fix: check code presence

Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

server/handlers.go

@@ -805,6 +805,11 @@ func (s *Server) handleAuthCode(w http.ResponseWriter, r *http.Request, client s
 	code := r.PostFormValue("code")
 	redirectURI := r.PostFormValue("redirect_uri")
 
+	if code == "" {
+		s.tokenErrHelper(w, errInvalidRequest, `Required param: code.`, http.StatusBadRequest)
+		return
+	}
+
 	authCode, err := s.storage.GetAuthCode(code)
 	if err != nil || s.now().After(authCode.Expiry) || authCode.ClientID != client.ID {
 		if err != storage.ErrNotFound {

server/handlers_test.go

@@ -208,8 +208,53 @@ func TestConnectorLoginDoesNotAllowToChangeConnectorForAuthRequest(t *testing.T)
 	}
 }
 
-// TestHandleCodeReuse checks that it is forbidden to use same code twice
+// TestHandleAuthCode checks that it is forbidden to use same code twice
-func TestHandleCodeReuse(t *testing.T) {
+func TestHandleAuthCode(t *testing.T) {
+	tests := []struct {
+		name       string
+		handleCode func(*testing.T, context.Context, *oauth2.Config, string)
+	}{
+		{
+			name: "Code Reuse should return invalid_grant",
+			handleCode: func(t *testing.T, ctx context.Context, oauth2Config *oauth2.Config, code string) {
+				_, err := oauth2Config.Exchange(ctx, code)
+				require.NoError(t, err)
+
+				_, err = oauth2Config.Exchange(ctx, code)
+				require.Error(t, err)
+
+				oauth2Err, ok := err.(*oauth2.RetrieveError)
+				require.True(t, ok)
+
+				var errResponse struct{ Error string }
+				err = json.Unmarshal(oauth2Err.Body, &errResponse)
+				require.NoError(t, err)
+
+				// invalid_grant must be returned for invalid values
+				// https://tools.ietf.org/html/rfc6749#section-5.2
+				require.Equal(t, errInvalidGrant, errResponse.Error)
+			},
+		},
+		{
+			name: "No Code should return invalid_request",
+			handleCode: func(t *testing.T, ctx context.Context, oauth2Config *oauth2.Config, _ string) {
+				_, err := oauth2Config.Exchange(ctx, "")
+				require.Error(t, err)
+
+				oauth2Err, ok := err.(*oauth2.RetrieveError)
+				require.True(t, ok)
+
+				var errResponse struct{ Error string }
+				err = json.Unmarshal(oauth2Err.Body, &errResponse)
+				require.NoError(t, err)
+
+				require.Equal(t, errInvalidRequest, errResponse.Error)
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
 			ctx, cancel := context.WithCancel(context.Background())
 			defer cancel()
 
@@ -229,24 +274,8 @@ func TestHandleCodeReuse(t *testing.T) {
 				q := r.URL.Query()
 				require.Equal(t, q.Get("error"), "", q.Get("error_description"))
 
-		if code := q.Get("code"); code != "" {
+				code := q.Get("code")
-			_, err := oauth2Client.config.Exchange(ctx, code)
+				tc.handleCode(t, ctx, oauth2Client.config, code)
-			require.NoError(t, err)
-
-			_, err = oauth2Client.config.Exchange(ctx, code)
-			require.Error(t, err)
-
-			oauth2Err, ok := err.(*oauth2.RetrieveError)
-			require.True(t, ok)
-
-			var errResponse struct{ Error string }
-			err = json.Unmarshal(oauth2Err.Body, &errResponse)
-			require.NoError(t, err)
-
-			// invalid_grant must be returned for invalid values
-			// https://tools.ietf.org/html/rfc6749#section-5.2
-			require.Equal(t, errInvalidGrant, errResponse.Error)
-		}
 
 				w.WriteHeader(http.StatusOK)
 			}))
@@ -273,4 +302,6 @@ func TestHandleCodeReuse(t *testing.T) {
 			require.NoError(t, err)
 
 			resp.Body.Close()
+		})
+	}
 }