more discovery test

packages/backend/src/server/oauth/OAuth2ProviderService.ts

@@ -511,7 +511,7 @@ export class OAuth2ProviderService {
 
 				const clientUrl = validateClientId(clientId);
 
-				if (process.env.NODE_ENV !== 'test') {
+				if (process.env.NODE_ENV !== 'test' || process.env.MISSKEY_TEST_DISALLOW_LOOPBACK === '1') {
 					const lookup = await dns.lookup(clientUrl.hostname);
 					if (ipaddr.parse(lookup.address).range() === 'loopback') {
 						throw new Error('client_id unexpectedly resolves to loopback IP.');

packages/backend/test/e2e/oauth.ts

@@ -29,7 +29,7 @@ function getClient(): AuthorizationCode<'client_id'> {
 	});
 }
 
-function getMeta(html: string): { transactionId: string | undefined, clientName: string | undefined } | undefined {
+function getMeta(html: string): { transactionId: string | undefined, clientName: string | undefined } {
 	const fragment = JSDOM.fragment(html);
 	return {
 		transactionId: fragment.querySelector<HTMLMetaElement>('meta[name="misskey:oauth:transaction-id"]')?.content,
@@ -68,6 +68,11 @@ describe('OAuth', () => {
 
 	beforeAll(async () => {
 		app = await startServer();
+		alice = await signup({ username: 'alice' });
+	}, 1000 * 60 * 2);
+
+	beforeEach(async () => {
+		process.env.MISSKEY_TEST_DISALLOW_LOOPBACK = '';
 		fastify = Fastify();
 		fastify.get('/', async (request, reply) => {
 			reply.send(`
@@ -77,12 +82,13 @@ describe('OAuth', () => {
 			`);
 		});
 		await fastify.listen({ port: clientPort });
-
+	});
-		alice = await signup({ username: 'alice' });
-	}, 1000 * 60 * 2);
 
 	afterAll(async () => {
 		await app.close();
+	});
+
+	afterEach(async () => {
 		await fastify.close();
 	});
 
@@ -104,7 +110,7 @@ describe('OAuth', () => {
 
 		const meta = getMeta(await response.text());
 		assert.strictEqual(typeof meta.transactionId, 'string');
-		assert.strictEqual(meta?.clientName, 'Misklient');
+		assert.strictEqual(meta.clientName, 'Misklient');
 
 		const decisionResponse = await fetchDecision(cookie!, meta.transactionId!, alice);
 		assert.strictEqual(decisionResponse.status, 302);
@@ -602,6 +608,7 @@ describe('OAuth', () => {
 	});
 
 	describe('Client Information Discovery', () => {
+		describe('Redirection', () => {
 			test('Read HTTP header', async () => {
 				await fastify.close();
 
@@ -675,7 +682,6 @@ describe('OAuth', () => {
 					code_challenge: 'code',
 					code_challenge_method: 'S256',
 				}));
-			console.log(await response.text());
 				assert.strictEqual(response.status, 200);
 			});
 
@@ -731,9 +737,46 @@ describe('OAuth', () => {
 			});
 		});
 
+		test('Disallow loopback', async () => {
+			process.env.MISSKEY_TEST_DISALLOW_LOOPBACK = '1';
+
+			const client = getClient();
+			const response = await fetch(client.authorizeURL({
+				redirect_uri,
+				scope: 'write:notes',
+				state: 'state',
+				code_challenge: 'code',
+				code_challenge_method: 'S256',
+			}));
+			// TODO: status code
+			assert.strictEqual(response.status, 500);
+		});
+
+		test('Missing name', async () => {
+			await fastify.close();
+
+			fastify = Fastify();
+			fastify.get('/', async (request, reply) => {
+				reply.header('Link', '</redirect>; rel="redirect_uri"');
+				reply.send();
+			});
+			await fastify.listen({ port: clientPort });
+
+			const client = getClient();
+
+			const response = await fetch(client.authorizeURL({
+				redirect_uri,
+				scope: 'write:notes',
+				state: 'state',
+				code_challenge: 'code',
+				code_challenge_method: 'S256',
+			}));
+			assert.strictEqual(response.status, 200);
+			assert.strictEqual(getMeta(await response.text()).clientName, `http://127.0.0.1:${clientPort}/`);
+		});
+	});
+
 	// TODO: authorizing two users concurrently
 
 	// TODO: Error format required by OAuth spec
-
-	// TODO: Client Information Discovery (use http header, loopback check, missing name or redirection uri)
 });