diff --git a/saleor/plugins/openid_connect/tests/test_plugin.py b/saleor/plugins/openid_connect/tests/test_plugin.py index a8ccf1df425..26609e8db03 100644 --- a/saleor/plugins/openid_connect/tests/test_plugin.py +++ b/saleor/plugins/openid_connect/tests/test_plugin.py @@ -911,6 +911,7 @@ def test_authenticate_user_with_jwt_access_token( decoded_access_token["scope"] = "" decoded_token = MagicMock() decoded_token.__getitem__.side_effect = decoded_access_token.__getitem__ + decoded_token.get.side_effect = decoded_access_token.get # mock get token from request monkeypatch.setattr( @@ -1151,6 +1152,7 @@ def test_authenticate_user_with_jwt_access_token_unable_to_fetch_user_info( decoded_token = MagicMock() decoded_token.__getitem__.side_effect = decoded_access_token.__getitem__ + decoded_token.get.side_effect = decoded_access_token.get # mock get token from request monkeypatch.setattr( @@ -1193,6 +1195,7 @@ def test_authenticate_user_with_jwt_invalid_access_token( decoded_token = MagicMock() decoded_token.__getitem__.side_effect = decoded_access_token.__getitem__ + decoded_token.get.side_effect = decoded_access_token.get decoded_token.validate.side_effect = JoseError() # mock get token from request diff --git a/saleor/plugins/openid_connect/tests/test_utils.py b/saleor/plugins/openid_connect/tests/test_utils.py index d3a3e1b137e..fe829b75620 100644 --- a/saleor/plugins/openid_connect/tests/test_utils.py +++ b/saleor/plugins/openid_connect/tests/test_utils.py @@ -8,6 +8,7 @@ import pytest import pytz import requests +from authlib.jose import JWTClaims from django.core.exceptions import ValidationError from django.utils.timezone import make_aware from freezegun import freeze_time @@ -32,6 +33,7 @@ get_or_create_user_from_payload, get_saleor_permission_names, get_saleor_permissions_qs_from_scope, + get_user_from_oauth_access_token_in_jwt_format, get_user_from_token, get_user_info, validate_refresh_token, @@ -331,3 +333,27 @@ def test_get_or_create_user_from_payload_with_last_login(customer_user, settings ) assert user_from_payload.email == customer_user.email assert user_from_payload.private_metadata[f"oidc-{oauth_url}"] == sub_id + + +def test_jwt_token_without_expiration_claim(monkeypatch, decoded_access_token): + monkeypatch.setattr( + "saleor.plugins.openid_connect.utils.get_user_info_from_cache_or_fetch", + lambda *args, **kwargs: { + "email": "test@example.org", + "sub": token_payload["sub"], + "scope": token_payload["scope"], + }, + ) + decoded_access_token.pop("exp") + token_payload = JWTClaims( + decoded_access_token, + {}, + ) + user = get_user_from_oauth_access_token_in_jwt_format( + token_payload, + "https://example.com", + access_token="fake-token", + use_scope_permissions=False, + audience="", + ) + assert user.email == "test@example.org" diff --git a/saleor/plugins/openid_connect/utils.py b/saleor/plugins/openid_connect/utils.py index f4c2ee0369a..247e4cfaa06 100644 --- a/saleor/plugins/openid_connect/utils.py +++ b/saleor/plugins/openid_connect/utils.py @@ -167,7 +167,7 @@ def get_user_from_oauth_access_token_in_jwt_format( user_info = get_user_info_from_cache_or_fetch( user_info_url, access_token, - token_payload["exp"], + token_payload.get("exp"), ) if not user_info: logger.info(