Testing Authentication Flows

Learn how to test Agent Auth authentication flows in development, staging, and production environments with comprehensive testing strategies.

Thorough testing of authentication flows ensures your Agent Auth integration works reliably before production deployment. This guide covers testing strategies, tools, and best practices.

Testing environments

Development environment

Purpose: Rapid iteration and debugging

Characteristics:

Local development server
Test accounts and credentials
Verbose logging enabled
Quick feedback loops

Setup:

1
SCALEKIT_ENV_URL=https://your-env.scalekit.dev
2
SCALEKIT_CLIENT_ID=dev_client_id
3
SCALEKIT_CLIENT_SECRET=dev_client_secret
4
DEBUG=true
5
LOG_LEVEL=debug

Staging environment

Purpose: Pre-production validation

Characteristics:

Production-like configuration
Realistic data volumes
Integration with staging third-party accounts
Performance testing

Setup:

1
SCALEKIT_ENV_URL=https://your-env.scalekit.cloud
2
SCALEKIT_CLIENT_ID=staging_client_id
3
SCALEKIT_CLIENT_SECRET=staging_client_secret
4
DEBUG=false
5
LOG_LEVEL=info

Production environment

Purpose: Live user traffic

Characteristics:

Real user data
Verified OAuth applications
Monitoring and alerts
Minimal logging

Setup:

1
SCALEKIT_ENV_URL=https://your-env.scalekit.cloud
2
SCALEKIT_CLIENT_ID=prod_client_id
3
SCALEKIT_CLIENT_SECRET=prod_client_secret
4
DEBUG=false
5
LOG_LEVEL=warn

Test account setup

Creating test providers

Set up test accounts for each provider:

Google Workspace:

Create test Google account
Enable 2FA if testing MFA scenarios
Use for Gmail, Calendar, Drive testing

Slack:

Create free Slack workspace
Install your Slack app
Use for messaging and notification testing

Microsoft 365:

Get Microsoft 365 developer account (free)
Create test users
Use for Outlook, Teams, OneDrive testing

Jira/Atlassian:

Create free Atlassian Cloud account
Set up test projects
Generate API tokens for testing

Test user patterns

Create different test users for scenarios:

1
# Test user configurations
2
TEST_USERS = {
3
    "basic_user": {
4
        "identifier": "test_user_001",
5
        "providers": ["gmail"],
6
        "scenario": "Single provider, basic authentication"
7
    },
8
    "power_user": {
9
        "identifier": "test_user_002",
10
        "providers": ["gmail", "slack", "jira", "calendar"],
11
        "scenario": "Multiple providers, full feature access"
12
    },
13
    "expired_user": {
14
        "identifier": "test_user_003",
15
        "providers": ["gmail"],
16
        "scenario": "Expired tokens, test refresh logic",
17
        "setup": "Manually expire tokens"
18
    },
19
    "revoked_user": {
20
        "identifier": "test_user_004",
21
        "providers": ["slack"],
22
        "scenario": "User revoked access, test re-auth flow"
23
    }
24
}

Unit testing authentication

Test connected account creation

1
import unittest
2
from unittest.mock import Mock, patch
3

4
class TestConnectedAccountCreation(unittest.TestCase):
5
    def setUp(self):
6
        self.actions = Mock()
7
        self.user_id = "test_user_123"
8
        self.provider = "gmail"
9

10
    def test_create_connected_account_success(self):
11
        """Test successful connected account creation"""
12
        # Mock response
13
        mock_response = Mock()
14
        mock_response.connected_account = Mock(
15
            id="account_123",
16
            status="PENDING",
17
            connection_name="gmail"
18
        )
19
        self.actions.get_or_create_connected_account.return_value = mock_response
20

21
        # Execute
22
        response = self.actions.get_or_create_connected_account(
23
            connection_name=self.provider,
24
            identifier=self.user_id
25
        )
26

27
        # Assert
28
        self.assertEqual(response.connected_account.status, "PENDING")
29
        self.assertEqual(response.connected_account.connection_name, "gmail")
30

31
    def test_generate_authorization_link(self):
32
        """Test authorization link generation"""
33
        mock_response = Mock()
34
        mock_response.link = "https://accounts.google.com/oauth/authorize?..."
35

36
        self.actions.get_authorization_link.return_value = mock_response
37

38
        response = self.actions.get_authorization_link(
39
            connection_name=self.provider,
40
            identifier=self.user_id
41
        )
42

43
        self.assertIn("https://", response.link)
44
        self.actions.get_authorization_link.assert_called_once()
45

46
if __name__ == '__main__':
47
    unittest.main()

1
const { describe, it, expect, jest, beforeEach } = require('@jest/globals');
2

3
describe('Connected Account Creation', () => {
4
  let mockActions;
5
  const userId = 'test_user_123';
6
  const provider = 'gmail';
7

8
  beforeEach(() => {
9
    mockActions = {
10
      getOrCreateConnectedAccount: jest.fn(),
11
      getAuthorizationLink: jest.fn()
12
    };
13
  });
14

15
  it('should create connected account successfully', async () => {
16
    // Mock response
17
    const mockResponse = {
18
      connectedAccount: {
19
        id: 'account_123',
20
        status: 'PENDING',
21
        connectionName: 'gmail'
22
      }
23
    };
24

25
    mockActions.getOrCreateConnectedAccount.mockResolvedValue(mockResponse);
26

27
    // Execute
28
    const response = await mockActions.getOrCreateConnectedAccount({
29
      connectionName: provider,
30
      identifier: userId
31
    });
32

33
    // Assert
34
    expect(response.connectedAccount.status).toBe('PENDING');
35
    expect(response.connectedAccount.connectionName).toBe('gmail');
36
  });
37

38
  it('should generate authorization link', async () => {
39
    const mockResponse = {
40
      link: 'https://accounts.google.com/oauth/authorize?...'
41
    };
42

43
    mockActions.getAuthorizationLink.mockResolvedValue(mockResponse);
44

45
    const response = await mockActions.getAuthorizationLink({
46
      connectionName: provider,
47
      identifier: userId
48
    });
49

50
    expect(response.link).toContain('https://');
51
    expect(mockActions.getAuthorizationLink).toHaveBeenCalledTimes(1);
52
  });
53
});

1
package auth_test
2

3
import (
4
    "testing"
5
    "github.com/stretchr/testify/assert"
6
    "github.com/stretchr/testify/mock"
7
)
8

9
type MockActions struct {
10
    mock.Mock
11
}
12

13
func (m *MockActions) GetOrCreateConnectedAccount(connectionName, identifier string) (*ConnectedAccountResponse, error) {
14
    args := m.Called(connectionName, identifier)
15
    return args.Get(0).(*ConnectedAccountResponse), args.Error(1)
16
}
17

18
func TestCreateConnectedAccount(t *testing.T) {
19
    // Arrange
20
    mockActions := new(MockActions)
21
    userId := "test_user_123"
22
    provider := "gmail"
23

24
    expectedResponse := &ConnectedAccountResponse{
25
        ConnectedAccount: ConnectedAccount{
26
            ID:             "account_123",
27
            Status:         "PENDING",
28
            ConnectionName: "gmail",
29
        },
30
    }
31

32
    mockActions.On("GetOrCreateConnectedAccount", provider, userId).
33
        Return(expectedResponse, nil)
34

35
    // Act
36
    response, err := mockActions.GetOrCreateConnectedAccount(provider, userId)
37

38
    // Assert
39
    assert.NoError(t, err)
40
    assert.Equal(t, "PENDING", response.ConnectedAccount.Status)
41
    assert.Equal(t, "gmail", response.ConnectedAccount.ConnectionName)
42
    mockActions.AssertExpectations(t)
43
}

1
import org.junit.jupiter.api.BeforeEach;
2
import org.junit.jupiter.api.Test;
3
import org.mockito.Mock;
4
import org.mockito.MockitoAnnotations;
5
import static org.junit.jupiter.api.Assertions.*;
6
import static org.mockito.Mockito.*;
7

8
class ConnectedAccountCreationTest {
9
    @Mock
10
    private Actions mockActions;
11

12
    private String userId;
13
    private String provider;
14

15
    @BeforeEach
16
    void setUp() {
17
        MockitoAnnotations.openMocks(this);
18
        userId = "test_user_123";
19
        provider = "gmail";
20
    }
21

22
    @Test
23
    void testCreateConnectedAccountSuccess() {
24
        // Arrange
25
        ConnectedAccount account = new ConnectedAccount();
26
        account.setId("account_123");
27
        account.setStatus("PENDING");
28
        account.setConnectionName("gmail");
29

30
        ConnectedAccountResponse mockResponse = new ConnectedAccountResponse();
31
        mockResponse.setConnectedAccount(account);
32

33
        when(mockActions.getOrCreateConnectedAccount(provider, userId))
34
            .thenReturn(mockResponse);
35

36
        // Act
37
        ConnectedAccountResponse response = mockActions
38
            .getOrCreateConnectedAccount(provider, userId);
39

40
        // Assert
41
        assertEquals("PENDING", response.getConnectedAccount().getStatus());
42
        assertEquals("gmail", response.getConnectedAccount().getConnectionName());
43
        verify(mockActions, times(1)).getOrCreateConnectedAccount(provider, userId);
44
    }
45
}

Test token refresh logic

1
def test_token_refresh_scenarios(self):
2
    """Test various token refresh scenarios"""
3
    test_cases = [
4
        {
5
            "name": "successful_refresh",
6
            "initial_status": "EXPIRED",
7
            "expected_status": "ACTIVE",
8
            "should_succeed": True
9
        },
10
        {
11
            "name": "refresh_token_invalid",
12
            "initial_status": "EXPIRED",
13
            "expected_status": "EXPIRED",
14
            "should_succeed": False
15
        },
16
        {
17
            "name": "already_active",
18
            "initial_status": "ACTIVE",
19
            "expected_status": "ACTIVE",
20
            "should_succeed": True
21
        }
22
    ]
23

24
    for case in test_cases:
25
        with self.subTest(case=case["name"]):
26
            # Setup mock
27
            mock_account = Mock()
28
            mock_account.status = case["expected_status"]
29

30
            if case["should_succeed"]:
31
                self.actions.refresh_connected_account.return_value = mock_account
32
            else:
33
                self.actions.refresh_connected_account.side_effect = Exception("Refresh failed")
34

35
            # Execute
36
            try:
37
                result = self.actions.refresh_connected_account(
38
                    identifier="test_user",
39
                    connection_name="gmail"
40
                )
41
                success = True
42
            except Exception:
43
                success = False
44

45
            # Assert
46
            self.assertEqual(success, case["should_succeed"])

Integration testing

Test complete authentication flow

1
import time
2

3
def test_complete_oauth_flow_integration():
4
    """
5
    Integration test for complete OAuth authentication flow.
6
    Requires manual intervention for OAuth consent.
7
    """
8
    user_id = "integration_test_user"
9
    provider = "gmail"
10

11
    # Step 1: Create connected account
12
    print("Step 1: Creating connected account...")
13
    response = actions.get_or_create_connected_account(
14
        connection_name=provider,
15
        identifier=user_id
16
    )
17

18
    account = response.connected_account
19
    assert account.status == "PENDING", f"Expected PENDING, got {account.status}"
20
    print(f"✓ Connected account created: {account.id}")
21

22
    # Step 2: Generate authorization link
23
    print("\nStep 2: Generating authorization link...")
24
    link_response = actions.get_authorization_link(
25
        connection_name=provider,
26
        identifier=user_id
27
    )
28

29
    print(f"✓ Authorization link: {link_response.link}")
30
    print("\n⚠ MANUAL STEP: Open this link in a browser and complete OAuth")
31
    print("   Press Enter after completing OAuth flow...")
32
    input()
33

34
    # Step 3: Verify account is now active
35
    print("\nStep 3: Verifying account status...")
36
    time.sleep(2)  # Brief delay for processing
37

38
    account = actions.get_connected_account(
39
        identifier=user_id,
40
        connection_name=provider
41
    )
42

43
    assert account.status == "ACTIVE", f"Expected ACTIVE, got {account.status}"
44
    print(f"✓ Account is ACTIVE")
45
    print(f"  Granted scopes: {account.scopes}")
46

47
    # Step 4: Test tool execution
48
    print("\nStep 4: Testing tool execution...")
49
    result = actions.execute_tool(
50
        identifier=user_id,
51
        tool_name="gmail_get_profile",
52
        tool_input={}
53
    )
54

55
    assert result is not None, "Tool execution failed"
56
    print(f"✓ Tool executed successfully")
57

58
    print("\n✓✓✓ Integration test completed successfully")
59

60
# Run with: pytest test_auth_integration.py -s (to see output)

Test error scenarios

1
def test_error_scenarios():
2
    """Test various error scenarios"""
3
    user_id = "error_test_user"
4

5
    # Test 1: Invalid provider
6
    print("Test 1: Invalid provider...")
7
    try:
8
        actions.get_or_create_connected_account(
9
            connection_name="invalid_provider",
10
            identifier=user_id
11
        )
12
        assert False, "Should have raised error"
13
    except Exception as e:
14
        print(f"✓ Caught expected error: {type(e).__name__}")
15

16
    # Test 2: Execute tool without authentication
17
    print("\nTest 2: Tool execution without auth...")
18
    try:
19
        actions.execute_tool(
20
            identifier="nonexistent_user",
21
            tool_name="gmail_send_email",
22
            tool_input={"to": "test@example.com"}
23
        )
24
        assert False, "Should have raised error"
25
    except Exception as e:
26
        print(f"✓ Caught expected error: {type(e).__name__}")
27

28
    # Test 3: Missing required scopes
29
    print("\nTest 3: Missing required scopes...")
30
    # This test requires setup with insufficient scopes
31
    print("⚠ Skipped: Requires special setup")
32

33
    print("\n✓✓✓ Error scenario tests completed")

Automated testing

Test authentication in CI/CD

1
name: Test Authentication Flows
2

3
on: [push, pull_request]
4

5
jobs:
6
  test:
7
    runs-on: ubuntu-latest
8

9
    steps:
10
      - uses: actions/checkout@v2
11

12
      - name: Set up Python
13
        uses: actions/setup-python@v2
14
        with:
15
          python-version: '3.9'
16

17
      - name: Install dependencies
18
        run: |
19
          pip install -r requirements.txt
20
          pip install pytest pytest-cov
21

22
      - name: Run unit tests
23
        env:
24
          SCALEKIT_CLIENT_ID: ${{ secrets.TEST_CLIENT_ID }}
25
          SCALEKIT_CLIENT_SECRET: ${{ secrets.TEST_CLIENT_SECRET }}
26
          SCALEKIT_ENV_URL: ${{ secrets.TEST_ENV_URL }}
27
        run: |
28
          pytest tests/test_auth.py -v --cov=src/auth
29

30
      - name: Run integration tests (non-OAuth)
31
        env:
32
          SCALEKIT_CLIENT_ID: ${{ secrets.TEST_CLIENT_ID }}
33
          SCALEKIT_CLIENT_SECRET: ${{ secrets.TEST_CLIENT_SECRET }}
34
          SCALEKIT_ENV_URL: ${{ secrets.TEST_ENV_URL }}
35
        run: |
36
          pytest tests/test_auth_integration.py -v -k "not oauth"

Mock OAuth flows

1
from unittest.mock import patch, Mock
2

3
def test_oauth_flow_with_mocks():
4
    """Test OAuth flow with mocked responses (no actual OAuth)"""
5

6
    with patch('scalekit.actions.get_or_create_connected_account') as mock_create, \
7
         patch('scalekit.actions.get_authorization_link') as mock_link, \
8
         patch('scalekit.actions.get_connected_account') as mock_get:
9

10
        # Mock connected account creation
11
        mock_account = Mock()
12
        mock_account.id = "account_123"
13
        mock_account.status = "PENDING"
14

15
        mock_response = Mock()
16
        mock_response.connected_account = mock_account
17
        mock_create.return_value = mock_response
18

19
        # Mock authorization link
20
        mock_link_response = Mock()
21
        mock_link_response.link = "https://mock-oauth-url.com"
22
        mock_link.return_value = mock_link_response
23

24
        # Mock successful authentication (simulate user completing OAuth)
25
        mock_account.status = "ACTIVE"
26
        mock_account.scopes = ["gmail.readonly", "gmail.send"]
27
        mock_get.return_value = mock_account
28

29
        # Test the flow
30
        # 1. Create account
31
        response = mock_create(connection_name="gmail", identifier="user_123")
32
        assert response.connected_account.status == "PENDING"
33

34
        # 2. Get auth link
35
        link = mock_link(connection_name="gmail", identifier="user_123")
36
        assert "https://" in link.link
37

38
        # 3. Simulate user completing OAuth (status changes to ACTIVE)
39
        account = mock_get(identifier="user_123", connection_name="gmail")
40
        assert account.status == "ACTIVE"
41
        assert len(account.scopes) > 0
42

43
        print("✓ OAuth flow test with mocks completed")

Performance testing

Test token refresh performance

1
import time
2

3
def test_token_refresh_performance():
4
    """Measure token refresh latency"""
5
    user_id = "perf_test_user"
6
    provider = "gmail"
7

8
    # Setup: Create account with expired token
9
    # (This requires manually setting up an expired account)
10

11
    iterations = 10
12
    refresh_times = []
13

14
    for i in range(iterations):
15
        start_time = time.time()
16

17
        try:
18
            actions.refresh_connected_account(
19
                identifier=user_id,
20
                connection_name=provider
21
            )
22
            elapsed = time.time() - start_time
23
            refresh_times.append(elapsed)
24
            print(f"Iteration {i+1}: {elapsed:.3f}s")
25
        except Exception as e:
26
            print(f"Iteration {i+1} failed: {e}")
27

28
    if refresh_times:
29
        avg_time = sum(refresh_times) / len(refresh_times)
30
        min_time = min(refresh_times)
31
        max_time = max(refresh_times)
32

33
        print(f"\nToken Refresh Performance:")
34
        print(f"  Average: {avg_time:.3f}s")
35
        print(f"  Min: {min_time:.3f}s")
36
        print(f"  Max: {max_time:.3f}s")
37

38
        # Assert reasonable performance (adjust threshold as needed)
39
        assert avg_time < 2.0, f"Average refresh time too slow: {avg_time:.3f}s"

Best practices

Test checklist

Unit tests - Test individual authentication functions
Integration tests - Test complete OAuth flows
Error handling - Test all error scenarios
Token refresh - Test automatic and manual refresh
Multi-provider - Test multiple simultaneous connections
Performance - Measure and optimize latency
Security - Verify token encryption and secure storage

Testing dos and don’ts

✅ Do:

Use separate test accounts for each provider
Test both success and failure scenarios
Mock external OAuth calls in unit tests
Test token refresh before expiration
Verify error messages are helpful
Test with realistic data volumes

❌ Don’t:

Use production accounts for testing
Hardcode test credentials in source code
Skip error scenario testing
Assume OAuth always succeeds
Neglect performance testing
Test only happy path scenarios

Security testing

1
def test_security_scenarios():
2
    """Test security-related authentication scenarios"""
3

4
    # Test 1: Verify tokens are not exposed in logs
5
    print("Test 1: Token exposure check...")
6
    with patch('logging.Logger.debug') as mock_log:
7
        account = actions.get_connected_account(
8
            identifier="test_user",
9
            connection_name="gmail"
10
        )
11

12
        # Verify no access tokens in log calls
13
        for call in mock_log.call_args_list:
14
            log_message = str(call)
15
            assert "access_token" not in log_message.lower()
16
            assert "refresh_token" not in log_message.lower()
17

18
    print("✓ No tokens in logs")
19

20
    # Test 2: Verify HTTPS for OAuth redirects
21
    print("\nTest 2: HTTPS verification...")
22
    link_response = actions.get_authorization_link(
23
        connection_name="gmail",
24
        identifier="test_user"
25
    )
26

27
    assert link_response.link.startswith("https://")
28
    print("✓ OAuth uses HTTPS")
29

30
    # Test 3: State parameter validation
31
    print("\nTest 3: State parameter present...")
32
    assert "state=" in link_response.link
33
    print("✓ State parameter included")
34

35
    print("\n✓✓✓ Security tests completed")

Next steps

Authentication Troubleshooting - Debug authentication issues
Token Management - Manage tokens effectively
Multi-Provider Authentication - Test multiple providers