I have a web application where users must authenticate with a 3rd-party OAuth 2.0 service in order to do what they need to do in the app. On initial registration/login, they will connect with the service and my backend will get their access tokens and refresh tokens and keep those fresh for the duration of their user existing in our system (unless they are revoked).
Since the majority of my application needs a valid Oauth 2.0 token with this service to properly function, I also need a valid token in my tests (both local and on my CI/CD - currently on AWS).
What I am looking for is a "proper" way to both get and store these tokens non-interactively (since during testing, the user would have to open the browser, connect to the service, then be redirected back to my app). I see a few ways to do this; however, I do not see anything out there right now that is off-the-shelf and I could use immediately. I am looking for options if people are aware.
Possible "ways" of doing this that I can see:
- Use something like Selenium to automate the login and OAuth 2.0 connection flow with a real browser as a fixture that will be used by other tests in the test suite. Not sure how well this would work on something like AWS CodeBuild without using a headless browser.
- Build a new HTTPS application, hosted in AWS or elsewhere, where you can configure OAuth 2.0 connections with a sandbox server on the 3rd-party service, and the server, much like my actual app, will keep the tokens fresh using background tasks. Then, the idea would be to provide ANOTHER set of credentials to this server that I could fetch in my local tests and in CI/CD to get the OAuth 2.0 access token for a specific connected user that has been done once manually in this new application.
- Some way of interactively connecting to the OAuth 2.0 server as part of the local test suite (I am using Python, Flask, and PyTest). I am not sure how/if this could work on AWS.
- Finally, take the most recent tokens I have from a local version of my app, and always be changing them out in the environment variables of both the AWS CI/CD and my local tests. Extremely non-optimal.
I thought that something out there to do this would exist, given how often now 3rd-party services do not provide a key and secret like OAuth 1.0 where no interaction is required.