Subversion Repositories cheapmusic

<?php

/*

 * Copyright 2010 Google Inc.

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *     http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

namespace Google\Auth\Tests;

use Google\Auth\OAuth2;

use GuzzleHttp\Psr7;

use GuzzleHttp\Psr7\Response;

class OAuth2AuthorizationUriTest extends \PHPUnit_Framework_TestCase

{

    private $minimal = [

        'authorizationUri' => 'https://accounts.test.org/insecure/url',

        'redirectUri' => 'https://accounts.test.org/redirect/url',

        'clientId' => 'aClientID',

    ];

    /**

     * @expectedException InvalidArgumentException

     */

    public function testIsNullIfAuthorizationUriIsNull()

    {

        $o = new OAuth2([]);

        $this->assertNull($o->buildFullAuthorizationUri());

    }

    /**

     * @expectedException InvalidArgumentException

     */

    public function testRequiresTheClientId()

    {

        $o = new OAuth2([

            'authorizationUri' => 'https://accounts.test.org/auth/url',

            'redirectUri' => 'https://accounts.test.org/redirect/url',

        ]);

        $o->buildFullAuthorizationUri();

    }

    /**

     * @expectedException InvalidArgumentException

     */

    public function testRequiresTheRedirectUri()

    {

        $o = new OAuth2([

            'authorizationUri' => 'https://accounts.test.org/auth/url',

            'clientId' => 'aClientID',

        ]);

        $o->buildFullAuthorizationUri();

    }

    /**

     * @expectedException InvalidArgumentException

     */

    public function testCannotHavePromptAndApprovalPrompt()

    {

        $o = new OAuth2([

            'authorizationUri' => 'https://accounts.test.org/auth/url',

            'clientId' => 'aClientID',

        ]);

        $o->buildFullAuthorizationUri([

            'approval_prompt' => 'an approval prompt',

            'prompt' => 'a prompt',

        ]);

    }

    /**

     * @expectedException InvalidArgumentException

     */

    public function testCannotHaveInsecureAuthorizationUri()

    {

        $o = new OAuth2([

            'authorizationUri' => 'http://accounts.test.org/insecure/url',

            'redirectUri' => 'https://accounts.test.org/redirect/url',

            'clientId' => 'aClientID',

        ]);

        $o->buildFullAuthorizationUri();

    }

    /**

     * @expectedException InvalidArgumentException

     */

    public function testCannotHaveRelativeRedirectUri()

    {

        $o = new OAuth2([

            'authorizationUri' => 'http://accounts.test.org/insecure/url',

            'redirectUri' => '/redirect/url',

            'clientId' => 'aClientID',

        ]);

        $o->buildFullAuthorizationUri();

    }

    public function testHasDefaultXXXTypeParams()

    {

        $o = new OAuth2($this->minimal);

        $q = Psr7\parse_query($o->buildFullAuthorizationUri()->getQuery());

        $this->assertEquals('code', $q['response_type']);

        $this->assertEquals('offline', $q['access_type']);

    }

    public function testCanBeUrlObject()

    {

        $config = array_merge($this->minimal, [

            'authorizationUri' => Psr7\uri_for('https://another/uri'),

        ]);

        $o = new OAuth2($config);

        $this->assertEquals('/uri', $o->buildFullAuthorizationUri()->getPath());

    }

    public function testCanOverrideParams()

    {

        $overrides = [

            'access_type' => 'o_access_type',

            'client_id' => 'o_client_id',

            'redirect_uri' => 'o_redirect_uri',

            'response_type' => 'o_response_type',

            'state' => 'o_state',

        ];

        $config = array_merge($this->minimal, ['state' => 'the_state']);

        $o = new OAuth2($config);

        $q = Psr7\parse_query($o->buildFullAuthorizationUri($overrides)->getQuery());

        $this->assertEquals('o_access_type', $q['access_type']);

        $this->assertEquals('o_client_id', $q['client_id']);

        $this->assertEquals('o_redirect_uri', $q['redirect_uri']);

        $this->assertEquals('o_response_type', $q['response_type']);

        $this->assertEquals('o_state', $q['state']);

    }

    public function testIncludesTheScope()

    {

        $with_strings = array_merge($this->minimal, ['scope' => 'scope1 scope2']);

        $o = new OAuth2($with_strings);

        $q = Psr7\parse_query($o->buildFullAuthorizationUri()->getQuery());

        $this->assertEquals('scope1 scope2', $q['scope']);

        $with_array = array_merge($this->minimal, [

            'scope' => ['scope1', 'scope2'],

        ]);

        $o = new OAuth2($with_array);

        $q = Psr7\parse_query($o->buildFullAuthorizationUri()->getQuery());

        $this->assertEquals('scope1 scope2', $q['scope']);

    }

    public function testRedirectUriPostmessageIsAllowed()

    {

        $o = new OAuth2([

            'authorizationUri' => 'https://accounts.test.org/insecure/url',

            'redirectUri' => 'postmessage',

            'clientId' => 'aClientID',

        ]);

        $this->assertEquals('postmessage', $o->getRedirectUri());

        $url = $o->buildFullAuthorizationUri();

        $parts = parse_url((string)$url);

        parse_str($parts['query'], $query);

        $this->assertArrayHasKey('redirect_uri', $query);

        $this->assertEquals('postmessage', $query['redirect_uri']);

    }

}

class OAuth2GrantTypeTest extends \PHPUnit_Framework_TestCase

{

    private $minimal = [

        'authorizationUri' => 'https://accounts.test.org/insecure/url',

        'redirectUri' => 'https://accounts.test.org/redirect/url',

        'clientId' => 'aClientID',

    ];

    public function testReturnsNullIfCannotBeInferred()

    {

        $o = new OAuth2($this->minimal);

        $this->assertNull($o->getGrantType());

    }

    public function testInfersAuthorizationCode()

    {

        $o = new OAuth2($this->minimal);

        $o->setCode('an auth code');

        $this->assertEquals('authorization_code', $o->getGrantType());

    }

    public function testInfersRefreshToken()

    {

        $o = new OAuth2($this->minimal);

        $o->setRefreshToken('a refresh token');

        $this->assertEquals('refresh_token', $o->getGrantType());

    }

    public function testInfersPassword()

    {

        $o = new OAuth2($this->minimal);

        $o->setPassword('a password');

        $o->setUsername('a username');

        $this->assertEquals('password', $o->getGrantType());

    }

    public function testInfersJwtBearer()

    {

        $o = new OAuth2($this->minimal);

        $o->setIssuer('an issuer');

        $o->setSigningKey('a key');

        $this->assertEquals('urn:ietf:params:oauth:grant-type:jwt-bearer',

            $o->getGrantType());

    }

    public function testSetsKnownTypes()

    {

        $o = new OAuth2($this->minimal);

        foreach (OAuth2::$knownGrantTypes as $t) {

            $o->setGrantType($t);

            $this->assertEquals($t, $o->getGrantType());

        }

    }

    public function testSetsUrlAsGrantType()

    {

        $o = new OAuth2($this->minimal);

        $o->setGrantType('http://a/grant/url');

        $this->assertEquals('http://a/grant/url', $o->getGrantType());

    }

}

class OAuth2GetCacheKeyTest extends \PHPUnit_Framework_TestCase

{

    private $minimal = [

        'clientID' => 'aClientID',

    ];

    public function testIsNullWithNoScopes()

    {

        $o = new OAuth2($this->minimal);

        $this->assertNull($o->getCacheKey());

    }

    public function testIsScopeIfSingleScope()

    {

        $o = new OAuth2($this->minimal);

        $o->setScope('test/scope/1');

        $this->assertEquals('test/scope/1', $o->getCacheKey());

    }

    public function testIsAllScopesWhenScopeIsArray()

    {

        $o = new OAuth2($this->minimal);

        $o->setScope(['test/scope/1', 'test/scope/2']);

        $this->assertEquals('test/scope/1:test/scope/2', $o->getCacheKey());

    }

}

class OAuth2TimingTest extends \PHPUnit_Framework_TestCase

{

    private $minimal = [

        'authorizationUri' => 'https://accounts.test.org/insecure/url',

        'redirectUri' => 'https://accounts.test.org/redirect/url',

        'clientId' => 'aClientID',

    ];

    public function testIssuedAtDefaultsToNull()

    {

        $o = new OAuth2($this->minimal);

        $this->assertNull($o->getIssuedAt());

    }

    public function testExpiresAtDefaultsToNull()

    {

        $o = new OAuth2($this->minimal);

        $this->assertNull($o->getExpiresAt());

    }

    public function testExpiresInDefaultsToNull()

    {

        $o = new OAuth2($this->minimal);

        $this->assertNull($o->getExpiresIn());

    }

    public function testSettingExpiresInSetsIssuedAt()

    {

        $o = new OAuth2($this->minimal);

        $this->assertNull($o->getIssuedAt());

        $aShortWhile = 5;

        $o->setExpiresIn($aShortWhile);

        $this->assertEquals($aShortWhile, $o->getExpiresIn());

        $this->assertNotNull($o->getIssuedAt());

    }

    public function testSettingExpiresInSetsExpireAt()

    {

        $o = new OAuth2($this->minimal);

        $this->assertNull($o->getExpiresAt());

        $aShortWhile = 5;

        $o->setExpiresIn($aShortWhile);

        $this->assertNotNull($o->getExpiresAt());

        $this->assertEquals($aShortWhile, $o->getExpiresAt() - $o->getIssuedAt());

    }

    public function testIsNotExpiredByDefault()

    {

        $o = new OAuth2($this->minimal);

        $this->assertFalse($o->isExpired());

    }

    public function testIsNotExpiredIfExpiresAtIsOld()

    {

        $o = new OAuth2($this->minimal);

        $o->setExpiresAt(time() - 2);

        $this->assertTrue($o->isExpired());

    }

}

class OAuth2GeneralTest extends \PHPUnit_Framework_TestCase

{

    private $minimal = [

        'authorizationUri' => 'https://accounts.test.org/insecure/url',

        'redirectUri' => 'https://accounts.test.org/redirect/url',

        'clientId' => 'aClientID',

    ];

    /**

     * @expectedException InvalidArgumentException

     */

    public function testFailsOnUnknownSigningAlgorithm()

    {

        $o = new OAuth2($this->minimal);

        $o->setSigningAlgorithm('this is definitely not an algorithm name');

    }

    public function testAllowsKnownSigningAlgorithms()

    {

        $o = new OAuth2($this->minimal);

        foreach (OAuth2::$knownSigningAlgorithms as $a) {

            $o->setSigningAlgorithm($a);

            $this->assertEquals($a, $o->getSigningAlgorithm());

        }

    }

    /**

     * @expectedException InvalidArgumentException

     */

    public function testFailsOnRelativeRedirectUri()

    {

        $o = new OAuth2($this->minimal);

        $o->setRedirectUri('/relative/url');

    }

    public function testAllowsUrnRedirectUri()

    {

        $urn = 'urn:ietf:wg:oauth:2.0:oob';

        $o = new OAuth2($this->minimal);

        $o->setRedirectUri($urn);

        $this->assertEquals($urn, $o->getRedirectUri());

    }

}

class OAuth2JwtTest extends \PHPUnit_Framework_TestCase

{

    private $signingMinimal = [

        'signingKey' => 'example_key',

        'signingAlgorithm' => 'HS256',

        'scope' => 'https://www.googleapis.com/auth/userinfo.profile',

        'issuer' => 'app@example.com',

        'audience' => 'accounts.google.com',

        'clientId' => 'aClientID',

    ];

    /**

     * @expectedException DomainException

     */

    public function testFailsWithMissingAudience()

    {

        $testConfig = $this->signingMinimal;

        unset($testConfig['audience']);

        $o = new OAuth2($testConfig);

        $o->toJwt();

    }

    /**

     * @expectedException DomainException

     */

    public function testFailsWithMissingIssuer()

    {

        $testConfig = $this->signingMinimal;

        unset($testConfig['issuer']);

        $o = new OAuth2($testConfig);

        $o->toJwt();

    }

    /**

     */

    public function testCanHaveNoScope()

    {

        $testConfig = $this->signingMinimal;

        unset($testConfig['scope']);

        $o = new OAuth2($testConfig);

        $o->toJwt();

    }

    /**

     * @expectedException DomainException

     */

    public function testFailsWithMissingSigningKey()

    {

        $testConfig = $this->signingMinimal;

        unset($testConfig['signingKey']);

        $o = new OAuth2($testConfig);

        $o->toJwt();

    }

    /**

     * @expectedException DomainException

     */

    public function testFailsWithMissingSigningAlgorithm()

    {

        $testConfig = $this->signingMinimal;

        unset($testConfig['signingAlgorithm']);

        $o = new OAuth2($testConfig);

        $o->toJwt();

    }

    public function testCanHS256EncodeAValidPayload()

    {

        $testConfig = $this->signingMinimal;

        $o = new OAuth2($testConfig);

        $payload = $o->toJwt();

        $roundTrip = $this->jwtDecode($payload, $testConfig['signingKey'], array('HS256'));

        $this->assertEquals($roundTrip->iss, $testConfig['issuer']);

        $this->assertEquals($roundTrip->aud, $testConfig['audience']);

        $this->assertEquals($roundTrip->scope, $testConfig['scope']);

    }

    public function testCanRS256EncodeAValidPayload()

    {

        $publicKey = file_get_contents(__DIR__ . '/fixtures' . '/public.pem');

        $privateKey = file_get_contents(__DIR__ . '/fixtures' . '/private.pem');

        $testConfig = $this->signingMinimal;

        $o = new OAuth2($testConfig);

        $o->setSigningAlgorithm('RS256');

        $o->setSigningKey($privateKey);

        $payload = $o->toJwt();

        $roundTrip = $this->jwtDecode($payload, $publicKey, array('RS256'));

        $this->assertEquals($roundTrip->iss, $testConfig['issuer']);

        $this->assertEquals($roundTrip->aud, $testConfig['audience']);

        $this->assertEquals($roundTrip->scope, $testConfig['scope']);

    }

    private function jwtDecode()

    {

        $args = func_get_args();

        $class = 'JWT';

        if (class_exists('Firebase\JWT\JWT')) {

            $class = 'Firebase\JWT\JWT';

        }

        return call_user_func_array("$class::decode", $args);

    }

}

class OAuth2GenerateAccessTokenRequestTest extends \PHPUnit_Framework_TestCase

{

    private $tokenRequestMinimal = [

        'tokenCredentialUri' => 'https://tokens_r_us/test',

        'scope' => 'https://www.googleapis.com/auth/userinfo.profile',

        'issuer' => 'app@example.com',

        'audience' => 'accounts.google.com',

        'clientId' => 'aClientID',

    ];

    /**

     * @expectedException DomainException

     */

    public function testFailsIfNoTokenCredentialUri()

    {

        $testConfig = $this->tokenRequestMinimal;

        unset($testConfig['tokenCredentialUri']);

        $o = new OAuth2($testConfig);

        $o->generateCredentialsRequest();

    }

    /**

     * @expectedException DomainException

     */

    public function testFailsIfAuthorizationCodeIsMissing()

    {

        $testConfig = $this->tokenRequestMinimal;

        $testConfig['redirectUri'] = 'https://has/redirect/uri';

        $o = new OAuth2($testConfig);

        $o->generateCredentialsRequest();

    }

    public function testGeneratesAuthorizationCodeRequests()

    {

        $testConfig = $this->tokenRequestMinimal;

        $testConfig['redirectUri'] = 'https://has/redirect/uri';

        $o = new OAuth2($testConfig);

        $o->setCode('an_auth_code');

        // Generate the request and confirm that it's correct.

        $req = $o->generateCredentialsRequest();

        $this->assertInstanceOf('Psr\Http\Message\RequestInterface', $req);

        $this->assertEquals('POST', $req->getMethod());

        $fields = Psr7\parse_query((string)$req->getBody());

        $this->assertEquals('authorization_code', $fields['grant_type']);

        $this->assertEquals('an_auth_code', $fields['code']);

    }

    public function testGeneratesPasswordRequests()

    {

        $testConfig = $this->tokenRequestMinimal;

        $o = new OAuth2($testConfig);

        $o->setUsername('a_username');

        $o->setPassword('a_password');

        // Generate the request and confirm that it's correct.

        $req = $o->generateCredentialsRequest();

        $this->assertInstanceOf('Psr\Http\Message\RequestInterface', $req);

        $this->assertEquals('POST', $req->getMethod());

        $fields = Psr7\parse_query((string)$req->getBody());

        $this->assertEquals('password', $fields['grant_type']);

        $this->assertEquals('a_password', $fields['password']);

        $this->assertEquals('a_username', $fields['username']);

    }

    public function testGeneratesRefreshTokenRequests()

    {

        $testConfig = $this->tokenRequestMinimal;

        $o = new OAuth2($testConfig);

        $o->setRefreshToken('a_refresh_token');

        // Generate the request and confirm that it's correct.

        $req = $o->generateCredentialsRequest();

        $this->assertInstanceOf('Psr\Http\Message\RequestInterface', $req);

        $this->assertEquals('POST', $req->getMethod());

        $fields = Psr7\parse_query((string)$req->getBody());

        $this->assertEquals('refresh_token', $fields['grant_type']);

        $this->assertEquals('a_refresh_token', $fields['refresh_token']);

    }

    public function testClientSecretAddedIfSetForAuthorizationCodeRequests()

    {

        $testConfig = $this->tokenRequestMinimal;

        $testConfig['clientSecret'] = 'a_client_secret';

        $testConfig['redirectUri'] = 'https://has/redirect/uri';

        $o = new OAuth2($testConfig);

        $o->setCode('an_auth_code');

        $request = $o->generateCredentialsRequest();

        $fields = Psr7\parse_query((string)$request->getBody());

        $this->assertEquals('a_client_secret', $fields['client_secret']);

    }

    public function testClientSecretAddedIfSetForRefreshTokenRequests()

    {

        $testConfig = $this->tokenRequestMinimal;

        $testConfig['clientSecret'] = 'a_client_secret';

        $o = new OAuth2($testConfig);

        $o->setRefreshToken('a_refresh_token');

        $request = $o->generateCredentialsRequest();

        $fields = Psr7\parse_query((string)$request->getBody());

        $this->assertEquals('a_client_secret', $fields['client_secret']);

    }

    public function testClientSecretAddedIfSetForPasswordRequests()

    {

        $testConfig = $this->tokenRequestMinimal;

        $testConfig['clientSecret'] = 'a_client_secret';

        $o = new OAuth2($testConfig);

        $o->setUsername('a_username');

        $o->setPassword('a_password');

        $request = $o->generateCredentialsRequest();

        $fields = Psr7\parse_query((string)$request->getBody());

        $this->assertEquals('a_client_secret', $fields['client_secret']);

    }

    public function testGeneratesAssertionRequests()

    {

        $testConfig = $this->tokenRequestMinimal;

        $o = new OAuth2($testConfig);

        $o->setSigningKey('a_key');

        $o->setSigningAlgorithm('HS256');

        // Generate the request and confirm that it's correct.

        $req = $o->generateCredentialsRequest();

        $this->assertInstanceOf('Psr\Http\Message\RequestInterface', $req);

        $this->assertEquals('POST', $req->getMethod());

        $fields = Psr7\parse_query((string)$req->getBody());

        $this->assertEquals(OAuth2::JWT_URN, $fields['grant_type']);

        $this->assertTrue(array_key_exists('assertion', $fields));

    }

    public function testGeneratesExtendedRequests()

    {

        $testConfig = $this->tokenRequestMinimal;

        $o = new OAuth2($testConfig);

        $o->setGrantType('urn:my_test_grant_type');

        $o->setExtensionParams(['my_param' => 'my_value']);

        // Generate the request and confirm that it's correct.

        $req = $o->generateCredentialsRequest();

        $this->assertInstanceOf('Psr\Http\Message\RequestInterface', $req);

        $this->assertEquals('POST', $req->getMethod());

        $fields = Psr7\parse_query((string)$req->getBody());

        $this->assertEquals('my_value', $fields['my_param']);

        $this->assertEquals('urn:my_test_grant_type', $fields['grant_type']);

    }

}

class OAuth2FetchAuthTokenTest extends \PHPUnit_Framework_TestCase

{

    private $fetchAuthTokenMinimal = [

        'tokenCredentialUri' => 'https://tokens_r_us/test',

        'scope' => 'https://www.googleapis.com/auth/userinfo.profile',

        'signingKey' => 'example_key',

        'signingAlgorithm' => 'HS256',

        'issuer' => 'app@example.com',

        'audience' => 'accounts.google.com',

        'clientId' => 'aClientID',

    ];

    /**

     * @expectedException GuzzleHttp\Exception\ClientException

     */

    public function testFailsOn400()

    {

        $testConfig = $this->fetchAuthTokenMinimal;

        $httpHandler = getHandler([

            buildResponse(400),

        ]);

        $o = new OAuth2($testConfig);

        $o->fetchAuthToken($httpHandler);

    }

    /**

     * @expectedException GuzzleHttp\Exception\ServerException

     */

    public function testFailsOn500()

    {

        $testConfig = $this->fetchAuthTokenMinimal;

        $httpHandler = getHandler([

            buildResponse(500),

        ]);

        $o = new OAuth2($testConfig);

        $o->fetchAuthToken($httpHandler);

    }

    /**

     * @expectedException Exception

     * @expectedExceptionMessage Invalid JSON response

     */

    public function testFailsOnNoContentTypeIfResponseIsNotJSON()

    {

        $testConfig = $this->fetchAuthTokenMinimal;

        $notJson = '{"foo": , this is cannot be passed as json" "bar"}';

        $httpHandler = getHandler([

            buildResponse(200, [], Psr7\stream_for($notJson)),

        ]);

        $o = new OAuth2($testConfig);

        $o->fetchAuthToken($httpHandler);

    }

    public function testFetchesJsonResponseOnNoContentTypeOK()

    {

        $testConfig = $this->fetchAuthTokenMinimal;

        $json = '{"foo": "bar"}';

        $httpHandler = getHandler([

            buildResponse(200, [], Psr7\stream_for($json)),

        ]);

        $o = new OAuth2($testConfig);

        $tokens = $o->fetchAuthToken($httpHandler);

        $this->assertEquals($tokens['foo'], 'bar');

    }

    public function testFetchesFromFormEncodedResponseOK()

    {

        $testConfig = $this->fetchAuthTokenMinimal;

        $json = 'foo=bar&spice=nice';

        $httpHandler = getHandler([

            buildResponse(

                200,

                ['Content-Type' => 'application/x-www-form-urlencoded'],

                Psr7\stream_for($json)

            ),

        ]);

        $o = new OAuth2($testConfig);

        $tokens = $o->fetchAuthToken($httpHandler);

        $this->assertEquals($tokens['foo'], 'bar');

        $this->assertEquals($tokens['spice'], 'nice');

    }

    public function testUpdatesTokenFieldsOnFetch()

    {

        $testConfig = $this->fetchAuthTokenMinimal;

        $wanted_updates = [

            'expires_at' => '1',

            'expires_in' => '57',

            'issued_at' => '2',

            'access_token' => 'an_access_token',

            'id_token' => 'an_id_token',

            'refresh_token' => 'a_refresh_token',

        ];

        $json = json_encode($wanted_updates);

        $httpHandler = getHandler([

            buildResponse(200, [], Psr7\stream_for($json)),

        ]);

        $o = new OAuth2($testConfig);

        $this->assertNull($o->getExpiresAt());

        $this->assertNull($o->getExpiresIn());

        $this->assertNull($o->getIssuedAt());

        $this->assertNull($o->getAccessToken());

        $this->assertNull($o->getIdToken());

        $this->assertNull($o->getRefreshToken());

        $tokens = $o->fetchAuthToken($httpHandler);

        $this->assertEquals(1, $o->getExpiresAt());

        $this->assertEquals(57, $o->getExpiresIn());

        $this->assertEquals(2, $o->getIssuedAt());

        $this->assertEquals('an_access_token', $o->getAccessToken());

        $this->assertEquals('an_id_token', $o->getIdToken());

        $this->assertEquals('a_refresh_token', $o->getRefreshToken());

    }

    public function testUpdatesTokenFieldsOnFetchMissingRefreshToken()

    {

        $testConfig = $this->fetchAuthTokenMinimal;

        $testConfig['refresh_token'] = 'a_refresh_token';

        $wanted_updates = [

            'expires_at' => '1',

            'expires_in' => '57',

            'issued_at' => '2',

            'access_token' => 'an_access_token',

            'id_token' => 'an_id_token',

        ];

        $json = json_encode($wanted_updates);

        $httpHandler = getHandler([

            buildResponse(200, [], Psr7\stream_for($json)),

        ]);

        $o = new OAuth2($testConfig);

        $this->assertNull($o->getExpiresAt());

        $this->assertNull($o->getExpiresIn());

        $this->assertNull($o->getIssuedAt());

        $this->assertNull($o->getAccessToken());

        $this->assertNull($o->getIdToken());

        $this->assertEquals('a_refresh_token', $o->getRefreshToken());

        $tokens = $o->fetchAuthToken($httpHandler);

        $this->assertEquals(1, $o->getExpiresAt());

        $this->assertEquals(57, $o->getExpiresIn());

        $this->assertEquals(2, $o->getIssuedAt());

        $this->assertEquals('an_access_token', $o->getAccessToken());

        $this->assertEquals('an_id_token', $o->getIdToken());

        $this->assertEquals('a_refresh_token', $o->getRefreshToken());

    }

}

class OAuth2VerifyIdTokenTest extends \PHPUnit_Framework_TestCase

{

    private $publicKey;

    private $privateKey;

    private $verifyIdTokenMinimal = [

        'scope' => 'https://www.googleapis.com/auth/userinfo.profile',

        'audience' => 'myaccount.on.host.issuer.com',

        'issuer' => 'an.issuer.com',

        'clientId' => 'myaccount.on.host.issuer.com',

    ];

    public function setUp()

    {

        $this->publicKey =

            file_get_contents(__DIR__ . '/fixtures' . '/public.pem');

        $this->privateKey =

            file_get_contents(__DIR__ . '/fixtures' . '/private.pem');

    }

    /**

     * @expectedException UnexpectedValueException

     */

    public function testFailsIfIdTokenIsInvalid()

    {

        $testConfig = $this->verifyIdTokenMinimal;

        $not_a_jwt = 'not a jot';

        $o = new OAuth2($testConfig);

        $o->setIdToken($not_a_jwt);

        $o->verifyIdToken($this->publicKey);

    }

    /**

     * @expectedException DomainException

     */

    public function testFailsIfAudienceIsMissing()

    {

        $testConfig = $this->verifyIdTokenMinimal;

        $now = time();

        $origIdToken = [

            'issuer' => $testConfig['issuer'],

            'exp' => $now + 65, // arbitrary

            'iat' => $now,

        ];

        $o = new OAuth2($testConfig);

        $jwtIdToken = $this->jwtEncode($origIdToken, $this->privateKey, 'RS256');

        $o->setIdToken($jwtIdToken);

        $o->verifyIdToken($this->publicKey, ['RS256']);

    }

    /**

     * @expectedException DomainException

     */

    public function testFailsIfAudienceIsWrong()

    {

        $now = time();

        $testConfig = $this->verifyIdTokenMinimal;

        $origIdToken = [

            'aud' => 'a different audience',

            'iss' => $testConfig['issuer'],

            'exp' => $now + 65, // arbitrary

            'iat' => $now,

        ];

        $o = new OAuth2($testConfig);

        $jwtIdToken = $this->jwtEncode($origIdToken, $this->privateKey, 'RS256');

        $o->setIdToken($jwtIdToken);

        $o->verifyIdToken($this->publicKey, ['RS256']);

    }

    public function testShouldReturnAValidIdToken()

    {

        $testConfig = $this->verifyIdTokenMinimal;

        $now = time();

        $origIdToken = [

            'aud' => $testConfig['audience'],

            'iss' => $testConfig['issuer'],

            'exp' => $now + 65, // arbitrary

            'iat' => $now,

        ];

        $o = new OAuth2($testConfig);

        $alg = 'RS256';

        $jwtIdToken = $this->jwtEncode($origIdToken, $this->privateKey, $alg);

        $o->setIdToken($jwtIdToken);

        $roundTrip = $o->verifyIdToken($this->publicKey, array($alg));

        $this->assertEquals($origIdToken['aud'], $roundTrip->aud);

    }

    private function jwtEncode()

    {

        $args = func_get_args();

        $class = 'JWT';

        if (class_exists('Firebase\JWT\JWT')) {

            $class = 'Firebase\JWT\JWT';

        }

        return call_user_func_array("$class::encode", $args);

    }

}