1 files changed, 124 insertions, 0 deletions
diff --git a/tests/oauth2/rfc6749/grant_types/test_authorization_code.py b/tests/oauth2/rfc6749/grant_types/test_authorization_code.py
index acb23ac..00e2b6d 100644
--- a/tests/oauth2/rfc6749/grant_types/test_authorization_code.py
+++ b/tests/oauth2/rfc6749/grant_types/test_authorization_code.py
@@ -8,6 +8,7 @@ import mock
 from oauthlib.common import Request
 from oauthlib.oauth2.rfc6749 import errors
 from oauthlib.oauth2.rfc6749.grant_types import AuthorizationCodeGrant
+from oauthlib.oauth2.rfc6749.grant_types import authorization_code
 from oauthlib.oauth2.rfc6749.tokens import BearerToken
 
 from ....unittest import TestCase
@@ -27,6 +28,8 @@ class AuthorizationCodeGrantTest(TestCase):
         self.request.redirect_uri = 'https://a.b/cb'
 
         self.mock_validator = mock.MagicMock()
+        self.mock_validator.is_pkce_required.return_value = False
+        self.mock_validator.get_code_challenge.return_value = None
         self.mock_validator.authenticate_client.side_effect = self.set_client
         self.auth = AuthorizationCodeGrant(request_validator=self.mock_validator)
 
@@ -200,3 +203,124 @@ class AuthorizationCodeGrantTest(TestCase):
         self.mock_validator.confirm_redirect_uri.return_value = False
         self.assertRaises(errors.MismatchingRedirectURIError,
                           self.auth.validate_token_request, self.request)
+
+    # PKCE validate_authorization_request
+    def test_pkce_challenge_missing(self):
+        self.mock_validator.is_pkce_required.return_value = True
+        self.assertRaises(errors.MissingCodeChallengeError,
+                          self.auth.validate_authorization_request, self.request)
+
+    def test_pkce_default_method(self):
+        for required in [True, False]:
+            self.mock_validator.is_pkce_required.return_value = required
+            self.request.code_challenge = "present"
+            _, ri = self.auth.validate_authorization_request(self.request)
+            self.assertIsNotNone(ri["request"].code_challenge_method)
+            self.assertEqual(ri["request"].code_challenge_method, "plain")
+
+    def test_pkce_wrong_method(self):
+        for required in [True, False]:
+            self.mock_validator.is_pkce_required.return_value = required
+            self.request.code_challenge = "present"
+            self.request.code_challenge_method = "foobar"
+            self.assertRaises(errors.UnsupportedCodeChallengeMethodError,
+                              self.auth.validate_authorization_request, self.request)
+
+    # PKCE validate_token_request
+    def test_pkce_verifier_missing(self):
+        self.mock_validator.is_pkce_required.return_value = True
+        self.assertRaises(errors.MissingCodeVerifierError,
+                          self.auth.validate_token_request, self.request)
+
+    # PKCE validate_token_request
+    def test_pkce_required_verifier_missing_challenge_missing(self):
+        self.mock_validator.is_pkce_required.return_value = True
+        self.request.code_verifier = None
+        self.mock_validator.get_code_challenge.return_value = None
+        self.assertRaises(errors.MissingCodeVerifierError,
+                          self.auth.validate_token_request, self.request)
+
+    def test_pkce_required_verifier_missing_challenge_valid(self):
+        self.mock_validator.is_pkce_required.return_value = True
+        self.request.code_verifier = None
+        self.mock_validator.get_code_challenge.return_value = "foo"
+        self.assertRaises(errors.MissingCodeVerifierError,
+                          self.auth.validate_token_request, self.request)
+
+    def test_pkce_required_verifier_valid_challenge_missing(self):
+        self.mock_validator.is_pkce_required.return_value = True
+        self.request.code_verifier = "foobar"
+        self.mock_validator.get_code_challenge.return_value = None
+        self.assertRaises(errors.InvalidGrantError,
+                          self.auth.validate_token_request, self.request)
+
+    def test_pkce_required_verifier_valid_challenge_valid_method_valid(self):
+        self.mock_validator.is_pkce_required.return_value = True
+        self.request.code_verifier = "foobar"
+        self.mock_validator.get_code_challenge.return_value = "foobar"
+        self.mock_validator.get_code_challenge_method.return_value = "plain"
+        self.auth.validate_token_request(self.request)
+
+    def test_pkce_required_verifier_invalid_challenge_valid_method_valid(self):
+        self.mock_validator.is_pkce_required.return_value = True
+        self.request.code_verifier = "foobar"
+        self.mock_validator.get_code_challenge.return_value = "raboof"
+        self.mock_validator.get_code_challenge_method.return_value = "plain"
+        self.assertRaises(errors.InvalidGrantError,
+                          self.auth.validate_token_request, self.request)
+
+    def test_pkce_required_verifier_valid_challenge_valid_method_wrong(self):
+        self.mock_validator.is_pkce_required.return_value = True
+        self.request.code_verifier = "present"
+        self.mock_validator.get_code_challenge.return_value = "foobar"
+        self.mock_validator.get_code_challenge_method.return_value = "cryptic_method"
+        self.assertRaises(errors.ServerError,
+                          self.auth.validate_token_request, self.request)
+
+    def test_pkce_verifier_valid_challenge_valid_method_missing(self):
+        self.mock_validator.is_pkce_required.return_value = True
+        self.request.code_verifier = "present"
+        self.mock_validator.get_code_challenge.return_value = "foobar"
+        self.mock_validator.get_code_challenge_method.return_value = None
+        self.assertRaises(errors.InvalidGrantError,
+                          self.auth.validate_token_request, self.request)
+
+    def test_pkce_optional_verifier_valid_challenge_missing(self):
+        self.mock_validator.is_pkce_required.return_value = False
+        self.request.code_verifier = "present"
+        self.mock_validator.get_code_challenge.return_value = None
+        self.auth.validate_token_request(self.request)
+
+    def test_pkce_optional_verifier_missing_challenge_valid(self):
+        self.mock_validator.is_pkce_required.return_value = False
+        self.request.code_verifier = None
+        self.mock_validator.get_code_challenge.return_value = "foobar"
+        self.assertRaises(errors.MissingCodeVerifierError,
+                          self.auth.validate_token_request, self.request)
+
+    # PKCE functions
+    def test_wrong_code_challenge_method_plain(self):
+        self.assertFalse(authorization_code.code_challenge_method_plain("foo", "bar"))
+
+    def test_correct_code_challenge_method_plain(self):
+        self.assertTrue(authorization_code.code_challenge_method_plain("foo", "foo"))
+
+    def test_wrong_code_challenge_method_s256(self):
+        self.assertFalse(authorization_code.code_challenge_method_s256("foo", "bar"))
+
+    def test_correct_code_challenge_method_s256(self):
+        # "abcd" as verifier gives a '+' to base64
+        self.assertTrue(
+            authorization_code.code_challenge_method_s256("abcd",
+                                                          "iNQmb9TmM40TuEX88olXnSCciXgjuSF9o-Fhk28DFYk")
+        )
+        # "/" as verifier gives a '/' and '+' to base64
+        self.assertTrue(
+            authorization_code.code_challenge_method_s256("/",
+                                                          "il7asoJjJEMhngUeSt4tHVu8Zxx4EFG_FDeJfL3-oPE")
+        )
+        # Example from PKCE RFCE
+        self.assertTrue(
+            authorization_code.code_challenge_method_s256("dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk",
+                                                          "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM")
+        )