Testing

The package ships test helpers in Bambamboole\LaravelOidc\Server\Testing. Add the trait to your suite:

// Pest (tests/Pest.php)
uses(Bambamboole\LaravelOidc\Server\Testing\InteractsWithOidc::class)->in('Feature');

// PHPUnit
abstract class TestCase extends BaseTestCase
{
    use \Bambamboole\LaravelOidc\Server\Testing\InteractsWithOidc;
}

Authenticating an identity

actingAsIdentity() logs the user in on the identity guard and seeds the session keys the authorization grant reads (oidc.auth_time, oidc.amr, oidc.id_token_claims, oidc.access_token_claims):

$this->actingAsIdentity($user, amr: ['pwd', 'otp'], authTime: time() - 60);

There is no acr parameter: the grant derives acr from amr (1 for a single method, 2 for multiple).

Minting tokens without the HTTP dance

issueTokenFor() returns a signed at+jwt access token with a persisted Passport token row — ready for a Bearer header:

$jwt = $this->issueTokenFor($user, scopes: ['openid', 'email'], audience: ['https://api.orders.test']);

$this->withHeader('Authorization', 'Bearer '.$jwt)->get('/api/orders');

When no client is given, a default authorization-code client is created once per test and reused.

A token minted with a custom audience: does not authenticate on plain auth:oidc routes unless that audience is the issuer URL or listed in oidc.resource.audiences — the auth:oidc guard accepts a token only when its aud intersects those, or carries the token’s own client_id, and an arbitrary custom audience does neither. It is for routes guarded by the package’s audience middleware; see Resource servers (CheckAudience).

Clients

$client = $this->createOidcClient();                 // auth-code grant client
$client = $this->withFirstPartyClient();             // + sets oidc.first_party.* config

Config mutated in a test takes effect immediately — the package reads oidc.first_party.* at call time, so no forgetInstance() ceremony is needed after config([...]) changes.

withFirstPartyClient() sets oidc.first_party.trusted = true, so consent is skipped for that client; register a client via createOidcClient() instead when a test asserts consent behavior.

The full authorization-code flow

authorizeAndApprove() drives authorize → approve → token with PKCE:

$result = $this->authorizeAndApprove($user, $client, scopes: 'openid email');

$result->accessToken;
$result->idToken;
$result->refreshToken;

The authorize and approve legs assert success; the token response is returned unasserted, so error paths stay testable:

$result = $this->authorizeAndApprove($user, $misconfiguredClient);

$result->response->assertStatus(401);
$result->response->json('error'); // invalid_client

params: overrides any authorize query parameter (state, nonce, max_age, redirect_uri, …), and pkce: accepts a fixed PkcePair when the test needs the verifier later. The helper binds a minimal JSON ConsentView unless the test (or FakesAuthViews, or the ui package) already bound one.

The CSRF exemption applied by authorizeAndApprove() persists for the remainder of the calling test method.