feat(oidc): a fake provider for hosts' tests (testing.dart)

The module's test provider moves into `package:halkyon_oidc_server/testing.dart`,
so a host tests its own sign-in against the module's real checks rather than
a copy: `TestKey` makes and publishes an RSA key and signs ID tokens with
headers written by hand (no `typ`, as SimpleLogin's), and `FakeProvider`
answers discovery, the keys and the token endpoint through an HTTP client
the host hands the module. `FakeProvider.simpleLogin` has SimpleLogin's
issuer and endpoints, without PKCE, as the preset expects; a test now signs
in through the preset end to end. pointycastle, already in the lock through
dart_jsonwebtoken, becomes a dependency for it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-23 20:33:13 +02:00
commit 54c0b3f7b8
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
2 changed files with 108 additions and 39 deletions

View file

@ -3,10 +3,9 @@ import 'dart:convert';
import 'package:clock/clock.dart';
import 'package:dart_jsonwebtoken/dart_jsonwebtoken.dart';
import 'package:halkyon_oidc_server/src/id_token.dart';
import 'package:halkyon_oidc_server/testing.dart';
import 'package:test/test.dart';
import '../support/test_provider.dart';
// An ID token proves who someone is only when everything in it checks out
// (ADR 0023, 5): signed with one of the provider's keys, the one its `kid`
// names, by an algorithm the provider uses; for this client, from this

View file

@ -4,10 +4,9 @@ import 'package:clock/clock.dart';
import 'package:dart_jsonwebtoken/dart_jsonwebtoken.dart';
import 'package:halkyon_oidc_server/src/oidc_provider.dart';
import 'package:halkyon_oidc_server/src/provider_keys.dart';
import 'package:halkyon_oidc_server/testing.dart';
import 'package:test/test.dart';
import '../support/test_provider.dart';
// A provider's keys, as the server keeps them (ADR 0023, 5): an hour, then
// fetched again; a `kid` it doesn't know fetched again at once, as the
// provider may have a new key, but at most once a minute, so tokens with made