Page MenuHomePhabricator

Improve test coverage for OpenID Connect (OIDC) functionality
Open, Needs TriagePublic

Description

Special:MWOAuth/identify and rest.php/oauth2/resource/profile are mechanisms to identify a user in OAuth1 and OAuth2, respectively.

For OAuth2, the corresponding class for the REST API endpoint is: Resource. Integration tests would be written to cover the special page case for OAuth1 and the REST Handler case for OAuth2. In addition, the backend logic that interacts with the DB would need to be tested appropriately (using unit tests for self-contained logic).

We already have a way to write integration tests for REST API handlers in MediaWiki using the HandlerTestTrait trait. Some good examples can be found at: https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/0aa7ce021b7904ed4f63f941f307f0143a32d0bf/tests/phpunit/integration/includes/Rest/Handler. And for special pages, use SpecialPageTestBase.

Impact

Event Timeline

The REST API endpoint for OIDC is oauth2/resource/profile. The same handler also deals with oauth2/resource/scope so I guess we could add a test for that as well, but I don't think that API is used at all.