Package dev.relism.flash.ext.security.test

Class OAuthTestClient

java.lang.Object

dev.relism.flash.ext.security.test.OAuthTestClient

public final class OAuthTestClient
extends Object

An OAuth 2.1 client of the application under test, driving its own authorization server the way an MCP client does: discovery (RFC 8414), registration (RFC 7591), authorization code with PKCE, consent, and the token exchange. Its user signs in as any principal, through TestSecurity.

 OAuthTestClient.Tokens tokens = OAuthTestClient.register(app).authorize(() -> "alice");
 app.request().with(tokens.bearer()).post("/mcp");
 

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	OAuthTestClient.Tokens	What the exchange returned.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	REDIRECT_URI	Where the authorization server sends the code: never contacted, only read off the redirect.

Method Summary

Modifier and Type	Method	Description
OAuthTestClient.Tokens	authorize(dev.relism.flash.ext.security.Principal user)	Signs in as user, allows this client if asked to, and exchanges the code: the application's default resource and no scope.
OAuthTestClient.Tokens	authorize(dev.relism.flash.ext.security.Principal user, Map<String,String> parameters)	The same, with extra authorization request parameters — scope, resource.
String	clientId()
OAuthTestClient.Tokens	refresh(String refreshToken)	Trades a refresh token for a new pair.
static OAuthTestClient	register(dev.relism.flash.testing.FlashTest app)	A public client, registered at the server's registration endpoint, allowed refresh tokens.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

REDIRECT_URI

public static final String REDIRECT_URI

Where the authorization server sends the code: never contacted, only read off the redirect.

See Also:

• Constant Field Values

Method Details

register

public static OAuthTestClient register(dev.relism.flash.testing.FlashTest app)

A public client, registered at the server's registration endpoint, allowed refresh tokens.

clientId

public String clientId()

authorize

public OAuthTestClient.Tokens authorize(dev.relism.flash.ext.security.Principal user)

Signs in as user, allows this client if asked to, and exchanges the code: the application's default resource and no scope.

authorize

public OAuthTestClient.Tokens authorize(dev.relism.flash.ext.security.Principal user,
 Map<String,String> parameters)

The same, with extra authorization request parameters — scope, resource.

refresh

public OAuthTestClient.Tokens refresh(String refreshToken)

Trades a refresh token for a new pair.