69 lines
2.2 KiB
JavaScript
69 lines
2.2 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import { createHash, randomBytes } from "node:crypto";
|
|
import { chromium } from "playwright-core";
|
|
|
|
const keycloakUrl = process.env.KEYCLOAK_URL ?? "http://localhost:8080";
|
|
const password = process.env.MOCK_GOOGLE_USER_PASSWORD;
|
|
assert.ok(password);
|
|
|
|
const verifier = randomBytes(48).toString("base64url");
|
|
const challenge = createHash("sha256").update(verifier).digest("base64url");
|
|
const redirectUri = "http://localhost:8088/";
|
|
|
|
const browser = await chromium.launch({
|
|
executablePath: process.env.CHROME_BIN ?? "/usr/bin/google-chrome",
|
|
headless: true,
|
|
args: ["--no-sandbox"],
|
|
});
|
|
|
|
try {
|
|
const page = await browser.newPage();
|
|
const authorizationUrl = new URL(
|
|
`${keycloakUrl}/realms/keycloak-patterns/protocol/openid-connect/auth`,
|
|
);
|
|
authorizationUrl.search = new URLSearchParams({
|
|
client_id: "spa-public",
|
|
redirect_uri: redirectUri,
|
|
response_type: "code",
|
|
scope: "openid profile email",
|
|
state: crypto.randomUUID(),
|
|
nonce: crypto.randomUUID(),
|
|
code_challenge: challenge,
|
|
code_challenge_method: "S256",
|
|
kc_idp_hint: "mock-google",
|
|
prompt: "login",
|
|
});
|
|
|
|
await page.goto(authorizationUrl.toString());
|
|
await page.waitForURL(/\/realms\/mock-google\//u);
|
|
await page.locator("#username").fill("mock-new-user");
|
|
await page.locator("#password").fill(password);
|
|
await page.locator("#kc-login").click();
|
|
await page.waitForURL(/localhost:8088\/\?.*code=/u);
|
|
|
|
const code = new URL(page.url()).searchParams.get("code");
|
|
assert.ok(code);
|
|
const response = await fetch(
|
|
`${keycloakUrl}/realms/keycloak-patterns/protocol/openid-connect/token`,
|
|
{
|
|
method: "POST",
|
|
body: new URLSearchParams({
|
|
grant_type: "authorization_code",
|
|
client_id: "spa-public",
|
|
redirect_uri: redirectUri,
|
|
code,
|
|
code_verifier: verifier,
|
|
}),
|
|
},
|
|
);
|
|
assert.equal(response.status, 200);
|
|
const tokens = await response.json();
|
|
const payload = JSON.parse(
|
|
Buffer.from(tokens.access_token.split(".")[1], "base64url").toString(),
|
|
);
|
|
assert.ok(payload.realm_access.roles.includes("employee-role"));
|
|
console.log("Claim-to-role verified: hd=example.test -> employee-role");
|
|
} finally {
|
|
await browser.close();
|
|
}
|