microcks / microcks/microcks-cli

Missing Verification for Automatic OIDC Access Token Refreshing and JWT Expiration Claim Parsing

Open
#486 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

stale
Dominant language
Go
Stars
52
Forks
68
Avg merge
6h 54m
Merged PRs (30d)
10

Description

### Describe the bug

* **Location**: [pkg/connectors/microcks_client.go](file:///c:/Users/Hp/microcks-cli/pkg/connectors/microcks_client.go) -> `refreshAuthToken`
* **Detailed Description**:
When you run the CLI for a long time (like keeping it active in the background), the security token it got when you logged in will eventually expire. To prevent commands from failing, we have code that reads the cached security token, parses it to see when it expires, and automatically requests a new one from the server if it's running out of time.

Currently, we have zero tests checking this check-and-refresh logic. If a bug is introduced here, the CLI will suddenly stop working after a while and throw unauthorized errors (like HTTP 401) out of nowhere. We need to make sure the token checks are accurate and that the refresh requests are triggered correctly.
* **Test Requirements**:
* Verify that a valid, fresh token does not trigger a refresh.
* Verify that a token close to expiry or already expired triggers the refresh server call.
* Check that the CLI successfully updates the local configuration file with the new token.
* Make sure the CLI handles cases where the refresh token itself has expired and tells the user to log in again.

#### Simulation Diagram
```mermaid
sequenceDiagram
autonumber
actor Test as Test Runner
participant MC as microcksClient
participant mockKC as Mock Keycloak Server (httptest)

Test->>MC: Trigger refreshAuthToken() with Expired JWT
activate MC
MC->>MC: Parse JWT Claims & Detect Expiration (exp <= now)
Note over MC: Expiration detected. Initiating refresh flow...
MC->>mockKC: POST /protocol/openid-connect/token (refresh_token grant)
activate mockKC
mockKC-->>MC: HTTP 200 OK (New Auth & Refresh Tokens)
deactivate mockKC
MC->>MC: Save new tokens to localconfig YAML file
MC-->>Test: Success (Token Refreshed)
deactivate MC
```

---

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in pkg/connectors/microcks_client.go at refreshAuthToken and inspect how JWT expiration is parsed and how refresh requests are made. Use an httptest mock Keycloak server to cover fresh, near-expiry, expired, and expired-refresh-token cases. Done means the expected refresh behavior is verified and the new tokens are saved to the local configuration YAML, with re-login reported when required.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication, cli, testing
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.