Zakaria El OrcheandClaude Opus 5
f28fc43150
flash-ext-security-oauth-server issues RFC 9068 access tokens (code + PKCE S256, CIMD and DCR clients, RFC 8707 resources, rotating refresh tokens) for resources on the application's own origin. Around it: SecurityExtension resolves a configured origin instead of X-Forwarded-* headers, mechanisms expose schemes() and a route can be restricted to some of them, McpConfig.mechanisms(...) uses that, OIDC bearers must be typed at+jwt, and PublicUrl guards outbound fetches against internal addresses. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
25 lines
1.2 KiB
Markdown
25 lines
1.2 KiB
Markdown
# flash-ext-security-test
|
|
|
|
Test-scope utilities for applications on `flash-ext-security-core`.
|
|
|
|
```java
|
|
FlashTest app = FlashTest.of(flash -> flash.apply(new MyApp()).install(new TestSecurity()));
|
|
|
|
app.request().with(TestSecurity.as(() -> "alice")).get("/me"); // any principal
|
|
app.request().with(TestSecurity.as(new OidcPrincipal(...))).get("/projects"); // a mechanism's own type
|
|
```
|
|
|
|
`OAuthTestClient` drives an application's own authorization server
|
|
([`flash-ext-security-oauth-server`](../../flash-ext-security-oauth-server/docs/README.md)) the way an MCP
|
|
client does — discovery, registration, PKCE, consent, exchange — signing in as any principal:
|
|
|
|
```java
|
|
OAuthTestClient.Tokens tokens = OAuthTestClient.register(app).authorize(() -> "alice");
|
|
app.request().with(tokens.bearer()).post("/mcp");
|
|
```
|
|
|
|
`TestSecurity.as(principal)` hands the principal to the application by reference — `FlashTest`
|
|
serves it in the same JVM — so tests exercise the real `UserResolver`, `RoleResolver` and policies
|
|
with no identity provider running. Tests of the flows themselves use the mechanism's own kit:
|
|
`FakeOidcProvider` and `OidcTokens` in this module for OIDC, a real `POST` for form login.
|