From e844878ba7862a4d774e4148f58bc423242f67ea Mon Sep 17 00:00:00 2001 From: John Coffey Date: Fri, 18 Sep 2026 22:49:27 -0700 Subject: [PATCH] Tests: stabilize the OIDC suite with five times upstream's token lifetimes Expiry counts whole seconds, so a 1s access token, code or device code could lapse before a debug build's next request: 4 of 8 baseline runs failed at six different points. Lifetimes are now 5s (tokens, codes), 15s (refresh) and 10s (renewal), with the expiry checks' sleeps scaled to match. OIDC then passed in 12 of 12 runs. --- tests/src/system/oidc.rs | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/tests/src/system/oidc.rs b/tests/src/system/oidc.rs index 41d783d..e216c3d 100644 --- a/tests/src/system/oidc.rs +++ b/tests/src/system/oidc.rs @@ -93,13 +93,15 @@ pub async fn test(test: &mut TestServer) { let admin = test.account("admin@example.org"); // Set test parameters + // inbuxa: five times upstream's lifetimes. Expiry counts whole seconds, so + // a 1s token could lapse before a debug build's next request. let settings = OidcProvider { - access_token_expiry: registry::schema::prelude::Duration::from_millis(1000), - auth_code_expiry: registry::schema::prelude::Duration::from_millis(1000), + access_token_expiry: registry::schema::prelude::Duration::from_millis(5000), + auth_code_expiry: registry::schema::prelude::Duration::from_millis(5000), auth_code_max_attempts: 1, - user_code_expiry: registry::schema::prelude::Duration::from_millis(1000), - refresh_token_expiry: registry::schema::prelude::Duration::from_millis(3000), - refresh_token_renewal: registry::schema::prelude::Duration::from_millis(2000), + user_code_expiry: registry::schema::prelude::Duration::from_millis(5000), + refresh_token_expiry: registry::schema::prelude::Duration::from_millis(15000), + refresh_token_renewal: registry::schema::prelude::Duration::from_millis(10000), anonymous_client_registration: true, require_client_registration: true, signature_algorithm: JwtSignatureAlgorithm::Rs256, @@ -722,7 +724,7 @@ pub async fn test(test: &mut TestServer) { ); // Let the code expire and make sure it's invalidated - tokio::time::sleep(Duration::from_secs(1)).await; + tokio::time::sleep(Duration::from_secs(6)).await; // inbuxa: past the 5s code assert_eq!( http.post::( "/api/auth", @@ -835,19 +837,19 @@ pub async fn test(test: &mut TestServer) { ); // Wait 1 second and make sure the access token expired - tokio::time::sleep(Duration::from_secs(1)).await; + tokio::time::sleep(Duration::from_secs(6)).await; // inbuxa: past the 5s token assert_unauthorized("https://127.0.0.1:8899", &token).await; // Wait another second for the refresh token to be about to expire // and expect a new refresh token - tokio::time::sleep(Duration::from_secs(1)).await; + tokio::time::sleep(Duration::from_secs(2)).await; // inbuxa: ~8s in, inside renewal let (_, new_refresh_token, _) = unwrap_token_response(post(&metadata.token_endpoint, &refresh_params).await); //println!("New refresh token: {:?}", new_refresh_token); assert_ne!(new_refresh_token, None); // Wait another second and make sure the refresh token expired - tokio::time::sleep(Duration::from_secs(1)).await; + tokio::time::sleep(Duration::from_secs(8)).await; // inbuxa: ~16s in, past 15s assert_eq!( post::(&metadata.token_endpoint, &refresh_params).await, TokenResponse::Error {