Change Details

Essential OAuth functionality should have end-to-end tests: * proposing a new application (OAuth 1, OAuth 2; owner-only, normal) * authorizing an application (OAuth 1, OAuth 2); there are lots of variations (/authorize vs /authenticate for OAuth 1; refresh token, PKCE for OAuth 2), not sure how much we should try to cover * making an API request with an authorized application * using the identify endpoint (OAuth 1, OAuth 2) For the authorizing test, we might want to build something like [https://oauth-hello-world.toolforge.org/ oauth-hello-world] into the extension, only enabled in CI mode. Or we could use a NodeJS test script to both be the OAuth app and simulate the browser. The others are straightforward, we use `createOAuthConsumer.php` to register the app (we'd need to do {T274713} for the owner-only tests), override the secret key in the DB or just use RSA, the API and identify requests can use the PHP integration test framework (OAuth 2 has a couple such tests already), app proposal is a normal Selenium test.

Essential OAuth functionality should have end-to-end tests: * proposing a new application (OAuth 1, OAuth 2; owner-only, normal) * authorizing an application (OAuth 1, OAuth 2); there are lots of variations (/authorize vs /authenticate for OAuth 1; refresh token, PKCE for OAuth 2), not sure how much we should try to cover * making an API request with an authorized application * using the identify endpoint (OAuth 1, OAuth 2) For the authorizing test, we might want to build something like [[https://oauth-hello-world.toolforge.org/|oauth-hello-world]] into the extension, only enabled in CI mode. Or we could use a NodeJS test script to both be the OAuth app and simulate the browser. The others are straightforward, we use `createOAuthConsumer.php` to register the app (we'd need to do {T274713} for the owner-only tests), override the secret key in the DB or just use RSA, the API and identify requests can use the PHP integration test framework (OAuth 2 has a couple such tests already), app proposal is a normal Selenium test.

Essential OAuth functionality should have end-to-end tests: * proposing a new application (OAuth 1, OAuth 2; owner-only, normal) * authorizing an application (OAuth 1, OAuth 2); there are lots of variations (/authorize vs /authenticate for OAuth 1; refresh token, PKCE for OAuth 2), not sure how much we should try to cover * making an API request with an authorized application * using the identify endpoint (OAuth 1, OAuth 2) For the authorizing test, we might want to build something like [[https://oauth-hello-world.toolforge.org/ |oauth-hello-world]] into the extension, only enabled in CI mode. Or we could use a NodeJS test script to both be the OAuth app and simulate the browser. The others are straightforward, we use `createOAuthConsumer.php` to register the app (we'd need to do {T274713} for the owner-only tests), override the secret key in the DB or just use RSA, the API and identify requests can use the PHP integration test framework (OAuth 2 has a couple such tests already), app proposal is a normal Selenium test.