Still working on getting client credential flow complete, most of the request works but still working on generating the JWT.

IdentityShroud.Api.Tests/Apis/OpenIdApiTests.cs

@@ -0,0 +1,123 @@
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using System.Text.Json.Serialization;
+using IdentityShroud.Api.Apis;
+using IdentityShroud.Core.EFCore;
+using IdentityShroud.Core.Tests.Fixtures;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using Shouldly;
+
+namespace IdentityShroud.Api.Tests.Apis;
+
+public class OpenIdApiTests : IClassFixture<ApplicationFactory>
+{
+    private readonly ApplicationFactory _factory;
+
+    public OpenIdApiTests(ApplicationFactory factory)
+    {
+        _factory = factory;
+
+        using var scope = _factory.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<Db>();
+        if (!db.Database.EnsureCreated())
+        {
+            db.Database.ExecuteSqlRaw("TRUNCATE realm CASCADE;");
+        }
+    }
+
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task ClientCredentialsFlow(bool useAuthenticationHeader)
+    {
+        var client = _factory.CreateClient();
+        
+        var createRealmResponse = await client.PostAsync("/api/v1/realms", JsonContent.Create(new
+            {
+                Slug = "foo",
+                Name = "Test'",
+            }),
+            TestContext.Current.CancellationToken);
+
+        createRealmResponse.StatusCode.ShouldBe(HttpStatusCode.Created);
+
+        var realm = await createRealmResponse.Content.ReadFromJsonAsync<RealmRepresentation>(
+            cancellationToken: TestContext.Current.CancellationToken);
+        realm.ShouldNotBeNull();
+        realm.Id.ShouldNotBe(Guid.Empty);
+        
+        var createClientResponse = await client.PostAsync(
+            $"/api/v1/realms/{realm.Id}/clients",
+            JsonContent.Create(new
+            {
+                ClientId = "myclient", 
+                Name = "New Client",
+                Confidential = true,
+                AllowClientCredentialsFlow = true,
+                GenerateSecret = true,
+            }),
+            TestContext.Current.CancellationToken);
+        
+        createClientResponse.StatusCode.ShouldBe(HttpStatusCode.Created);
+        
+        // Act
+        const string clientId = "myclient";
+        
+        var data = new[]
+        {
+            new KeyValuePair<string, string>("client_id", clientId),
+            new KeyValuePair<string, string>("client_secret", "secret"),
+            new KeyValuePair<string, string>("response_type", "token"),
+            new KeyValuePair<string, string>("grant_type", "client_credentials"),
+        };
+
+        if (useAuthenticationHeader)
+        {
+            // client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("basic",
+            //     Convert.ToBase64String($"{clientId}:{clientSecret}"))
+        }
+ 
+        var content = new FormUrlEncodedContent(data);
+        var response = await client.PostAsync(
+            "/auth/realms/foo/openid-connect/token",
+            content,
+            TestContext.Current.CancellationToken);
+
+        // Verify
+        // var responseJson = await response.Content.ReadAsStringAsync(
+        //     TestContext.Current.CancellationToken);
+        // Console.WriteLine($"Response: {responseJson}");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        // Cache-Control: no-store
+        response.Headers.CacheControl.ShouldNotBeNull()
+            .NoStore.ShouldBe(true);
+        // Pragma: no-cache
+        response.Headers.Pragma.ShouldNotBeNull()
+            .ShouldContain(new NameValueHeaderValue("no-cache"));
+
+        var payload = await response.Content.ReadFromJsonAsync<TokenResponse>();
+        payload.ShouldNotBeNull();
+        Assert.Multiple(
+            () => payload.AccessToken.ShouldNotBeNull(),
+            () => payload.TokenType.ShouldBe("bearer"),
+            () => payload.ExpiresIn.ShouldBe(3600));
+
+        // - refresh_token OPTIONAL
+        // - scope OPTIONAL when identical to request otherwise REQUIRED
+    }
+
+    internal class TokenResponse
+    {
+        [JsonPropertyName("access_token")]
+        public string? AccessToken { get; set; }
+        [JsonPropertyName("token_type")]
+        public string? TokenType { get; set; }
+        [JsonPropertyName("expires_in")]
+        public int? ExpiresIn { get; set; }
+    }
+
+}