query introspection client test

internal/query/embed/introspection_client_by_id.sql

@@ -18,6 +18,6 @@ keys as (
 		and expiration > current_timestamp
 	group by identifier
 )
-select apps.project_id, config.client_secret, keys.public_keys from config
+select config.client_id, config.client_secret, apps.project_id, keys.public_keys from config
 join projections.apps5 apps on apps.id = config.app_id
 left join keys on keys.client_id = config.client_id;

internal/query/introspection_client.go

@@ -5,8 +5,6 @@ import (
 	"database/sql"
 	_ "embed"
 
-	"github.com/jackc/pgtype"
-
 	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/crypto"
 	"github.com/zitadel/zitadel/internal/database"
@@ -33,11 +31,7 @@ func (q *Queries) GetIntrospectionClientByID(ctx context.Context, clientID strin
 	)
 
 	err = q.client.QueryRowContext(ctx, func(row *sql.Row) error {
-		var publicKeys pgtype.ByteaArray
+		return row.Scan(&client.ClientID, &client.ClientSecret, &client.ProjectID, &client.PublicKeys)
-		if err := row.Scan(&client.ClientID, &client.ClientSecret, &client.ProjectID, &publicKeys); err != nil {
-			return err
-		}
-		return publicKeys.AssignTo(&client.PublicKeys)
 	},
 		introspectionClientByIDQuery,
 		instanceID, clientID, getKeys,

internal/query/introspection_client_test.go

@@ -0,0 +1,107 @@
+package query
+
+import (
+	"database/sql"
+	"database/sql/driver"
+	_ "embed"
+	"encoding/json"
+	"regexp"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/zitadel/zitadel/internal/api/authz"
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/database"
+)
+
+func TestQueries_GetIntrospectionClientByID(t *testing.T) {
+	secret := &crypto.CryptoValue{
+		CryptoType: crypto.TypeHash,
+		Algorithm:  "alg",
+		KeyID:      "keyID",
+		Crypted:    []byte("secret"),
+	}
+	encSecret, err := json.Marshal(secret)
+	require.NoError(t, err)
+
+	pubkeys := database.Map[[]byte]{
+		"key1": {1, 2, 3},
+		"key2": {4, 5, 6},
+	}
+	encPubkeys, err := pubkeys.Value()
+	require.NoError(t, err)
+
+	expQuery := regexp.QuoteMeta(introspectionClientByIDQuery)
+	type args struct {
+		clientID string
+		getKeys  bool
+	}
+	tests := []struct {
+		name    string
+		args    args
+		mock    sqlExpectation
+		want    *IntrospectionClient
+		wantErr error
+	}{
+		{
+			name: "query error",
+			args: args{
+				clientID: "clientID",
+				getKeys:  false,
+			},
+			mock:    mockQueryErr(expQuery, sql.ErrConnDone, "instanceID", "clientID", false),
+			wantErr: sql.ErrConnDone,
+		},
+		{
+			name: "success, secret",
+			args: args{
+				clientID: "clientID",
+				getKeys:  false,
+			},
+			mock: mockQuery(expQuery,
+				[]string{"client_id", "client_secret", "project_id", "public_keys"},
+				[]driver.Value{"clientID", encSecret, "projectID", nil},
+				"instanceID", "clientID", false),
+			want: &IntrospectionClient{
+				ClientID:     "clientID",
+				ClientSecret: secret,
+				ProjectID:    "projectID",
+				PublicKeys:   nil,
+			},
+		},
+		{
+			name: "success, keys",
+			args: args{
+				clientID: "clientID",
+				getKeys:  true,
+			},
+			mock: mockQuery(expQuery,
+				[]string{"client_id", "client_secret", "project_id", "public_keys"},
+				[]driver.Value{"clientID", nil, "projectID", encPubkeys},
+				"instanceID", "clientID", true),
+			want: &IntrospectionClient{
+				ClientID:     "clientID",
+				ClientSecret: nil,
+				ProjectID:    "projectID",
+				PublicKeys:   pubkeys,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			execMock(t, tt.mock, func(db *sql.DB) {
+				q := &Queries{
+					client: &database.DB{
+						DB:       db,
+						Database: &prepareDB{},
+					},
+				}
+				ctx := authz.NewMockContext("instanceID", "orgID", "userID")
+				got, err := q.GetIntrospectionClientByID(ctx, tt.args.clientID, tt.args.getKeys)
+				require.ErrorIs(t, err, tt.wantErr)
+				assert.Equal(t, tt.want, got)
+			})
+		})
+	}
+}