fix(e2e): stamp the testing token on the OAuth callback when consent is skipped (#10438)

Author: wobsoriano

.changeset/oauth-authorize-continue-testing-token.md

@@ -0,0 +1,2 @@
+---
+---

integration/testUtils/setupTestingTokens.ts

@@ -22,15 +22,21 @@ export const setupTestingTokens = async ({
 
   await context.route(
     url =>
-      (tokens.has(url.origin) && url.pathname.startsWith('/v1/')) || url.pathname.startsWith('/v1/me/oauth/consent/'),
+      (tokens.has(url.origin) && url.pathname.startsWith('/v1/')) ||
+      url.pathname.startsWith('/v1/me/oauth/consent/') ||
+      url.pathname === '/oauth/authorize/continue',
     async route => {
-      const requestUrl = new URL(route.request().url());
-      const requestToken = tokens.get(requestUrl.origin);
+      const request = route.request();
+      const requestUrl = new URL(request.url());
+      const requestToken = requestUrl.pathname.startsWith('/v1/') ? tokens.get(requestUrl.origin) : undefined;
       if (requestToken) {
         requestUrl.searchParams.set('__clerk_testing_token', requestToken);
       }
 
-      if (route.request().method() !== 'POST' || !requestUrl.pathname.startsWith('/v1/me/oauth/consent/')) {
+      const redirectsToCallback =
+        (request.method() === 'POST' && requestUrl.pathname.startsWith('/v1/me/oauth/consent/')) ||
+        (request.method() === 'GET' && requestUrl.pathname === '/oauth/authorize/continue');
+      if (!redirectsToCallback) {
         if (!requestToken) {
           return route.fallback();
         }

integration/tests/session-tasks-sign-up.test.ts

@@ -101,7 +101,11 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasks] })(
       await u.po.signUp.waitForMounted();
       await u.po.signUp.setEmailAddress(fakeUserForOAuth.email);
       await u.po.signUp.continue();
-      await u.po.signUp.enterTestOtpCode();
+      const [callback] = await Promise.all([
+        page.waitForRequest(request => new URL(request.url()).pathname === '/v1/oauth_callback'),
+        u.po.signUp.enterTestOtpCode(),
+      ]);
+      expect(new URL(callback.url()).searchParams.has('__clerk_testing_token')).toBe(true);
 
       // Resolves task
       await u.po.signUp.waitForMounted();

integration/tests/testing-token.test.ts

@@ -13,6 +13,7 @@ test.describe('OAuth testing tokens @nextjs', () => {
   let appOrigin: string;
   let consentPosts: string[];
   let consentTokens: (string | null)[];
+  let authorizeTokens: (string | null)[];
 
   test.beforeAll(async () => {
     app = createServer((request, response) => {
@@ -37,6 +38,10 @@ test.describe('OAuth testing tokens @nextjs', () => {
           });
           response.end('Consent accepted');
         });
+      } else if (url.pathname === '/oauth/authorize/continue') {
+        authorizeTokens.push(url.searchParams.get('__clerk_testing_token'));
+        response.writeHead(303, { location: url.searchParams.get('callback') || '/' });
+        response.end('Authorized');
       } else {
         response.end(JSON.stringify({ url: request.url, method: request.method }));
       }
@@ -49,6 +54,7 @@ test.describe('OAuth testing tokens @nextjs', () => {
   test.beforeEach(async ({ context }) => {
     consentPosts = [];
     consentTokens = [];
+    authorizeTokens = [];
     await setupTestingTokens({ context, frontendApiOrigin: appOrigin, token: 'app-testing-token' });
   });
 
@@ -95,6 +101,22 @@ test.describe('OAuth testing tokens @nextjs', () => {
     expect((await context.cookies(providerOrigin)).map(cookie => cookie.name).sort()).toEqual(['consent', 'provider']);
   });
 
+  test('delivers the token on the callback when the provider skips the consent screen', async ({ page, context }) => {
+    await setupTestingTokens({ context, frontendApiOrigin: providerOrigin, token: 'provider-testing-token' });
+    const callback = new URL('/v1/oauth_callback?code=auth-code&state=a%2Bb%2F%3D', appOrigin);
+    const authorize = new URL('/oauth/authorize/continue', providerOrigin);
+    authorize.searchParams.set('callback', callback.toString());
+    await page.goto(authorize.toString());
+
+    expect(authorizeTokens).toEqual([null]);
+    const received = JSON.parse((await page.locator('body').textContent()) || '{}');
+    expect(Object.fromEntries(new URL(received.url, appOrigin).searchParams)).toEqual({
+      code: 'auth-code',
+      state: 'a+b/=',
+      __clerk_testing_token: 'app-testing-token',
+    });
+  });
+
   for (const [name, getCallback] of [
     ['another origin', () => new URL('/v1/oauth_callback?code=auth-code', providerOrigin)],
     ['another path', () => new URL('/sso-callback?code=auth-code', appOrigin)],