Testing: Add edge case tests for OAuth2 flows #42
Description
Description
As identified in PR #32 review, we should add comprehensive edge case testing for OAuth2 flows including token expiration scenarios, concurrent flows, and clock skew.
Test Scenarios to Add
1. Token Expiration Edge Cases
def test_token_expires_exactly_at_buffer():
'''Test behavior when token expires exactly at buffer time'''
def test_token_already_expired():
'''Test handling of already expired tokens'''
def test_token_without_expiry():
'''Test tokens that don't include expiry time'''
def test_very_short_lived_token():
'''Test tokens with < 60 second lifetime'''2. Concurrent OAuth2 Flows
async def test_multiple_concurrent_auth_flows():
'''Test multiple users authenticating simultaneously'''
async def test_concurrent_token_refresh():
'''Test race condition during token refresh'''
def test_state_parameter_uniqueness():
'''Ensure state parameters are unique across flows'''3. Clock Skew Scenarios
def test_server_clock_ahead():
'''Test when server clock is ahead of client'''
def test_server_clock_behind():
'''Test when server clock is behind client'''
def test_timezone_handling():
'''Test token expiry across timezones'''4. Error Recovery
def test_network_failure_during_token_exchange():
'''Test handling of network errors'''
def test_invalid_callback_data():
'''Test malformed callback parameters'''
def test_csrf_attack_prevention():
'''Test state parameter validation'''5. Callback Server Edge Cases
def test_port_already_in_use():
'''Test when callback port is occupied'''
def test_callback_timeout():
'''Test when user doesn't complete auth'''
def test_multiple_callbacks():
'''Test handling of duplicate callbacks'''Implementation Tools
pytest-asynciofor async test supportfreezegunfor time manipulationpytest-timeoutfor timeout testing- Mock OAuth2 server for controlled testing
Test Data Requirements
- Various token lifetime scenarios
- Different error responses
- Edge case timestamps
Success Criteria
- 100% code coverage for OAuth2 module
- All edge cases documented and tested
- Clear error messages for each failure mode
References
- PR Release v0.2.0b1 - First Beta Release #32 review feedback
- OAuth2 security considerations
- Common OAuth2 implementation pitfalls