kych

db_integration.rs (5832B)

---

 use anyhow::Result;
 use kych_oauth2_gateway_lib::db::{authorization_codes, clients, sessions, tokens};
 use serde_json::json;
 use sqlx::{PgPool, postgres::PgPoolOptions};
 use uuid::Uuid;
 
 async fn get_pool() -> Option<PgPool> {
     let url = match std::env::var("DATABASE_URL") {
         Ok(url) if !url.trim().is_empty() => url,
         _ => {
             eprintln!("DATABASE_URL not set; skipping DB integration tests.");
             return None;
         }
     };
 
     match PgPoolOptions::new().max_connections(5).connect(&url).await {
         Ok(pool) => Some(pool),
         Err(err) => {
             eprintln!("Failed to connect to DATABASE_URL; skipping tests: {}", err);
             None
         }
     }
 }
 
 struct TestClient {
     client: clients::Client,
     secret: String,
 }
 
 async fn create_test_client(pool: &PgPool) -> Result<TestClient> {
     let suffix = Uuid::new_v4().to_string();
     let client_id = format!("test-client-{}", suffix);
     let secret = format!("secret-{}", suffix);
     let verifier_url = "https://verifier.example";
     let redirect_uri = "https://example.com/callback";
     let accepted_issuer_dids = Some("did:example:issuer1,did:example:issuer2");
 
     let client = clients::register_client(
         pool,
         &client_id,
         &secret,
         verifier_url,
         None,
         redirect_uri,
         accepted_issuer_dids,
     )
     .await?;
 
     Ok(TestClient { client, secret })
 }
 
 #[tokio::test]
 async fn test_clients_crud() -> Result<()> {
     let Some(pool) = get_pool().await else { return Ok(()); };
 
     let test_client = create_test_client(&pool).await?;
     let client = &test_client.client;
 
     let fetched = clients::get_client_by_id(&pool, &client.client_id).await?;
     assert!(fetched.is_some());
     assert_eq!(fetched.as_ref().unwrap().id, client.id);
 
     let auth_ok = clients::authenticate_client(&pool, &client.client_id, "wrong-secret").await?;
     assert!(auth_ok.is_none());
 
     let auth_ok = clients::authenticate_client(&pool, &client.client_id, &test_client.secret)
         .await?;
     assert!(auth_ok.is_some());
 
     let updated = clients::update_client(
         &pool,
         client.id,
         Some("https://verifier.example/v2"),
         Some("/management/api/verifications"),
         Some("https://example.com/redirect2"),
         None,
     )
     .await?;
     assert_eq!(updated.redirect_uri, "https://example.com/redirect2");
 
     let all = clients::list_clients(&pool).await?;
     assert!(all.iter().any(|c| c.id == client.id));
 
     let deleted = clients::delete_client(&pool, client.id).await?;
     assert!(deleted);
 
     Ok(())
 }
 
 #[tokio::test]
 async fn test_sessions_codes_tokens_flow() -> Result<()> {
     let Some(pool) = get_pool().await else { return Ok(()); };
 
     let test_client = create_test_client(&pool).await?;
     let client = &test_client.client;
 
     let nonce = format!("nonce-{}", Uuid::new_v4());
     let session = sessions::create_session(&pool, &client.client_id, &nonce, 5)
         .await?
         .expect("client should exist");
     assert_eq!(session.nonce, nonce);
 
     let scope = "first_name last_name";
     let redirect_uri = "https://example.com/callback";
     let state = "state-123";
     let authorize = sessions::get_session_for_authorize(
         &pool,
         &nonce,
         &client.client_id,
         scope,
         redirect_uri,
         state,
     )
     .await?
     .expect("session should exist");
     assert_eq!(authorize.scope, scope);
     assert_eq!(authorize.redirect_uri.as_deref(), Some(redirect_uri));
     assert_eq!(authorize.state.as_deref(), Some(state));
 
     let verification_url = "https://verifier.example/verify/1";
     let request_id = Uuid::new_v4().to_string();
     let authorized = sessions::update_session_authorized(
         &pool,
         authorize.session_id,
         verification_url,
         None,
         &request_id,
         None,
     )
     .await?;
     assert_eq!(authorized.request_id, request_id);
 
     let authorization_code = format!("code-{}", Uuid::new_v4());
     let issued_code = sessions::verify_session_and_issue_code(
         &pool,
         authorize.session_id,
         sessions::SessionStatus::Verified,
         &authorization_code,
         10,
         client.id,
         "",
         Some(&json!({"vc": "data"})),
     )
     .await?;
     assert_eq!(issued_code, authorization_code);
 
     let code_row = authorization_codes::get_code_by_session(&pool, authorize.session_id)
         .await?
         .expect("code should exist");
     assert!(!code_row.used);
 
     let exchange = authorization_codes::get_code_for_token_exchange(&pool, &authorization_code)
         .await?
         .expect("code should be exchangeable");
     assert!(!exchange.was_already_used);
     assert_eq!(exchange.session_status, sessions::SessionStatus::Verified);
     assert!(exchange.existing_token.is_none());
 
     let exchange_again = authorization_codes::get_code_for_token_exchange(&pool, &authorization_code)
         .await?
         .expect("code still exists");
     assert!(exchange_again.was_already_used);
 
     let token_value = format!("token-{}", Uuid::new_v4());
     let token = tokens::create_token_and_complete_session(
         &pool,
         authorize.session_id,
         &token_value,
         60,
     )
     .await?;
     assert_eq!(token.token, token_value);
 
     let token_data = tokens::get_token_with_session(&pool, &token_value)
         .await?
         .expect("token should exist");
     assert!(!token_data.revoked);
     assert_eq!(token_data.session_status, sessions::SessionStatus::Completed);
 
     let status_data = sessions::get_session_for_status(&pool, &request_id)
         .await?
         .expect("status should exist");
     assert_eq!(status_data.status, sessions::SessionStatus::Completed);
 
     let _ = clients::delete_client(&pool, client.id).await?;
     Ok(())
 }