microcks / microcks/microcks-cli
Missing Verification for Automatic OIDC Access Token Refreshing and JWT Expiration Claim Parsing
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 52
- Forks
- 68
- Avg merge
- 6h 54m
- Merged PRs (30d)
- 10
Description
### Describe the bug
* **Location**: [pkg/connectors/microcks_client.go](file:///c:/Users/Hp/microcks-cli/pkg/connectors/microcks_client.go) -> `refreshAuthToken`
* **Detailed Description**:
When you run the CLI for a long time (like keeping it active in the background), the security token it got when you logged in will eventually expire. To prevent commands from failing, we have code that reads the cached security token, parses it to see when it expires, and automatically requests a new one from the server if it's running out of time.
Currently, we have zero tests checking this check-and-refresh logic. If a bug is introduced here, the CLI will suddenly stop working after a while and throw unauthorized errors (like HTTP 401) out of nowhere. We need to make sure the token checks are accurate and that the refresh requests are triggered correctly.
* **Test Requirements**:
* Verify that a valid, fresh token does not trigger a refresh.
* Verify that a token close to expiry or already expired triggers the refresh server call.
* Check that the CLI successfully updates the local configuration file with the new token.
* Make sure the CLI handles cases where the refresh token itself has expired and tells the user to log in again.
#### Simulation Diagram
```mermaid
sequenceDiagram
autonumber
actor Test as Test Runner
participant MC as microcksClient
participant mockKC as Mock Keycloak Server (httptest)
Test->>MC: Trigger refreshAuthToken() with Expired JWT
activate MC
MC->>MC: Parse JWT Claims & Detect Expiration (exp <= now)
Note over MC: Expiration detected. Initiating refresh flow...
MC->>mockKC: POST /protocol/openid-connect/token (refresh_token grant)
activate mockKC
mockKC-->>MC: HTTP 200 OK (New Auth & Refresh Tokens)
deactivate mockKC
MC->>MC: Save new tokens to localconfig YAML file
MC-->>Test: Success (Token Refreshed)
deactivate MC
```
---
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in pkg/connectors/microcks_client.go at refreshAuthToken and inspect how JWT expiration is parsed and how refresh requests are made. Use an httptest mock Keycloak server to cover fresh, near-expiry, expired, and expired-refresh-token cases. Done means the expected refresh behavior is verified and the new tokens are saved to the local configuration YAML, with re-login reported when required.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, cli, testing
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 72/100