Struct FakePasServer 

pub struct FakePasServer { /* private fields */ }

Wiremock-wrapped fake PAS Authorization Server.

Self::start constructs the server, generates an ed25519 keypair, and mounts the discovery + JWKS routes. The returned Self::issuer_url is the value to pass into oidc::Config::new’s issuer parameter so that crate::oidc::RelyingParty::new’s discovery + JWKS fetches resolve here.

Token-endpoint expectations are configured per-test via Self::expect_token_exchange and Self::reject_next_token_exchange.

Implementations

impl FakePasServer

pub async fn start() -> Self

Start a fresh fake PAS server. Mounts the discovery + JWKS routes immediately; the token endpoint stays unmounted until a test calls Self::expect_token_exchange or Self::reject_next_token_exchange.

pub async fn start_without_end_session() -> Self

Start a fake PAS whose discovery document omits end_session_endpoint — models an OP that does not support OIDC RP-Initiated Logout, so crate::oidc::RelyingParty::end_session_url returns crate::oidc::EndSessionError::NotSupported.

pub fn issuer_url(&self) -> Url

Issuer URL — pass to oidc::Config::new(client_id, redirect_uri, issuer).

pub fn token_url(&self) -> Url

Token endpoint URL (<issuer>/oauth/token).

pub fn jwks_url(&self) -> Url

JWKS URL (<issuer>/.well-known/jwks.json).

pub fn sign_id_token<S: ScopeSet>( &self, request: &IssueRequest<S>, config: &IssueConfig, ) -> Result<String, IssueError>

Sign an id_token with the fake server’s signing key.

The resulting JWT is verifiable by any crate::oidc::RelyingParty::new-bootstrapped RP that fetched JWKS from this server.

pub fn sign_access_token( &self, issuer: &str, audience: &str, request: &IssueRequest, ) -> Result<String, IssueError>

Sign an RFC 9068 access token with the fake server’s signing key, pinning kid from the key — mirror of PAS’s encode_access_token. The result verifies against any crate::oidc::RelyingParty::access_token_verifier-built verifier that fetched JWKS from this server, as long as issuer + audience match its expectations.

issuer is used verbatim — the caller chooses the form: pass the bare issuer (issuer_url().as_str().trim_end_matches('/')) for a token the perimeter accepts, or the trailing-slash form to exercise the engine’s exact-iss reject (M23). This is what lets a boundary test prove the access_token_verifier trailing-slash trim end-to-end.

pub async fn expect_token_exchange(&self, body: TokenExchangeBody)

Mount a one-shot mock for POST /oauth/token returning body as 200 JSON. Multiple calls stack; each is consumed once in the order they were configured.

pub async fn reject_next_token_exchange( &self, status: u16, body: impl Into<String>, )

Mount a one-shot mock for POST /oauth/token returning the given HTTP status + plaintext body (typical for testing 4xx rejection or 5xx server-error paths).