<std::chrono::seconds>("waitTimeForExpiration");

    QTest::addColumn<bool>("autoRefresh");

    QTest::addColumn<bool>("expectExpirationSignal");

    QTest::addColumn<QString>("refreshToken");

    QTest::addColumn<bool>("expectRefreshRequest");

    const QString refreshToken = u"refreshToken"_s;

    // wait-time: 20s - 18s = 2s, + 1s for robustness => 3s

    QTest::addRow("validSetExpiration")

        << 18s << 20 << 3s << true  << true  << refreshToken << true;

    // wait-time calculation: 15s - 10s = 5s, + 1s for robustness => 6s

    QTest::addRow("validCalculatedExpiration")

        << 0s  << 15 << 6s << true  << true  << refreshToken << true;

    // wait-time: 5s - 10s = -5s => 2s minimum + 1s for robustness => 3s

    QTest::addRow("tooShortCalculatedExpiration")

        << 0s  << 5 << 3s  << true  << true  << refreshToken << true;

    // wait-time: 5s - 10s = -5s => 2s minimum + 1s for robustness => 3s

    QTest::addRow("tooShortSetExpiration")

        << 10s  << 5 << 3s << true  << true  << refreshToken << true;

    // wait-time: 3s - 1s = 2s, +1s for robustness => 3s

    QTest::addRow("leadTimeNearExpiration")

        << 1s  << 3 << 3s  << true  << true << refreshToken << true;

    QTest::addRow("invalidExpirationTime")

        << 1s  << 0 << 3s  << true  << false << refreshToken << false;

    // wait-time: 2s - 1s = 1s, => minimum 2s + 1s for robustness => 2s

    QTest::addRow("autoRefreshDisabled")

        << 1s  << 2 << 3s  << false << true  << refreshToken << false;

    QTest::addRow("emptyRefreshToken")

        << 18s << 20 << 3s << true  << true << QString() << false;

void tst_OAuth2DeviceFlow::refreshLeadTime()

    QFETCH(std::chrono::seconds, refreshLeadTime);

    QFETCH(int, expiresIn);

    QFETCH(std::chrono::seconds, waitTimeForExpiration);

    QFETCH(bool, autoRefresh);

    QFETCH(bool, expectExpirationSignal);

    QFETCH(QString, refreshToken);

    QFETCH(bool, expectRefreshRequest);

    auto server = createAuthorizationServer<WebServer>(Responses::defaults());

    DeviceFlow oauth2;

    oauth2.flowPrivate()->useAutoTestDurations = true;

    oauth2.setAuthorizationUrl(server->authorizationEndpoint());

    oauth2.setTokenUrl(server->tokenEndpoint());

    oauth2.setRefreshLeadTime(refreshLeadTime);

    oauth2.setAutoRefresh(autoRefresh);

    QSignalSpy expiredSpy(&oauth2, &QAbstractOAuth2::accessTokenAboutToExpire);

    QSignalSpy grantedSpy(&oauth2, &QAbstractOAuth2::grantedScopeTokensChanged);

    server->responses.tokenBody = R"(

        "access_token": "initial-access-token",

        "token_type": "bearer",

        "expires_in": ")" + QByteArray::number(expiresIn) + R"(",

        "scope": "s",

        "refresh_token": ")" + refreshToken.toLatin1() +

    "\"}";

    oauth2.grant();

    QTRY_COMPARE(grantedSpy.size(), 1);

    QCOMPARE(oauth2.token(), u"initial-access-token"_s);

    // Clear initial token request

    server->receivedTokenRequests.clear();

    if (expectExpirationSignal) {

        server->responses.tokenBody = R"(

                "access_token": "refreshed-access-token",

                "token_type": "bearer",

                "expires_in": 3600,

                "scope": "s",

                "refresh_token": "a-refresh-token"

            })";

        QTRY_COMPARE_WITH_TIMEOUT(expiredSpy.size(), 1, waitTimeForExpiration);

        if (expectRefreshRequest) {

            QTRY_COMPARE(oauth2.token(), "refreshed-access-token"_L1);

            QCOMPARE(server->receivedTokenRequests.size(), 1);

            QCOMPARE(expiredSpy.size(), 1);

        } else {

            // Refresh request isn't expected. To be sure that it isn't sent, allow a bit time

            // for the network stack to process before testing that it indeed wasn't sent

            QTest::qWait(100);

            QCOMPARE(server->receivedTokenRequests.size(), 0);

void tst_OAuth2DeviceFlow::destruction_data()

    QTest::addColumn<QNetworkAccessManager *>("qnam");

    QTest::addRow("no qnam supplied") << static_cast<QNetworkAccessManager*>(nullptr);

    QTest::addRow("default qnam") << new QNetworkAccessManager;

    auto qnamWithAutoDelete = new QNetworkAccessManager;

    qnamWithAutoDelete->setAutoDeleteReplies(true);

    QTest::addRow("autodeleting qnam") << qnamWithAutoDelete;

void tst_OAuth2DeviceFlow::destruction()

    // Test destroying the device flow class in different stages of the flow

    // and verify that things destruct cleanly

    QFETCH(QNetworkAccessManager *, qnam);

    std::unique_ptr<QNetworkAccessManager> accessManager(qnam);

    auto responses = Responses::defaults();

    responses.authBody = Responses::authorizationResponseWithTimes(1, 5);

    responses.tokenBody = Responses::tokenAuthorizationPending;

    auto server = createAuthorizationServer<WebServer>(responses);

    const auto newFlow = [&]() -> QOAuth2DeviceAuthorizationFlow * {

        QOAuth2DeviceAuthorizationFlow *flow =

            new QOAuth2DeviceAuthorizationFlow(accessManager.get());

        flow->setAuthorizationUrl(server->authorizationEndpoint());

        flow->setTokenUrl(server->tokenEndpoint());

        return flow;

};

    std::unique_ptr<QOAuth2DeviceAuthorizationFlow> oauth2;

    oauth2.reset(newFlow());

    // Delete right after creation

    oauth2.reset(nullptr);

    // Delete while authorization request is out

    oauth2.reset(newFlow());

    oauth2->grant();

    oauth2.reset(nullptr);

    // Delete while polling

    oauth2.reset(newFlow());

    oauth2->grant();

    QTRY_VERIFY(server->receivedTokenRequests.size() >= 1);

    oauth2.reset(nullptr);

void tst_OAuth2DeviceFlow::changeNetworkAccessManager()

    auto responses = Responses::defaults();

    responses.authBody = Responses::authorizationResponseWithTimes(100, 1000);

    auto server = createAuthorizationServer<WebServer>(Responses::defaults());

    QNetworkAccessManager *qnam0 = nullptr;

    QNetworkAccessManager qnam1;

    QNetworkAccessManager qnam2;

    DeviceFlow oauth2;

    oauth2.flowPrivate()->useAutoTestDurations = true;

    oauth2.setAuthorizationUrl(server->authorizationEndpoint());

    oauth2.setTokenUrl(server->tokenEndpoint());

    bool stopPollingAfterAuthorization = true;

    connect(&oauth2, &QAbstractOAuth::statusChanged, this, [&](Status status) {

        if (status == Status::TemporaryCredentialsReceived && stopPollingAfterAuthorization)

            oauth2.stopTokenPolling();

});

    // Change QNAM between authorization and polling

    stopPollingAfterAuthorization = true;

    oauth2.setNetworkAccessManager(&qnam1);

    oauth2.grant();

    QTRY_COMPARE(oauth2.status(), Status::TemporaryCredentialsReceived);

    oauth2.setNetworkAccessManager(&qnam2);

    oauth2.startTokenPolling();

    QTRY_COMPARE(oauth2.status(), Status::Granted);

    // Set QNAM to nullptr, which should trigger creation of a new (internal) one

    oauth2.setNetworkAccessManager(qnam0);

    stopPollingAfterAuthorization = false;

    oauth2.grant();

    QTRY_COMPARE(oauth2.status(), Status::Granted);

    // Change QNAM right after sending authorization request. The authorization

    // works because the first QNAM isn't an internal one (which would get deleted)

    oauth2.setNetworkAccessManager(&qnam1);

    oauth2.grant();

    oauth2.setNetworkAccessManager(&qnam2);

    QTRY_COMPARE(oauth2.status(), Status::Granted);

    // Change QNAM right after sending authorization request. This time authorization

    // won't work because the internally created QNAM will get deleted. This is a

    // corner case, but must not crash etc.

    oauth2.setNetworkAccessManager(nullptr);

    oauth2.grant();

    oauth2.setNetworkAccessManager(&qnam2);

    QTest::qWait(200ms);

    QCOMPARE(oauth2.status(), Status::NotAuthenticated);

    // restart with the new QNAM

    oauth2.grant();

    QTRY_COMPARE(oauth2.status(), Status::Granted);

#ifndef QT_NO_SSL

void tst_OAuth2DeviceFlow::tlsAuthentication()

    if (!QSslSocket::supportsSsl())

        QSKIP("This test will fail because the backend does not support TLS");

#ifdef Q_OS_MACOS

#if !QT_APPLE_SDK_EQUAL_OR_ABOVE(MACOS(15), IOS(18))

    if (QOperatingSystemVersion::current() >= QOperatingSystemVersion::MacOSSequoia

        && QSslSocket::activeBackend() == QLatin1String("securetransport")) {

        // Built with SDK < 15, with file-based keychains that no longer work on macOS >= 15.

        QSKIP("SecureTransport will block the test server while accessing the login keychain");

#endif

#endif // Q_OS_MACOS

    auto rollback = useTemporaryKeychain();

    // erros may vary, depending on backend

    const QSet<QSslError::SslError> expectedErrors{ QSslError::SelfSignedCertificate,

                                                    QSslError::CertificateUntrusted,

                                                    QSslError::HostNameMismatch };

    auto serverConfig = createSslConfiguration(testDataDir + "certs/selfsigned-server.key",

                                               testDataDir + "certs/selfsigned-server.crt");

    auto responses = Responses::defaults();

    // SSL establishment can take awhile, use one full second for poll interval

    responses.authBody = Responses::authorizationResponseWithTimes(1, 10);

    auto server = createAuthorizationServer<TlsWebServer>(responses, serverConfig);

    server->server->setExpectedSslErrors(expectedErrors);

    auto clientConfig = createSslConfiguration(testDataDir + "certs/selfsigned-client.key",

                                               testDataDir + "certs/selfsigned-client.crt");

    QNetworkAccessManager qnam;

    QOAuth2DeviceAuthorizationFlow oauth2;

    oauth2.setNetworkAccessManager(&qnam);

    oauth2.setSslConfiguration(clientConfig);

    oauth2.setAuthorizationUrl(server->authorizationEndpoint());

    oauth2.setTokenUrl(server->tokenEndpoint());

    connect(&qnam, &QNetworkAccessManager::sslErrors, this,

        [&expectedErrors](QNetworkReply *r, const QList<QSslError> &errors) {

            // On some Windows machines the test might report all

            // three expected errors.

            QCOMPARE_GE(errors.size(), 2);

            QCOMPARE_LE(errors.size(), 3);

            for (const auto &err : errors)

                QVERIFY(expectedErrors.contains(err.error()));

            r->ignoreSslErrors();

});

    QSignalSpy grantedSpy(&oauth2, &QOAuth2DeviceAuthorizationFlow::granted);

    oauth2.grant();

    QTRY_COMPARE(grantedSpy.size(), 1);

    QCOMPARE(oauth2.token(), "an-access-token"_L1);

#endif // !QT_NO_SSL

QTEST_MAIN(tst_OAuth2DeviceFlow)

#include "tst_oauth2deviceflow.moc"