oauth2: update oauth2 tests for the OIDC review hardening

Align the existing provider and command tests with the hardened behavior:
verifyUser resolves through the nonce-aware path, the verified-email tests
stub the four-argument resolveEmail, the token helper sets email_verified,
and the command test mocks the nonce overload. All 110 oauth2 tests pass.

Author: rootnomad

plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/oidc/GenericOIDCOAuth2Provider.java

@@ -155,7 +155,7 @@ public boolean verifyUser(String email, String secretCode, Long domainId, String
 
         String verifiedEmail = verifiedEmailCache.asMap().remove(verifiedEmailKey(providerName, secretCode, domainId));
         if (verifiedEmail == null) {
-            verifiedEmail = resolveEmail(secretCode, domainId, providerName);
+            verifiedEmail = resolveEmail(secretCode, domainId, providerName, null);
         }
         if (StringUtils.isBlank(verifiedEmail) || !email.equals(verifiedEmail)) {
             throw new CloudRuntimeException("Unable to verify the email address with the provided secret");

plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/api/command/VerifyOAuthCodeAndGetUserCmdTest.java

@@ -74,7 +74,7 @@ public void testAuthenticate() {
         params.put("provider", providerArray);
 
         when(oauth2mgr.resolveDomainId(any())).thenReturn(null);
-        when(oauth2mgr.verifySecretCodeAndFetchEmail(eq("secretcode"), eq("provider"), any())).thenReturn("test@example.com");
+        when(oauth2mgr.verifySecretCodeAndFetchEmail(eq("secretcode"), eq("provider"), any(), any())).thenReturn("test@example.com");
 
         String response = cmd.authenticate("command", params, session, remoteAddress, responseType, auditTrailSb, req, resp);
 

plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/oidc/GenericOIDCOAuth2ProviderTest.java

@@ -103,7 +103,7 @@ private String idToken(String issuer, String audience, String email, long expire
         String payload = "{"
                 + "\"iss\":\"" + issuer + "\","
                 + "\"aud\":[\"" + audience + "\"],"
-                + (email == null ? "" : "\"email\":\"" + email + "\",")
+                + (email == null ? "" : "\"email\":\"" + email + "\",\"email_verified\":true,")
                 + "\"exp\":" + (System.currentTimeMillis() / 1000L + expiresInSeconds) + ","
                 + "\"sub\":\"12345\""
                 + "}";
@@ -378,8 +378,8 @@ public void testEveryCallExchangesItsOwnAuthorizationCode() {
         doReturn(metadata()).when(provider).getMetadata(registration);
         doReturn("token-for-first").when(provider).exchangeAuthorizationCode(eq("first-code"), any(), any());
         doReturn("token-for-second").when(provider).exchangeAuthorizationCode(eq("second-code"), any(), any());
-        doReturn("first@example.com").when(provider).validateAndExtractEmail(eq("token-for-first"), any(), any());
-        doReturn("second@example.com").when(provider).validateAndExtractEmail(eq("token-for-second"), any(), any());
+        doReturn("first@example.com").when(provider).validateAndExtractEmail(eq("token-for-first"), any(), any(), any());
+        doReturn("second@example.com").when(provider).validateAndExtractEmail(eq("token-for-second"), any(), any(), any());
 
         assertEquals("first@example.com", provider.verifySecretCodeAndFetchEmail("first-code", null, REGISTRATION));
         assertEquals("second@example.com", provider.verifySecretCodeAndFetchEmail("second-code", null, REGISTRATION));
@@ -391,7 +391,7 @@ public void testEveryCallExchangesItsOwnAuthorizationCode() {
     @Test(expected = CloudRuntimeException.class)
     public void testVerifyUserRejectsAnEmailThatDoesNotMatchTheToken() {
         when(oauthProviderDao.findByProviderAndDomainWithGlobalFallback(REGISTRATION, null)).thenReturn(registration);
-        doReturn("someone-else@example.com").when(provider).resolveEmail("code", null, REGISTRATION);
+        doReturn("someone-else@example.com").when(provider).resolveEmail("code", null, REGISTRATION, null);
 
         provider.verifyUser("user@example.com", "code", null, REGISTRATION);
     }
@@ -402,38 +402,38 @@ public void testVerifyUserRejectsAnEmailThatDoesNotMatchTheToken() {
      */
     @Test
     public void testLoginAfterVerificationDoesNotRedeemTheCodeAgain() {
-        doReturn("user@example.com").when(provider).resolveEmail("code", null, REGISTRATION);
+        doReturn("user@example.com").when(provider).resolveEmail("code", null, REGISTRATION, null);
 
         assertEquals("user@example.com", provider.verifySecretCodeAndFetchEmail("code", null, REGISTRATION));
         assertTrue(provider.verifyUser("user@example.com", "code", null, REGISTRATION));
 
-        verify(provider, times(1)).resolveEmail("code", null, REGISTRATION);
+        verify(provider, times(1)).resolveEmail("code", null, REGISTRATION, null);
     }
 
     @Test
     public void testVerifiedCodeIsServedFromTheCacheOnlyOnce() {
-        doReturn("user@example.com").when(provider).resolveEmail("code", null, REGISTRATION);
+        doReturn("user@example.com").when(provider).resolveEmail("code", null, REGISTRATION, null);
 
         provider.verifySecretCodeAndFetchEmail("code", null, REGISTRATION);
         provider.verifyUser("user@example.com", "code", null, REGISTRATION);
         provider.verifyUser("user@example.com", "code", null, REGISTRATION);
 
-        verify(provider, times(2)).resolveEmail("code", null, REGISTRATION);
+        verify(provider, times(2)).resolveEmail("code", null, REGISTRATION, null);
     }
 
     @Test(expected = CloudRuntimeException.class)
     public void testAnotherCodeIsNeverAnsweredFromTheCache() {
-        doReturn("user@example.com").when(provider).resolveEmail("user-code", null, REGISTRATION);
-        doThrow(new CloudRuntimeException("invalid_grant")).when(provider).resolveEmail("unrelated-code", null, REGISTRATION);
+        doReturn("user@example.com").when(provider).resolveEmail("user-code", null, REGISTRATION, null);
+        doThrow(new CloudRuntimeException("invalid_grant")).when(provider).resolveEmail("unrelated-code", null, REGISTRATION, null);
 
         provider.verifySecretCodeAndFetchEmail("user-code", null, REGISTRATION);
         provider.verifyUser("user@example.com", "unrelated-code", null, REGISTRATION);
     }
 
     @Test(expected = CloudRuntimeException.class)
     public void testCachedCodeIsScopedToItsRegistration() {
-        doReturn("user@example.com").when(provider).resolveEmail("code", null, REGISTRATION);
-        doThrow(new CloudRuntimeException("invalid_grant")).when(provider).resolveEmail("code", null, "other-idp");
+        doReturn("user@example.com").when(provider).resolveEmail("code", null, REGISTRATION, null);
+        doThrow(new CloudRuntimeException("invalid_grant")).when(provider).resolveEmail("code", null, "other-idp", null);
 
         provider.verifySecretCodeAndFetchEmail("code", null, REGISTRATION);
         provider.verifyUser("user@example.com", "code", null, "other-idp");