如何编写测试用例来验证 OAuth 令牌？

这是一个非常有趣的问题。我可以看到您的团队关注通过测试代码来最小化可能的错误。这是许多开发人员经常忘记的一个方面。

在没有看过您的代码的情况下，很难为您的案例提出 100% 正确的答案。

我将假设我的示例将作为编写您自己的测试或在最佳情况下优化我建议的示例的指南

我使用 gin gonic 作为我项目的 http Web 框架，我编写了一个方法 Authenticate，它被称为每个受保护端点的中间件。然后为了测试我只通过 gin.Default () 方法创建了一个 http 服务器

// Authenticate auth an endpoint
func Authenticate() gin.HandlerFunc {
  return func(c *gin.Context) {
    var someErr errors.bukyError
    someErr.SetUnauthorized()

    // Fetch token from the headers
    requiredToken := c.GetHeader(constants.AuthorizationHeader)
    if len(requiredToken) == 0 {
        c.AbortWithStatusJSON(someErr.httpErrorCode,someErr.JSON())
        return
    }

    splittedToken := Strings.SplitN(requiredToken," ",2)
    if len(splittedToken) != 2 || Strings.ToLower(splittedToken[0]) != "bearer" {
        primErr := fmt.Errorf("wrong bearer token format on Authorization Header")
        someErr.PrimitiveErr = &primErr
        c.AbortWithStatusJSON(someErr.httpErrorCode,someErr.JSON())
        return
    }

    // Get email from encoded token
    jwtToken,claims,err := Helpers.DecodeJWT(splittedToken[1],falsE)
    if err != nil {
        someErr.PrimitiveErr = &err
        c.AbortWithStatusJSON(someErr.httpErrorCode,someErr.JSON())
        return
    }

    if _,err := Helpers.VerifyObjectIDs(claims.Subject); !err.IsNilError() {
        c.AbortWithStatusJSON(someErr.httpErrorCode,someErr.JSON())
        return
    }

    // Set the User variable so that we can easily retrieve from other middlewares
    // c.Set("User",result)
    c.Set(constants.ReqBukyJWTKey,jwtToken)
    c.Set(constants.ReqBukyClaimsKey,claims)

    // Call the next middlware
    c.Next()
  }
}

然后我只是按照以下方式进行了测试

func TestAuthenticate(t *tesTing.T) {
  userID := primitive.NewObjectID().Hex()
  email := "email@email.com"
  firstName := "My Name"
  lastName := "My Lastname"
  scopes := []String{"im_scope"}

  statusOK := "statusOK"
  someProtectedPath := constantS.UsersPath + "/" + userID

  ENGIne := gin.Default()
  ENGIne.GET(someProtectedPath,Authenticate(),func(c *gin.Context) {
      c.String(http.StatusOK,statusOK)
  })

  t.Run("NoTokenHeader",func(t *tesTing.T) {
    t.Run("UnsetHeader",func(t *tesTing.T) {
        w := httptest.NewRecorder()
        req,_ := http.Newrequest("GET",someProtectedPath,nil)
        ENGIne.Servehttp(w,req)
        assert.Equal(t,http.StatusUnauthorized,w.CodE)
    })

    t.Run("EmptyHeader",nil)
        req.Header.Set(constants.AuthorizationHeader,"")
        ENGIne.Servehttp(w,w.CodE)
    })
  })

  t.Run("TokenWithBadFormat",func(t *tesTing.T) {
    t.Run("1",nil)
        badFormatedToken := "hola.hola"
        req.Header.Set(constants.AuthorizationHeader,fmt.Sprintf("Bearer %s",badFormatedToken))
        ENGIne.Servehttp(w,w.CodE)
    })

    t.Run("2",nil)
        badFormatedToken := "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ."
        req.Header.Set(constants.AuthorizationHeader,w.CodE)
    })

    t.Run("3",nil)
        badFormatedToken := "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.hola.hola.hola"
        req.Header.Set(constants.AuthorizationHeader,fmt.Sprintf("Bearere %s",w.CodE)
    })
  })

  t.Run("ExpiredToken",func(t *tesTing.T) {
    w := httptest.NewRecorder()
    req,nil)
    expirationTime := time.Second
    expiredToken,_,err := Helpers.GenerateAccessJWT(userID,email,firstName,lastName,scopes,expirationTimE)
    time.Sleep(expirationTime * 2)
    req.Header.Set(constants.AuthorizationHeader,expiredToken))
    ENGIne.Servehttp(w,req)
    assert.Equal(t,w.CodE)
    assert.Nil(t,err)
  })

  t.Run("ValidToken",nil)
    validToken,scopes)
    req.Header.Set(constants.AuthorizationHeader,validToken))
    ENGIne.Servehttp(w,req)
    assert.Nil(t,err)
    assert.Equal(t,http.StatusOK,w.CodE)

  })
}