add more tests

Author: ndyakov

entraid.go

@@ -1,10 +1,12 @@
 package entraid
 
+import "time"
+
 const (
 	DefaultExpirationRefreshRatio        = 0.7
 	DefaultRetryOptionsMaxAttempts       = 3
 	DefaultRetryOptionsInitialDelayMs    = 1000
 	DefaultRetryOptionsBackoffMultiplier = 2.0
 	DefaultRetryOptionsMaxDelayMs        = 10000
-	MinTokenTTL                          = 60 * 1000 // 1 minute
+	MinTokenTTL                          = 5 * time.Minute
 )

token_manager.go

@@ -90,8 +90,8 @@ var defaultIdentityProviderResponseParser IdentityProviderResponseParserFunc = f
 	switch response.Type() {
 	case ResponseTypeAuthResult:
 		authResult := response.AuthResult()
-		if authResult.ExpiresOn.Before(time.Now()) {
-			return nil, fmt.Errorf("auth result expired or invalid")
+		if authResult.ExpiresOn.IsZero() {
+			return nil, fmt.Errorf("auth result invalid")
 		}
 		rawToken = authResult.IDToken.RawToken
 		username = authResult.IDToken.Oid
@@ -130,12 +130,16 @@ var defaultIdentityProviderResponseParser IdentityProviderResponseParserFunc = f
 		return nil, fmt.Errorf("unknown response type: %s", response.Type())
 	}
 
+	expiresOn = expiresOn.UTC()
+
 	if expiresOn.IsZero() {
 		return nil, fmt.Errorf("expires on is zero")
 	}
+
 	if expiresOn.Before(time.Now()) {
 		return nil, fmt.Errorf("expires on is in the past")
 	}
+
 	if time.Until(expiresOn) < MinTokenTTL {
 		return nil, fmt.Errorf("expires on is less than minimum token TTL which is %d", MinTokenTTL)
 	}

token_manager_test.go

@@ -459,4 +459,37 @@ func TestDefaultIdentityProviderResponseParser(t *testing.T) {
 		assert.Error(t, err)
 		assert.Nil(t, token)
 	})
+	t.Run("Default IdentityProviderResponseParser with expired token", func(t *testing.T) {
+		authResult := &public.AuthResult{
+			ExpiresOn: time.Now().Add(-time.Hour).UTC(),
+		}
+		idpResponse, err := NewIDPResponse(ResponseTypeAuthResult,
+			authResult)
+		assert.NoError(t, err)
+		token, err := defaultIdentityProviderResponseParser(idpResponse)
+		assert.Error(t, err)
+		assert.Nil(t, token)
+	})
+	t.Run("Default IdentityProviderResponseParser with token that will expire soon", func(t *testing.T) {
+		authResult := &public.AuthResult{
+			ExpiresOn: time.Now().Add(MinTokenTTL).Add(-time.Minute).UTC(),
+		}
+		idpResponse, err := NewIDPResponse(ResponseTypeAuthResult,
+			authResult)
+		assert.NoError(t, err)
+		token, err := defaultIdentityProviderResponseParser(idpResponse)
+		assert.Error(t, err)
+		assert.Nil(t, token)
+	})
+	t.Run("Default IdentityProviderResponseParser with token that expired", func(t *testing.T) {
+		authResult := &public.AuthResult{
+			ExpiresOn: time.Now().Add(-time.Hour).UTC(),
+		}
+		idpResponse, err := NewIDPResponse(ResponseTypeAuthResult,
+			authResult)
+		assert.NoError(t, err)
+		token, err := defaultIdentityProviderResponseParser(idpResponse)
+		assert.Error(t, err)
+		assert.Nil(t, token)
+	})
 }