offline 스코프 제거, rp_claims 값 표준화

2026-06-11 14:50:26 +09:00
parent f60b15a17b
commit c495e9119b
26 changed files with 1034 additions and 300 deletions
--- a/backend/internal/handler/dev_handler_test.go
+++ b/backend/internal/handler/dev_handler_test.go
@@ -11,6 +11,7 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 	"time"

@@ -571,7 +572,7 @@ func TestUpdateClient_ReservedSystemNameForbidden(t *testing.T) {
 				},
 				"grant_types":                []string{"authorization_code", "refresh_token"},
 				"response_types":             []string{"code"},
-				"scope":                      "openid profile email offline_access",
+				"scope":                      "openid profile email",
 				"token_endpoint_auth_method": "none",
 				"metadata":                   map[string]any{"status": "active"},
 			}), nil
@@ -621,7 +622,7 @@ func TestUpdateClient_PrivateClientAllowedByEditConfigPermission(t *testing.T) {
 				},
 				"grant_types":                []string{"authorization_code", "refresh_token"},
 				"response_types":             []string{"code"},
-				"scope":                      "openid profile email offline_access",
+				"scope":                      "openid profile email",
 				"token_endpoint_auth_method": "client_secret_basic",
 				"metadata": map[string]any{
 					"status":    "active",
@@ -638,7 +639,7 @@ func TestUpdateClient_PrivateClientAllowedByEditConfigPermission(t *testing.T) {
 				},
 				"grant_types":                []string{"authorization_code", "refresh_token"},
 				"response_types":             []string{"code"},
-				"scope":                      "openid profile email offline_access",
+				"scope":                      "openid profile email",
 				"token_endpoint_auth_method": "client_secret_basic",
 				"metadata": map[string]any{
 					"status":    "active",
@@ -700,7 +701,7 @@ func TestUpdateClient_ManagedRPAdminRequiresEditConfigPermission(t *testing.T) {
 				},
 				"grant_types":                []string{"authorization_code", "refresh_token"},
 				"response_types":             []string{"code"},
-				"scope":                      "openid profile email offline_access",
+				"scope":                      "openid profile email",
 				"token_endpoint_auth_method": "none",
 				"metadata": map[string]any{
 					"status":    "active",
@@ -768,7 +769,7 @@ func TestUpdateClient_SuperAdminBypassesEditConfigPermission(t *testing.T) {
 				},
 				"grant_types":                []string{"authorization_code", "refresh_token"},
 				"response_types":             []string{"code"},
-				"scope":                      "openid profile email offline_access",
+				"scope":                      "openid profile email",
 				"token_endpoint_auth_method": "client_secret_basic",
 				"metadata": map[string]any{
 					"status":    "active",
@@ -785,7 +786,7 @@ func TestUpdateClient_SuperAdminBypassesEditConfigPermission(t *testing.T) {
 				},
 				"grant_types":                []string{"authorization_code", "refresh_token"},
 				"response_types":             []string{"code"},
-				"scope":                      "openid profile email offline_access",
+				"scope":                      "openid profile email",
 				"token_endpoint_auth_method": "client_secret_basic",
 				"metadata": map[string]any{
 					"status":    "active",
@@ -2176,6 +2177,131 @@ func TestCreateClient_HeadlessLoginPayloadMapping(t *testing.T) {
 	assert.False(t, hasRequestObjectAlg)
 }

+func TestCreateClient_StripsOfflineScopesAndKeepsRefreshTokenGrant(t *testing.T) {
+	var captured domain.HydraClient
+
+	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
+		if r.Method == http.MethodPost && r.URL.Path == "/clients" {
+			body, err := io.ReadAll(r.Body)
+			assert.NoError(t, err)
+			err = json.Unmarshal(body, &captured)
+			assert.NoError(t, err)
+
+			return httpJSONAny(r, http.StatusCreated, map[string]any{
+				"client_id":                  captured.ClientID,
+				"client_name":                captured.ClientName,
+				"redirect_uris":              captured.RedirectURIs,
+				"grant_types":                captured.GrantTypes,
+				"response_types":             captured.ResponseTypes,
+				"scope":                      captured.Scope,
+				"token_endpoint_auth_method": captured.TokenEndpointAuthMethod,
+				"skip_consent":               captured.SkipConsent,
+				"metadata":                   captured.Metadata,
+			}), nil
+		}
+		return httpJSONAny(r, http.StatusNotFound, nil), nil
+	})
+
+	h := &DevHandler{
+		Hydra: &service.HydraAdminService{
+			AdminURL:   "http://hydra.test",
+			PublicURL:  "http://hydra.public",
+			HTTPClient: &http.Client{Transport: transport},
+		},
+		Keto: new(devMockKetoService),
+	}
+
+	app := fiber.New()
+	app.Use(func(c *fiber.Ctx) error {
+		c.Locals("user_profile", &domain.UserProfileResponse{ID: "test-user", Role: domain.RoleSuperAdmin})
+		return c.Next()
+	})
+	app.Post("/api/v1/dev/clients", h.CreateClient)
+
+	body, _ := json.Marshal(map[string]any{
+		"name":         "Refresh Token App",
+		"type":         "pkce",
+		"redirectUris": []string{"https://rp.example.com/callback"},
+		"scopes":       []string{"openid", "offline", "profile", "offline_access", "email"},
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/dev/clients", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, _ := app.Test(req, -1)
+	assert.Equal(t, http.StatusCreated, resp.StatusCode)
+	assert.Equal(t, "openid profile email", captured.Scope)
+	assert.NotContains(t, strings.Fields(captured.Scope), "offline")
+	assert.NotContains(t, strings.Fields(captured.Scope), "offline_access")
+	assert.Contains(t, captured.GrantTypes, "refresh_token")
+}
+
+func TestUpdateClient_StripsStoredOfflineScopesAndKeepsRefreshTokenGrant(t *testing.T) {
+	var captured domain.HydraClient
+
+	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
+		if r.Method == http.MethodGet && r.URL.Path == "/clients/client-refresh" {
+			return httpJSONAny(r, http.StatusOK, map[string]any{
+				"client_id":                  "client-refresh",
+				"client_name":                "Refresh Token App",
+				"redirect_uris":              []string{"https://rp.example.com/callback"},
+				"grant_types":                []string{"authorization_code", "refresh_token"},
+				"response_types":             []string{"code"},
+				"scope":                      "openid offline profile offline_access email",
+				"token_endpoint_auth_method": "none",
+				"metadata":                   map[string]any{"status": "active"},
+			}), nil
+		}
+		if r.Method == http.MethodPut && r.URL.Path == "/clients/client-refresh" {
+			body, err := io.ReadAll(r.Body)
+			assert.NoError(t, err)
+			err = json.Unmarshal(body, &captured)
+			assert.NoError(t, err)
+
+			return httpJSONAny(r, http.StatusOK, map[string]any{
+				"client_id":                  captured.ClientID,
+				"client_name":                captured.ClientName,
+				"redirect_uris":              captured.RedirectURIs,
+				"grant_types":                captured.GrantTypes,
+				"response_types":             captured.ResponseTypes,
+				"scope":                      captured.Scope,
+				"token_endpoint_auth_method": captured.TokenEndpointAuthMethod,
+				"skip_consent":               captured.SkipConsent,
+				"metadata":                   captured.Metadata,
+			}), nil
+		}
+		return httpJSONAny(r, http.StatusNotFound, nil), nil
+	})
+
+	h := &DevHandler{
+		Hydra: &service.HydraAdminService{
+			AdminURL:   "http://hydra.test",
+			PublicURL:  "http://hydra.public",
+			HTTPClient: &http.Client{Transport: transport},
+		},
+		Keto: new(devMockKetoService),
+	}
+
+	app := fiber.New()
+	app.Use(func(c *fiber.Ctx) error {
+		c.Locals("user_profile", &domain.UserProfileResponse{ID: "test-user", Role: domain.RoleSuperAdmin})
+		return c.Next()
+	})
+	app.Put("/api/v1/dev/clients/:id", h.UpdateClient)
+
+	body, _ := json.Marshal(map[string]any{
+		"name": "Refresh Token App Updated",
+	})
+	req := httptest.NewRequest(http.MethodPut, "/api/v1/dev/clients/client-refresh", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, _ := app.Test(req, -1)
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.Equal(t, "openid profile email", captured.Scope)
+	assert.NotContains(t, strings.Fields(captured.Scope), "offline")
+	assert.NotContains(t, strings.Fields(captured.Scope), "offline_access")
+	assert.Contains(t, captured.GrantTypes, "refresh_token")
+}
+
 func TestCreateClient_DefaultsSkipConsentToTrue(t *testing.T) {
 	var captured domain.HydraClient