Testing oAuth login flow

4
votes

I'm creating a shopify app. I've written express middleware that will take a shop via query parameter so the route with "/?shop=example-shop" will kick off the login flow, from there the user gets redirected to shopify where if they aren't already logged in they do so then "install" the app, approving my apps keys. Then they get sent back to the app where I exchange the code for an access token and do other things like store the user. There's a lot that happens when they come back to the server and I'm having trouble deciding how to test everything. For one I can't even test this route unless all of the returned params are valid (signature, hmac, timestamp).

I'm thinking I could use Casper to login to shopify and follow the flow.

How can I test this very complicated login flow, with valid get parameters?

All the local stuff is easy to test, like database calls. However I can't fake / mock keys and the access token exchange.

1
javascriptnode.jsunit-testingshopify

1 Answers

5
votes

In general, the OAuth 2 login flow works something like this:

enter image description here

  1. You make a request to your route.
  2. It sends back a 3xx that redirects you to (in your case) Shopify.
  3. On the Shopify portal, you fill in the form and log in (sending a POST to them). This ends the "Authenticating the user" part.
  4. A 3xx is sent back that redirects you to a different route.
  5. When the second route is hit, it sends a request to Shopify to authenticate the server. Upon successful authentication of the server (now the user and server are authenticated), it's safe for Shopify to return the data, which your second route will receive.

Unit Testing

Think about how your routes would be unit tested.

  • Your first route receives a GET request, and sends back a 3xx without doing anything else.
  • Your second route receives a GET request, receives some sort of user object from Shopify, might do something with the user object, and then sends back a 3xx.

So for the first route, you'd really only be testing that the GET request sends back a 3xx. For the second, you might want to test anything the server does with the user object it gets back.

But as you mention, Shopify will only send back the user object if the user and server have been authenticated, and you won't be doing this full fledged authentication with your Unit test. What you'd want to do is mock the response from Shopify! Ie. when the request is made to the second route and you're in a testing environment, instead of authenticating with Shopify, just mock the user object you'd get back and continue to do whatever you'd normally do with that object. If you want to do a true unit test, this is the way to go.

Integration Testing

Alternatively, you might want to do a full integration test of this entire process. There's a lot of ways to do this, but basically you'd go through the 1-5 steps I outlined above. You'd probably want to set up a account with Spotify that is used for this test.