Styjun

I'm using Laravel 5.7 along with Passport to create an API for a first-party client. I have a login form that accepts the user's email and password and sends both to a custom LoginController. The LoginController then creates an oAuth payload, sends a POST request to oauth/token via Guzzle and returns the access_token, refresh_token and everything else to my first-party client.

Everything works perfectly when I test it in the browser. However I would now like to write an integration test for all of this and am running into an issue. The issue being that the oAuth server keeps rejecting my client and/or Guzzle request, only during testing.

Here is my corresponding code:

LoginController

<?php

namespace AppHttpControllersApi;

use AppDomainAuthPasswordGrant;
use AppHttpRequestsLoginRequest;

class LoginController extends ApiController

 /**
 * LoginController constructor.
 */
 public function __construct()
 
 $this->middleware('api')->only('login');
 

 /**
 * Attempt to authenticate the user with the credentials they provided
 * and if successful, return an access token for the user.
 *
 * @param LoginRequest $request
 * @return IlluminateHttpResponse
 */
 public function login(LoginRequest $request)
 
 return PasswordGrant::attempt($request->email, $request->password);
 

PasswordGrant

<?php

namespace AppDomainAuth;

use GuzzleHttpClient as GuzzleHttp;
use GuzzleHttpExceptionClientException;
use LaravelPassportClient;

class PasswordGrant

 /**
 * The GuzzleHttp client instance.
 *
 * @var GuzzleHttp
 */
 protected $http;

 /**
 * PasswordGrant constructor.
 *
 * @param GuzzleHttp $http
 */
 public function __construct(GuzzleHttp $http)
 
 $this->http = $http;
 

 /**
 * @param $username
 * @param $password
 * @return IlluminateHttpResponse
 */
 public static function attempt($username, $password)
 
 $passwordGrant = resolve(static::class);

 $payload = $passwordGrant->oAuthPayload(
 $passwordGrant->oAuthClient(), $username, $password
 );

 return $passwordGrant->oAuthResponse($payload);
 

 /**
 * Get the oAuth Client we are using to authenticate our login and user.
 *
 * @return Client
 */
 protected function oAuthClient()
 
 return Client::query()
 ->where('name', config('api.password_client'))
 ->where('password_client', true)
 ->where('revoked', false)
 ->firstOrFail();
 

 /**
 * The payload we need to send to our oAuth server in order to receive
 * a bearer token and authenticate the user.
 *
 * @param Client $client
 * @param $username
 * @param $password
 * @return array
 */
 protected function oAuthPayload(Client $client, $username, $password)
 
 return [
 'form_params' => [
 'grant_type' => 'password',
 'client_id' => $client->id,
 'client_secret' => $client->secret,
 'username' => $username,
 'password' => $password,
 'scope' => '*'
 ]
 ];
 

 /**
 * Get the response from our oAuth server.
 *
 * @param array $payload
 * @return IlluminateHttpResponse
 */
 protected function oAuthResponse(array $payload)
 
 try 

 return $this->http->post(route('passport.token'), $payload)->getBody();

 catch (ClientException $exception) 

 return response($exception->getMessage(), $exception->getCode());

 
 

PasswordGrantTest

<?php

namespace TestsFeatureRequestsTeam;

use AppDomainAuthPasswordGrant;
use AppModelsUser;
use IlluminateFoundationTestingRefreshDatabase;
use IlluminateSupportFacadesArtisan;
use TestsTestCasesTestCase;

class PasswordGrantTest extends TestCase

 use RefreshDatabase;

 /** @test */
 public function it_returns_an_access_token_for_a_user_with_valid_credentials()
 
 Artisan::call('passport:client', [
 '--password' => true,
 '--name' => config('api.password_client')
 ]);

 $user = create(User::class);

 $result = PasswordGrant::attempt($user->email, 'secret');

 dd($result);
 

The dd at the end of my test always returns a 401 with the message:
"error":"invalid_client","message":"Client authentication failed"

I have triple checked the existence and validity of my user model, the passport client and made sure the payload is well-formed.

Why does the password grant work when I test it via the browser but it does not work when making the same request to the server from my tests?

Perhaps I am missing certain headers in my request to the server during testing?