auth/threelegged_test.go - third_party/github.com/googleapis/google-cloud-go - Git at Google

 // Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.

 package auth

 import (
 	"context"
 	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"testing"
 	"time"
 )

 const day = 24 * time.Hour

 func newOpts(url string) *Options3LO {
 	return &Options3LO{
 		ClientID:     "CLIENT_ID",
 		ClientSecret: "CLIENT_SECRET",
 		RedirectURL:  "REDIRECT_URL",
 		Scopes:       []string{"scope1", "scope2"},
 		AuthURL:      url + "/auth",
 		TokenURL:     url + "/token",
 		AuthStyle:    StyleInHeader,
 		RefreshToken: "OLD_REFRESH_TOKEN",
 	}
 }

 func Test3LO_URLUnsafe(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if got, want := r.Header.Get("Authorization"), "Basic Q0xJRU5UX0lEJTNGJTNGOkNMSUVOVF9TRUNSRVQlM0YlM0Y="; got != want {
 			t.Errorf("Authorization header = %q; want %q", got, want)
 		}

 		w.Header().Set("Content-Type", "application/x-www-form-urlencoded")
 		w.Write([]byte("access_token=90d64460d14870c08c81352a05dedd3465940a7c&scope=user&token_type=bearer"))
 	}))
 	defer ts.Close()
 	conf := newOpts(ts.URL)
 	conf.ClientID = "CLIENT_ID??"
 	conf.ClientSecret = "CLIENT_SECRET??"
 	_, _, err := conf.exchange(context.Background(), "exchange-code")
 	if err != nil {
 		t.Error(err)
 	}
 }

 func Test3LO_StandardExchange(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.String() != "/token" {
 			t.Errorf("Unexpected exchange request URL %q", r.URL)
 		}
 		headerAuth := r.Header.Get("Authorization")
 		if want := "Basic Q0xJRU5UX0lEOkNMSUVOVF9TRUNSRVQ="; headerAuth != want {
 			t.Errorf("Unexpected authorization header %q, want %q", headerAuth, want)
 		}
 		headerContentType := r.Header.Get("Content-Type")
 		if headerContentType != "application/x-www-form-urlencoded" {
 			t.Errorf("Unexpected Content-Type header %q", headerContentType)
 		}
 		body, err := io.ReadAll(r.Body)
 		if err != nil {
 			t.Errorf("Failed reading request body: %s.", err)
 		}
 		if string(body) != "code=exchange-code&grant_type=authorization_code&redirect_uri=REDIRECT_URL" {
 			t.Errorf("Unexpected exchange payload; got %q", body)
 		}
 		w.Header().Set("Content-Type", "application/x-www-form-urlencoded")
 		w.Write([]byte("access_token=90d64460d14870c08c81352a05dedd3465940a7c&scope=user&token_type=bearer"))
 	}))
 	defer ts.Close()
 	conf := newOpts(ts.URL)
 	tok, _, err := conf.exchange(context.Background(), "exchange-code")
 	if err != nil {
 		t.Error(err)
 	}
 	if !tok.IsValid() {
 		t.Fatalf("Token invalid. Got: %#v", tok)
 	}
 	if tok.Value != "90d64460d14870c08c81352a05dedd3465940a7c" {
 		t.Errorf("Unexpected access token, %#v.", tok.Value)
 	}
 	if tok.Type != "bearer" {
 		t.Errorf("Unexpected token type, %#v.", tok.Type)
 	}
 	scope := tok.Metadata["scope"].([]string)
 	if scope[0] != "user" {
 		t.Errorf("Unexpected value for scope: %v", scope)
 	}
 }

 func Test3LO_ExchangeCustomParams(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.String() != "/token" {
 			t.Errorf("Unexpected exchange request URL, %v is found.", r.URL)
 		}
 		headerAuth := r.Header.Get("Authorization")
 		if headerAuth != "Basic Q0xJRU5UX0lEOkNMSUVOVF9TRUNSRVQ=" {
 			t.Errorf("Unexpected authorization header, %v is found.", headerAuth)
 		}
 		headerContentType := r.Header.Get("Content-Type")
 		if headerContentType != "application/x-www-form-urlencoded" {
 			t.Errorf("Unexpected Content-Type header, %v is found.", headerContentType)
 		}
 		body, err := io.ReadAll(r.Body)
 		if err != nil {
 			t.Errorf("Failed reading request body: %s.", err)
 		}
 		if string(body) != "code=exchange-code&foo=bar&grant_type=authorization_code&redirect_uri=REDIRECT_URL" {
 			t.Errorf("Unexpected exchange payload, %v is found.", string(body))
 		}
 		w.Header().Set("Content-Type", "application/x-www-form-urlencoded")
 		w.Write([]byte("access_token=90d64460d14870c08c81352a05dedd3465940a7c&scope=user&token_type=bearer"))
 	}))
 	defer ts.Close()
 	conf := newOpts(ts.URL)
 	conf.URLParams = url.Values{}
 	conf.URLParams.Set("foo", "bar")

 	tok, _, err := conf.exchange(context.Background(), "exchange-code")
 	if err != nil {
 		t.Error(err)
 	}
 	if !tok.IsValid() {
 		t.Fatalf("Token invalid. Got: %#v", tok)
 	}
 	if tok.Value != "90d64460d14870c08c81352a05dedd3465940a7c" {
 		t.Errorf("Unexpected access token, %#v.", tok.Value)
 	}
 	if tok.Type != "bearer" {
 		t.Errorf("Unexpected token type, %#v.", tok.Type)
 	}
 	scope := tok.Metadata["scope"].([]string)
 	if scope[0] != "user" {
 		t.Errorf("Unexpected value for scope: %v", scope)
 	}
 }

 func Test3LO_ExchangeJSONResponse(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.String() != "/token" {
 			t.Errorf("Unexpected exchange request URL, %v is found.", r.URL)
 		}
 		headerAuth := r.Header.Get("Authorization")
 		if headerAuth != "Basic Q0xJRU5UX0lEOkNMSUVOVF9TRUNSRVQ=" {
 			t.Errorf("Unexpected authorization header, %v is found.", headerAuth)
 		}
 		headerContentType := r.Header.Get("Content-Type")
 		if headerContentType != "application/x-www-form-urlencoded" {
 			t.Errorf("Unexpected Content-Type header, %v is found.", headerContentType)
 		}
 		body, err := io.ReadAll(r.Body)
 		if err != nil {
 			t.Errorf("Failed reading request body: %s.", err)
 		}
 		if string(body) != "code=exchange-code&grant_type=authorization_code&redirect_uri=REDIRECT_URL" {
 			t.Errorf("Unexpected exchange payload, %v is found.", string(body))
 		}
 		w.Header().Set("Content-Type", "application/json")
 		w.Write([]byte(`{"access_token": "90d64460d14870c08c81352a05dedd3465940a7c", "scope": "user", "token_type": "bearer", "expires_in": 86400}`))
 	}))
 	defer ts.Close()
 	conf := newOpts(ts.URL)
 	tok, _, err := conf.exchange(context.Background(), "exchange-code")
 	if err != nil {
 		t.Error(err)
 	}
 	if !tok.IsValid() {
 		t.Fatalf("Token invalid. Got: %#v", tok)
 	}
 	if tok.Value != "90d64460d14870c08c81352a05dedd3465940a7c" {
 		t.Errorf("Unexpected access token, %#v.", tok.Value)
 	}
 	if tok.Type != "bearer" {
 		t.Errorf("Unexpected token type, %#v.", tok.Type)
 	}
 	scope := tok.Metadata["scope"].(string)
 	if scope != "user" {
 		t.Errorf("Unexpected value for scope: %v", scope)
 	}
 	expiresIn := tok.Metadata["expires_in"]
 	if expiresIn != float64(86400) {
 		t.Errorf("Unexpected non-numeric value for expires_in: %v", expiresIn)
 	}
 }

 func Test3LO_ExchangeJSONResponseExpiry(t *testing.T) {
 	seconds := int32(day.Seconds())
 	for _, c := range []struct {
 		name        string
 		expires     string
 		want        bool
 		nullExpires bool
 	}{
 		{"normal", fmt.Sprintf(`"expires_in": %d`, seconds), true, false},
 		{"null", `"expires_in": null`, true, true},
 		{"wrong_type", `"expires_in": false`, false, false},
 		{"wrong_type2", `"expires_in": {}`, false, false},
 		{"wrong_value", `"expires_in": "zzz"`, false, false},
 	} {
 		t.Run(c.name, func(t *testing.T) {
 			test3LOExchangeJSONResponseExpiry(t, c.expires, c.want, c.nullExpires)
 		})
 	}
 }

 func test3LOExchangeJSONResponseExpiry(t *testing.T, exp string, want, nullExpires bool) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
 		w.Write([]byte(fmt.Sprintf(`{"access_token": "90d", "scope": "user", "token_type": "bearer", %s}`, exp)))
 	}))
 	defer ts.Close()
 	conf := newOpts(ts.URL)
 	t1 := time.Now().Add(day)
 	tok, _, err := conf.exchange(context.Background(), "exchange-code")
 	t2 := t1.Add(day)

 	if got := (err == nil); got != want {
 		if want {
 			t.Errorf("unexpected error: got %v", err)
 		} else {
 			t.Errorf("unexpected success")
 		}
 	}
 	if !want {
 		return
 	}
 	if !tok.IsValid() {
 		t.Fatalf("Token invalid. Got: %#v", tok)
 	}
 	expiry := tok.Expiry

 	if nullExpires && expiry.IsZero() {
 		return
 	}
 	if expiry.Before(t1) || expiry.After(t2) {
 		t.Errorf("Unexpected value for Expiry: %v (should be between %v and %v)", expiry, t1, t2)
 	}
 }

 func Test3LO_ExchangeBadResponse(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
 		w.Write([]byte(`{"scope": "user", "token_type": "bearer"}`))
 	}))
 	defer ts.Close()
 	conf := newOpts(ts.URL)
 	_, _, err := conf.exchange(context.Background(), "code")
 	if err == nil {
 		t.Error("expected error from missing access_token")
 	}
 }

 func Test3LO_ExchangeBadResponseType(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
 		w.Write([]byte(`{"access_token":123,  "scope": "user", "token_type": "bearer"}`))
 	}))
 	defer ts.Close()
 	conf := newOpts(ts.URL)
 	_, _, err := conf.exchange(context.Background(), "exchange-code")
 	if err == nil {
 		t.Error("expected error from non-string access_token")
 	}
 }

 func Test3LO_RefreshTokenReplacement(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
 		w.Write([]byte(`{"access_token":"ACCESS_TOKEN",  "scope": "user", "token_type": "bearer", "refresh_token": "NEW_REFRESH_TOKEN"}`))
 	}))
 	defer ts.Close()
 	opts := newOpts(ts.URL)
 	tp, err := New3LOTokenProvider(opts)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if _, err := tp.Token(context.Background()); err != nil {
 		t.Errorf("got err = %v; want none", err)
 		return
 	}
 	innerTP := tp.(*cachedTokenProvider).tp.(*tokenProvider3LO)
 	if want := "NEW_REFRESH_TOKEN"; innerTP.refreshToken != want {
 		t.Errorf("RefreshToken = %q; want %q", innerTP.refreshToken, want)
 	}
 }

 func Test3LO_RefreshTokenPreservation(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
 		w.Write([]byte(`{"access_token":"ACCESS_TOKEN",  "scope": "user", "token_type": "bearer"}`))
 	}))
 	defer ts.Close()
 	opts := newOpts(ts.URL)
 	const oldRefreshToken = "OLD_REFRESH_TOKEN"
 	tp, err := New3LOTokenProvider(opts)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if _, err := tp.Token(context.Background()); err != nil {
 		t.Errorf("got err = %v; want none", err)
 		return
 	}
 	innerTP := tp.(*cachedTokenProvider).tp.(*tokenProvider3LO)
 	if innerTP.refreshToken != oldRefreshToken {
 		t.Errorf("RefreshToken = %q; want %q", innerTP.refreshToken, oldRefreshToken)
 	}
 }

 func Test3LO_AuthHandlerExchangeSuccess(t *testing.T) {
 	authhandler := func(authCodeURL string) (string, string, error) {
 		if authCodeURL == "testAuthCodeURL?client_id=testClientID&response_type=code&scope=pubsub&state=testState" {
 			return "testCode", "testState", nil
 		}
 		return "", "", fmt.Errorf("invalid authCodeURL: %q", authCodeURL)
 	}

 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		r.ParseForm()
 		if r.Form.Get("code") == "testCode" {
 			w.Header().Set("Content-Type", "application/json")
 			w.Write([]byte(`{
 				"access_token": "90d64460d14870c08c81352a05dedd3465940a7c",
 				"scope": "pubsub",
 				"token_type": "bearer",
 				"expires_in": 3600
 			}`))
 		}
 	}))
 	defer ts.Close()

 	opts := &Options3LO{
 		ClientID:  "testClientID",
 		Scopes:    []string{"pubsub"},
 		AuthURL:   "testAuthCodeURL",
 		TokenURL:  ts.URL,
 		AuthStyle: StyleInHeader,
 		AuthHandlerOpts: &AuthorizationHandlerOptions{
 			State:   "testState",
 			Handler: authhandler,
 		},
 	}

 	tp, err := New3LOTokenProvider(opts)
 	if err != nil {
 		t.Fatal(err)
 	}
 	tok, err := tp.Token(context.Background())
 	if err != nil {
 		t.Fatal(err)
 	}
 	if !tok.IsValid() {
 		t.Errorf("got invalid token: %v", tok)
 	}
 	if got, want := tok.Value, "90d64460d14870c08c81352a05dedd3465940a7c"; got != want {
 		t.Errorf("access token = %q; want %q", got, want)
 	}
 	if got, want := tok.Type, "bearer"; got != want {
 		t.Errorf("token type = %q; want %q", got, want)
 	}
 	if got := tok.Expiry.IsZero(); got {
 		t.Errorf("token expiry is zero = %v, want false", got)
 	}
 	scope := tok.Metadata["scope"].(string)
 	if got, want := scope, "pubsub"; got != want {
 		t.Errorf("scope = %q; want %q", got, want)
 	}
 }

 func Test3LO_AuthHandlerExchangeStateMismatch(t *testing.T) {
 	authhandler := func(authCodeURL string) (string, string, error) {
 		return "testCode", "testStateMismatch", nil
 	}

 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
 		w.Write([]byte(`{
 			"access_token": "90d64460d14870c08c81352a05dedd3465940a7c",
 			"scope": "pubsub",
 			"token_type": "bearer",
 			"expires_in": 3600
 		}`))
 	}))
 	defer ts.Close()

 	opts := &Options3LO{
 		ClientID:  "testClientID",
 		Scopes:    []string{"pubsub"},
 		AuthURL:   "testAuthCodeURL",
 		TokenURL:  ts.URL,
 		AuthStyle: StyleInParams,
 		AuthHandlerOpts: &AuthorizationHandlerOptions{
 			State:   "testState",
 			Handler: authhandler,
 		},
 	}
 	tp, err := New3LOTokenProvider(opts)
 	if err != nil {
 		t.Fatal(err)
 	}
 	_, err = tp.Token(context.Background())
 	if wantErr := "auth: state mismatch in 3-legged-OAuth flow"; err == nil || err.Error() != wantErr {
 		t.Errorf("err = %q; want %q", err, wantErr)
 	}
 }

 func Test3LO_PKCEExchangeWithSuccess(t *testing.T) {
 	authhandler := func(authCodeURL string) (string, string, error) {
 		if authCodeURL == "testAuthCodeURL?client_id=testClientID&code_challenge=codeChallenge&code_challenge_method=plain&response_type=code&scope=pubsub&state=testState" {
 			return "testCode", "testState", nil
 		}
 		return "", "", fmt.Errorf("invalid authCodeURL: %q", authCodeURL)
 	}

 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		r.ParseForm()
 		if r.Form.Get("code") == "testCode" && r.Form.Get("code_verifier") == "codeChallenge" {
 			w.Header().Set("Content-Type", "application/json")
 			w.Write([]byte(`{
 				"access_token": "90d64460d14870c08c81352a05dedd3465940a7c",
 				"scope": "pubsub",
 				"token_type": "bearer",
 				"expires_in": 3600
 			}`))
 		}
 	}))
 	defer ts.Close()

 	opts := &Options3LO{
 		ClientID:  "testClientID",
 		Scopes:    []string{"pubsub"},
 		AuthURL:   "testAuthCodeURL",
 		TokenURL:  ts.URL,
 		AuthStyle: StyleInParams,
 		AuthHandlerOpts: &AuthorizationHandlerOptions{
 			State:   "testState",
 			Handler: authhandler,
 			PKCEOpts: &PKCEOptions{
 				Challenge:       "codeChallenge",
 				ChallengeMethod: "plain",
 				Verifier:        "codeChallenge",
 			},
 		},
 	}

 	tp, err := New3LOTokenProvider(opts)
 	if err != nil {
 		t.Fatal(err)
 	}
 	tok, err := tp.Token(context.Background())
 	if err != nil {
 		t.Fatal(err)
 	}
 	if !tok.IsValid() {
 		t.Errorf("got invalid token: %v", tok)
 	}
 	if got, want := tok.Value, "90d64460d14870c08c81352a05dedd3465940a7c"; got != want {
 		t.Errorf("access token = %q; want %q", got, want)
 	}
 	if got, want := tok.Type, "bearer"; got != want {
 		t.Errorf("token type = %q; want %q", got, want)
 	}
 	if got := tok.Expiry.IsZero(); got {
 		t.Errorf("token expiry is zero = %v, want false", got)
 	}
 	scope := tok.Metadata["scope"].(string)
 	if got, want := scope, "pubsub"; got != want {
 		t.Errorf("scope = %q; want %q", got, want)
 	}
 }

 func Test3LO_Validate(t *testing.T) {
 	tests := []struct {
 		name string
 		opts *Options3LO
 	}{
 		{
 			name: "missing options",
 		},
 		{
 			name: "missing client ID",
 			opts: &Options3LO{
 				ClientSecret: "client_secret",
 				AuthURL:      "auth_url",
 				TokenURL:     "token_url",
 				AuthStyle:    StyleInHeader,
 				RefreshToken: "refreshing",
 			},
 		},
 		{
 			name: "missing client secret",
 			opts: &Options3LO{
 				ClientID:     "client_id",
 				AuthURL:      "auth_url",
 				TokenURL:     "token_url",
 				AuthStyle:    StyleInHeader,
 				RefreshToken: "refreshing",
 			},
 		},
 		{
 			name: "missing auth URL",
 			opts: &Options3LO{
 				ClientID:     "client_id",
 				ClientSecret: "client_secret",
 				TokenURL:     "token_url",
 				AuthStyle:    StyleInHeader,
 				RefreshToken: "refreshing",
 			},
 		},
 		{
 			name: "missing token URL",
 			opts: &Options3LO{
 				ClientID:     "client_id",
 				ClientSecret: "client_secret",
 				AuthURL:      "auth_url",
 				AuthStyle:    StyleInHeader,
 				RefreshToken: "refreshing",
 			},
 		},
 		{
 			name: "missing auth style",
 			opts: &Options3LO{
 				ClientID:     "client_id",
 				ClientSecret: "client_secret",
 				AuthURL:      "auth_url",
 				TokenURL:     "token_url",
 				RefreshToken: "refreshing",
 			},
 		},
 		{
 			name: "missing refresh token",
 			opts: &Options3LO{
 				ClientID:     "client_id",
 				ClientSecret: "client_secret",
 				AuthURL:      "auth_url",
 				TokenURL:     "token_url",
 				AuthStyle:    StyleInHeader,
 			},
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			if _, err := New3LOTokenProvider(tt.opts); err == nil {
 				t.Error("got nil, want an error")
 			}
 		})
 	}
 }
	// Copyright 2023 Google LLC
	//
	// Licensed under the Apache License, Version 2.0 (the "License");
	// you may not use this file except in compliance with the License.
	// You may obtain a copy of the License at
	//
	// http://www.apache.org/licenses/LICENSE-2.0
	//
	// Unless required by applicable law or agreed to in writing, software
	// distributed under the License is distributed on an "AS IS" BASIS,
	// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	// See the License for the specific language governing permissions and
	// limitations under the License.

	package auth

	import (
	"context"
	"fmt"
	"io"
	"net/http"
	"net/http/httptest"
	"net/url"
	"testing"
	"time"
	)

	const day = 24 * time.Hour

	func newOpts(url string) *Options3LO {
	return &Options3LO{
	ClientID: "CLIENT_ID",
	ClientSecret: "CLIENT_SECRET",
	RedirectURL: "REDIRECT_URL",
	Scopes: []string{"scope1", "scope2"},
	AuthURL: url + "/auth",
	TokenURL: url + "/token",
	AuthStyle: StyleInHeader,
	RefreshToken: "OLD_REFRESH_TOKEN",
	}
	}

	func Test3LO_URLUnsafe(t *testing.T) {
	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	if got, want := r.Header.Get("Authorization"), "Basic Q0xJRU5UX0lEJTNGJTNGOkNMSUVOVF9TRUNSRVQlM0YlM0Y="; got != want {
	t.Errorf("Authorization header = %q; want %q", got, want)
	}

	w.Header().Set("Content-Type", "application/x-www-form-urlencoded")
	w.Write([]byte("access_token=90d64460d14870c08c81352a05dedd3465940a7c&scope=user&token_type=bearer"))
	}))
	defer ts.Close()
	conf := newOpts(ts.URL)
	conf.ClientID = "CLIENT_ID??"
	conf.ClientSecret = "CLIENT_SECRET??"
	_, _, err := conf.exchange(context.Background(), "exchange-code")
	if err != nil {
	t.Error(err)
	}
	}

	func Test3LO_StandardExchange(t *testing.T) {
	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	if r.URL.String() != "/token" {
	t.Errorf("Unexpected exchange request URL %q", r.URL)
	}
	headerAuth := r.Header.Get("Authorization")
	if want := "Basic Q0xJRU5UX0lEOkNMSUVOVF9TRUNSRVQ="; headerAuth != want {
	t.Errorf("Unexpected authorization header %q, want %q", headerAuth, want)
	}
	headerContentType := r.Header.Get("Content-Type")
	if headerContentType != "application/x-www-form-urlencoded" {
	t.Errorf("Unexpected Content-Type header %q", headerContentType)
	}
	body, err := io.ReadAll(r.Body)
	if err != nil {
	t.Errorf("Failed reading request body: %s.", err)
	}
	if string(body) != "code=exchange-code&grant_type=authorization_code&redirect_uri=REDIRECT_URL" {
	t.Errorf("Unexpected exchange payload; got %q", body)
	}
	w.Header().Set("Content-Type", "application/x-www-form-urlencoded")
	w.Write([]byte("access_token=90d64460d14870c08c81352a05dedd3465940a7c&scope=user&token_type=bearer"))
	}))
	defer ts.Close()
	conf := newOpts(ts.URL)
	tok, _, err := conf.exchange(context.Background(), "exchange-code")
	if err != nil {
	t.Error(err)
	}
	if !tok.IsValid() {
	t.Fatalf("Token invalid. Got: %#v", tok)
	}
	if tok.Value != "90d64460d14870c08c81352a05dedd3465940a7c" {
	t.Errorf("Unexpected access token, %#v.", tok.Value)
	}
	if tok.Type != "bearer" {
	t.Errorf("Unexpected token type, %#v.", tok.Type)
	}
	scope := tok.Metadata["scope"].([]string)
	if scope[0] != "user" {
	t.Errorf("Unexpected value for scope: %v", scope)
	}
	}

	func Test3LO_ExchangeCustomParams(t *testing.T) {
	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	if r.URL.String() != "/token" {
	t.Errorf("Unexpected exchange request URL, %v is found.", r.URL)
	}
	headerAuth := r.Header.Get("Authorization")
	if headerAuth != "Basic Q0xJRU5UX0lEOkNMSUVOVF9TRUNSRVQ=" {
	t.Errorf("Unexpected authorization header, %v is found.", headerAuth)
	}
	headerContentType := r.Header.Get("Content-Type")
	if headerContentType != "application/x-www-form-urlencoded" {
	t.Errorf("Unexpected Content-Type header, %v is found.", headerContentType)
	}
	body, err := io.ReadAll(r.Body)
	if err != nil {
	t.Errorf("Failed reading request body: %s.", err)
	}
	if string(body) != "code=exchange-code&foo=bar&grant_type=authorization_code&redirect_uri=REDIRECT_URL" {
	t.Errorf("Unexpected exchange payload, %v is found.", string(body))
	}
	w.Header().Set("Content-Type", "application/x-www-form-urlencoded")
	w.Write([]byte("access_token=90d64460d14870c08c81352a05dedd3465940a7c&scope=user&token_type=bearer"))
	}))
	defer ts.Close()
	conf := newOpts(ts.URL)
	conf.URLParams = url.Values{}
	conf.URLParams.Set("foo", "bar")

	tok, _, err := conf.exchange(context.Background(), "exchange-code")
	if err != nil {
	t.Error(err)
	}
	if !tok.IsValid() {
	t.Fatalf("Token invalid. Got: %#v", tok)
	}
	if tok.Value != "90d64460d14870c08c81352a05dedd3465940a7c" {
	t.Errorf("Unexpected access token, %#v.", tok.Value)
	}
	if tok.Type != "bearer" {
	t.Errorf("Unexpected token type, %#v.", tok.Type)
	}
	scope := tok.Metadata["scope"].([]string)
	if scope[0] != "user" {
	t.Errorf("Unexpected value for scope: %v", scope)
	}
	}

	func Test3LO_ExchangeJSONResponse(t *testing.T) {
	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	if r.URL.String() != "/token" {
	t.Errorf("Unexpected exchange request URL, %v is found.", r.URL)
	}
	headerAuth := r.Header.Get("Authorization")
	if headerAuth != "Basic Q0xJRU5UX0lEOkNMSUVOVF9TRUNSRVQ=" {
	t.Errorf("Unexpected authorization header, %v is found.", headerAuth)
	}
	headerContentType := r.Header.Get("Content-Type")
	if headerContentType != "application/x-www-form-urlencoded" {
	t.Errorf("Unexpected Content-Type header, %v is found.", headerContentType)
	}
	body, err := io.ReadAll(r.Body)
	if err != nil {
	t.Errorf("Failed reading request body: %s.", err)
	}
	if string(body) != "code=exchange-code&grant_type=authorization_code&redirect_uri=REDIRECT_URL" {
	t.Errorf("Unexpected exchange payload, %v is found.", string(body))
	}
	w.Header().Set("Content-Type", "application/json")
	w.Write([]byte(`{"access_token": "90d64460d14870c08c81352a05dedd3465940a7c", "scope": "user", "token_type": "bearer", "expires_in": 86400}`))
	}))
	defer ts.Close()
	conf := newOpts(ts.URL)
	tok, _, err := conf.exchange(context.Background(), "exchange-code")
	if err != nil {
	t.Error(err)
	}
	if !tok.IsValid() {
	t.Fatalf("Token invalid. Got: %#v", tok)
	}
	if tok.Value != "90d64460d14870c08c81352a05dedd3465940a7c" {
	t.Errorf("Unexpected access token, %#v.", tok.Value)
	}
	if tok.Type != "bearer" {
	t.Errorf("Unexpected token type, %#v.", tok.Type)
	}
	scope := tok.Metadata["scope"].(string)
	if scope != "user" {
	t.Errorf("Unexpected value for scope: %v", scope)
	}
	expiresIn := tok.Metadata["expires_in"]
	if expiresIn != float64(86400) {
	t.Errorf("Unexpected non-numeric value for expires_in: %v", expiresIn)
	}
	}

	func Test3LO_ExchangeJSONResponseExpiry(t *testing.T) {
	seconds := int32(day.Seconds())
	for _, c := range []struct {
	name string
	expires string
	want bool
	nullExpires bool
	}{
	{"normal", fmt.Sprintf(`"expires_in": %d`, seconds), true, false},
	{"null", `"expires_in": null`, true, true},
	{"wrong_type", `"expires_in": false`, false, false},
	{"wrong_type2", `"expires_in": {}`, false, false},
	{"wrong_value", `"expires_in": "zzz"`, false, false},
	} {
	t.Run(c.name, func(t *testing.T) {
	test3LOExchangeJSONResponseExpiry(t, c.expires, c.want, c.nullExpires)
	})
	}
	}

	func test3LOExchangeJSONResponseExpiry(t *testing.T, exp string, want, nullExpires bool) {
	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Content-Type", "application/json")
	w.Write([]byte(fmt.Sprintf(`{"access_token": "90d", "scope": "user", "token_type": "bearer", %s}`, exp)))
	}))
	defer ts.Close()
	conf := newOpts(ts.URL)
	t1 := time.Now().Add(day)
	tok, _, err := conf.exchange(context.Background(), "exchange-code")
	t2 := t1.Add(day)

	if got := (err == nil); got != want {
	if want {
	t.Errorf("unexpected error: got %v", err)
	} else {
	t.Errorf("unexpected success")
	}
	}
	if !want {
	return
	}
	if !tok.IsValid() {
	t.Fatalf("Token invalid. Got: %#v", tok)
	}
	expiry := tok.Expiry

	if nullExpires && expiry.IsZero() {
	return
	}
	if expiry.Before(t1) \|\| expiry.After(t2) {
	t.Errorf("Unexpected value for Expiry: %v (should be between %v and %v)", expiry, t1, t2)
	}
	}

	func Test3LO_ExchangeBadResponse(t *testing.T) {
	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Content-Type", "application/json")
	w.Write([]byte(`{"scope": "user", "token_type": "bearer"}`))
	}))
	defer ts.Close()
	conf := newOpts(ts.URL)
	_, _, err := conf.exchange(context.Background(), "code")
	if err == nil {
	t.Error("expected error from missing access_token")
	}
	}

	func Test3LO_ExchangeBadResponseType(t *testing.T) {
	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Content-Type", "application/json")
	w.Write([]byte(`{"access_token":123, "scope": "user", "token_type": "bearer"}`))
	}))
	defer ts.Close()
	conf := newOpts(ts.URL)
	_, _, err := conf.exchange(context.Background(), "exchange-code")
	if err == nil {
	t.Error("expected error from non-string access_token")
	}
	}

	func Test3LO_RefreshTokenReplacement(t *testing.T) {
	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Content-Type", "application/json")
	w.Write([]byte(`{"access_token":"ACCESS_TOKEN", "scope": "user", "token_type": "bearer", "refresh_token": "NEW_REFRESH_TOKEN"}`))
	}))
	defer ts.Close()
	opts := newOpts(ts.URL)
	tp, err := New3LOTokenProvider(opts)
	if err != nil {
	t.Fatal(err)
	}
	if _, err := tp.Token(context.Background()); err != nil {
	t.Errorf("got err = %v; want none", err)
	return
	}
	innerTP := tp.(cachedTokenProvider).tp.(tokenProvider3LO)
	if want := "NEW_REFRESH_TOKEN"; innerTP.refreshToken != want {
	t.Errorf("RefreshToken = %q; want %q", innerTP.refreshToken, want)
	}
	}

	func Test3LO_RefreshTokenPreservation(t *testing.T) {
	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Content-Type", "application/json")
	w.Write([]byte(`{"access_token":"ACCESS_TOKEN", "scope": "user", "token_type": "bearer"}`))
	}))
	defer ts.Close()
	opts := newOpts(ts.URL)
	const oldRefreshToken = "OLD_REFRESH_TOKEN"
	tp, err := New3LOTokenProvider(opts)
	if err != nil {
	t.Fatal(err)
	}
	if _, err := tp.Token(context.Background()); err != nil {
	t.Errorf("got err = %v; want none", err)
	return
	}
	innerTP := tp.(cachedTokenProvider).tp.(tokenProvider3LO)
	if innerTP.refreshToken != oldRefreshToken {
	t.Errorf("RefreshToken = %q; want %q", innerTP.refreshToken, oldRefreshToken)
	}
	}

	func Test3LO_AuthHandlerExchangeSuccess(t *testing.T) {
	authhandler := func(authCodeURL string) (string, string, error) {
	if authCodeURL == "testAuthCodeURL?client_id=testClientID&response_type=code&scope=pubsub&state=testState" {
	return "testCode", "testState", nil
	}
	return "", "", fmt.Errorf("invalid authCodeURL: %q", authCodeURL)
	}

	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	r.ParseForm()
	if r.Form.Get("code") == "testCode" {
	w.Header().Set("Content-Type", "application/json")
	w.Write([]byte(`{
	"access_token": "90d64460d14870c08c81352a05dedd3465940a7c",
	"scope": "pubsub",
	"token_type": "bearer",
	"expires_in": 3600
	}`))
	}
	}))
	defer ts.Close()

	opts := &Options3LO{
	ClientID: "testClientID",
	Scopes: []string{"pubsub"},
	AuthURL: "testAuthCodeURL",
	TokenURL: ts.URL,
	AuthStyle: StyleInHeader,
	AuthHandlerOpts: &AuthorizationHandlerOptions{
	State: "testState",
	Handler: authhandler,
	},
	}

	tp, err := New3LOTokenProvider(opts)
	if err != nil {
	t.Fatal(err)
	}
	tok, err := tp.Token(context.Background())
	if err != nil {
	t.Fatal(err)
	}
	if !tok.IsValid() {
	t.Errorf("got invalid token: %v", tok)
	}
	if got, want := tok.Value, "90d64460d14870c08c81352a05dedd3465940a7c"; got != want {
	t.Errorf("access token = %q; want %q", got, want)
	}
	if got, want := tok.Type, "bearer"; got != want {
	t.Errorf("token type = %q; want %q", got, want)
	}
	if got := tok.Expiry.IsZero(); got {
	t.Errorf("token expiry is zero = %v, want false", got)
	}
	scope := tok.Metadata["scope"].(string)
	if got, want := scope, "pubsub"; got != want {
	t.Errorf("scope = %q; want %q", got, want)
	}
	}

	func Test3LO_AuthHandlerExchangeStateMismatch(t *testing.T) {
	authhandler := func(authCodeURL string) (string, string, error) {
	return "testCode", "testStateMismatch", nil
	}

	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Content-Type", "application/json")
	w.Write([]byte(`{
	"access_token": "90d64460d14870c08c81352a05dedd3465940a7c",
	"scope": "pubsub",
	"token_type": "bearer",
	"expires_in": 3600
	}`))
	}))
	defer ts.Close()

	opts := &Options3LO{
	ClientID: "testClientID",
	Scopes: []string{"pubsub"},
	AuthURL: "testAuthCodeURL",
	TokenURL: ts.URL,
	AuthStyle: StyleInParams,
	AuthHandlerOpts: &AuthorizationHandlerOptions{
	State: "testState",
	Handler: authhandler,
	},
	}
	tp, err := New3LOTokenProvider(opts)
	if err != nil {
	t.Fatal(err)
	}
	_, err = tp.Token(context.Background())
	if wantErr := "auth: state mismatch in 3-legged-OAuth flow"; err == nil \|\| err.Error() != wantErr {
	t.Errorf("err = %q; want %q", err, wantErr)
	}
	}

	func Test3LO_PKCEExchangeWithSuccess(t *testing.T) {
	authhandler := func(authCodeURL string) (string, string, error) {
	if authCodeURL == "testAuthCodeURL?client_id=testClientID&code_challenge=codeChallenge&code_challenge_method=plain&response_type=code&scope=pubsub&state=testState" {
	return "testCode", "testState", nil
	}
	return "", "", fmt.Errorf("invalid authCodeURL: %q", authCodeURL)
	}

	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	r.ParseForm()
	if r.Form.Get("code") == "testCode" && r.Form.Get("code_verifier") == "codeChallenge" {
	w.Header().Set("Content-Type", "application/json")
	w.Write([]byte(`{
	"access_token": "90d64460d14870c08c81352a05dedd3465940a7c",
	"scope": "pubsub",
	"token_type": "bearer",
	"expires_in": 3600
	}`))
	}
	}))
	defer ts.Close()

	opts := &Options3LO{
	ClientID: "testClientID",
	Scopes: []string{"pubsub"},
	AuthURL: "testAuthCodeURL",
	TokenURL: ts.URL,
	AuthStyle: StyleInParams,
	AuthHandlerOpts: &AuthorizationHandlerOptions{
	State: "testState",
	Handler: authhandler,
	PKCEOpts: &PKCEOptions{
	Challenge: "codeChallenge",
	ChallengeMethod: "plain",
	Verifier: "codeChallenge",
	},
	},
	}

	tp, err := New3LOTokenProvider(opts)
	if err != nil {
	t.Fatal(err)
	}
	tok, err := tp.Token(context.Background())
	if err != nil {
	t.Fatal(err)
	}
	if !tok.IsValid() {
	t.Errorf("got invalid token: %v", tok)
	}
	if got, want := tok.Value, "90d64460d14870c08c81352a05dedd3465940a7c"; got != want {
	t.Errorf("access token = %q; want %q", got, want)
	}
	if got, want := tok.Type, "bearer"; got != want {
	t.Errorf("token type = %q; want %q", got, want)
	}
	if got := tok.Expiry.IsZero(); got {
	t.Errorf("token expiry is zero = %v, want false", got)
	}
	scope := tok.Metadata["scope"].(string)
	if got, want := scope, "pubsub"; got != want {
	t.Errorf("scope = %q; want %q", got, want)
	}
	}

	func Test3LO_Validate(t *testing.T) {
	tests := []struct {
	name string
	opts *Options3LO
	}{
	{
	name: "missing options",
	},
	{
	name: "missing client ID",
	opts: &Options3LO{
	ClientSecret: "client_secret",
	AuthURL: "auth_url",
	TokenURL: "token_url",
	AuthStyle: StyleInHeader,
	RefreshToken: "refreshing",
	},
	},
	{
	name: "missing client secret",
	opts: &Options3LO{
	ClientID: "client_id",
	AuthURL: "auth_url",
	TokenURL: "token_url",
	AuthStyle: StyleInHeader,
	RefreshToken: "refreshing",
	},
	},
	{
	name: "missing auth URL",
	opts: &Options3LO{
	ClientID: "client_id",
	ClientSecret: "client_secret",
	TokenURL: "token_url",
	AuthStyle: StyleInHeader,
	RefreshToken: "refreshing",
	},
	},
	{
	name: "missing token URL",
	opts: &Options3LO{
	ClientID: "client_id",
	ClientSecret: "client_secret",
	AuthURL: "auth_url",
	AuthStyle: StyleInHeader,
	RefreshToken: "refreshing",
	},
	},
	{
	name: "missing auth style",
	opts: &Options3LO{
	ClientID: "client_id",
	ClientSecret: "client_secret",
	AuthURL: "auth_url",
	TokenURL: "token_url",
	RefreshToken: "refreshing",
	},
	},
	{
	name: "missing refresh token",
	opts: &Options3LO{
	ClientID: "client_id",
	ClientSecret: "client_secret",
	AuthURL: "auth_url",
	TokenURL: "token_url",
	AuthStyle: StyleInHeader,
	},
	},
	}
	for _, tt := range tests {
	t.Run(tt.name, func(t *testing.T) {
	if _, err := New3LOTokenProvider(tt.opts); err == nil {
	t.Error("got nil, want an error")
	}
	})
	}
	}