test: validate key identifiers in key rotation assertions

Ensure that key identifiers (`kid`) are valid in tokens issued before
and after key rotation.

Author: tilgovi

cypress/helpers/index.js

@@ -100,18 +100,14 @@ const deleteGrant = (id) =>
   )
 
 export const validateJwt = (jwt) =>
-  cy
-    .request({
-      method: "POST",
-      url: `${Cypress.env("client_url")}/oauth2/validate-jwt`,
-      form: true,
-      body: { jwt },
-    })
-    .then(({ body }) => body)
+  cy.request({
+    method: "POST",
+    url: `${Cypress.env("client_url")}/oauth2/validate-jwt`,
+    form: true,
+    body: { jwt },
+  })
 
 export const rotateJwks = (set) =>
-  cy
-    .request("POST", `${Cypress.env("admin_url")}/keys/${set}`, {
-      alg: "RS256",
-    })
-    .then(({ body }) => body)
+  cy.request("POST", `${Cypress.env("admin_url")}/keys/${set}`, {
+    alg: "RS256",
+  })

cypress/integration/oauth2/refresh_token.js

@@ -1,6 +1,8 @@
 // Copyright © 2022 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
+import { validate as uuidValidate } from "uuid"
+
 import { createClient, prng, rotateJwks, validateJwt } from "../../helpers"
 
 const accessTokenStrategies = ["opaque", "jwt"]
@@ -101,9 +103,6 @@ describe("The OAuth 2.0 Refresh Token Grant", function () {
         })
       })
 
-      const validateJwtAndGetKid = (token) =>
-        validateJwt(token).then(({ header }) => header.kid)
-
       it("should refresh the Access and ID Token with newly rotated keys", function () {
         if (
           accessTokenStrategy === "opaque" ||
@@ -130,26 +129,45 @@ describe("The OAuth 2.0 Refresh Token Grant", function () {
               scope: ["offline_access", "openid"],
             },
             createClient: false,
-          }).then(({ body: tokensBefore }) => {
-            const kidsBefore = {
-              accessToken: validateJwtAndGetKid(tokensBefore.access_token),
-              idToken: validateJwtAndGetKid(tokensBefore.id_token),
-            }
+          }).then((originalResponse) => {
+            expect(originalResponse.status).to.eq(200)
+            expect(originalResponse.body.refresh_token).to.not.be.empty
+
+            const originalToken = originalResponse.body.refresh_token
 
             rotateJwks("hydra.jwt.access-token")
             rotateJwks("hydra.openid.id-token")
 
-            cy.refreshTokenBrowser(client, tokensBefore.refresh_token).then(
-              ({ body: tokensAfter }) => {
-                const kidsAfter = {
-                  accessToken: validateJwtAndGetKid(tokensAfter.access_token),
-                  idToken: validateJwtAndGetKid(tokensAfter.id_token),
-                }
-
-                expect(kidsAfter.accessToken).to.not.equal(
-                  kidsBefore.accessToken,
-                )
-                expect(kidsAfter.idToken).to.not.equal(kidsBefore.idToken)
+            cy.refreshTokenBrowser(client, originalToken).then(
+              (refreshedResponse) => {
+                expect(refreshedResponse.status).to.eq(200)
+                expect(refreshedResponse.body.refresh_token).to.not.be.empty
+
+                validateJwt(originalResponse.body.access_token)
+                  .its("body.header.kid")
+                  .then((originalKid) => {
+                    expect(originalKid).to.satisfy(uuidValidate)
+
+                    validateJwt(refreshedResponse.body.access_token)
+                      .its("body.header.kid")
+                      .then((refreshedKid) => {
+                        expect(refreshedKid).to.satisfy(uuidValidate)
+                        expect(refreshedKid).to.not.eq(originalKid)
+                      })
+                  })
+
+                validateJwt(originalResponse.body.id_token)
+                  .its("body.header.kid")
+                  .then((originalKid) => {
+                    expect(originalKid).to.satisfy(uuidValidate)
+
+                    validateJwt(refreshedResponse.body.id_token)
+                      .its("body.header.kid")
+                      .then((refreshedKid) => {
+                        expect(refreshedKid).to.satisfy(uuidValidate)
+                        expect(refreshedKid).to.not.eq(originalKid)
+                      })
+                  })
               },
             )
           })