TestCallbackEdges runs 30 rows through the real callback handler. All
but two start from the real login handler, which draws the state, the
nonce and the PKCE challenge and sets the 15-minute deadline; no-saved-
state arrives with no session at all, and no-verifier's session is
written by hand. A test token endpoint checks the grant type, the code
and the S256 of the verifier against that challenge, and signs the ID
token with the nonce the login sent. Fake identity and organization
queriers answer the six calls the callback makes and list each call with
its parameters in order. The closed test database stands in for the one
row whose provisioning fails, so the package's tests still need no
server.
Each row's golden holds the status, Location and failure page or body,
the log records in order, the querier calls, whether the response set a
new session token, kept the login's or set none, and the session read
back through the manager (every key the sign-in writes, the return-to,
the four flow keys as present or absent, and the deadline). Logs go on
the request's context, so a line written to another logger is missing
from the golden. The replay row also holds the second answer.
Defects and gaps pinned as they are today:
- the old fixture never set the sign-in deadline, and nothing pinned
that a completed callback clears the flow keys; the rows pin both, and
a replay of a completed callback restarts the sign-in at /login;
- two organizations with two workspaces bind the first of each by
position;
- the state and the nonce are compared with !=;
- an email_verified claim sent as a string refuses the sign-in.
No production file changes and no existing test changes. Three rows
(state-mismatch and the two provider-error rows) restate existing tests
on the rig and add the log and session facts.
Shown to change no output: only a new test file and its goldens are
added; the goldens are identical over 20 runs; the tests of
internal/auth, internal/provisioning and internal/server pass.
36 breaks, each edited once in internal/auth/auth.go and caught by the
new test (run on an export of the tree with the new files). The old
side has no counterpart: every break is a new-side record, since the
old tests do not name these rows. None dropped.
Not probed:
- deleting the SetDeadline line: scs's RenewToken sets the same
deadline, so the change is equivalent; the rows pin the full lifetime
itself;
- the error half of the organization and workspace guards: neither sqlc
nor the fakes return rows together with an error, so dropping it
changes no row;
- a first sign-in that succeeds: provisioning needs a database;
- RenewToken failing in a real store: only the wrapper fails it;
- given_name or family_name of another JSON type, which also refuses
the sign-in: pinned for email_verified only;
- each log line's attributes and the session's name and username keys,
beyond the probed ones: the golden holds them all;
- the failure page's texts: the rows share two refusal values whose
texts the existing failure-page tests pin.
cgalo5758
62f89707db