add

internal/api/auth_test.go

@@ -34,6 +34,30 @@ func modeBasic(c *config.Config) {
 	}
 }
 
+func modeOIDCWithAPIKey(c *config.Config) {
+	c.API.Auth = config.Auth{
+		Mode: "oidc", APIKeys: []string{"machine-key"},
+		OIDCIssuer: "https://users.example.test", OIDCAudience: "https://dns.example.test", OIDCClientID: "fancy-dns",
+		TrustLoopback: false, SessionTTL: config.Duration(time.Hour),
+	}
+}
+
+func TestOIDCModeKeepsAPIKeyLoginSessionsUsable(t *testing.T) {
+	h := newHarness(t, modeOIDCWithAPIKey)
+	res := h.do(http.MethodPost, "/api/auth/login", `{"api_key":"machine-key"}`)
+	if res.status != http.StatusOK {
+		t.Fatalf("API key login = %d: %s", res.status, res.body)
+	}
+	token, _ := res.json(t)["token"].(string)
+	if token == "" {
+		t.Fatal("login returned an empty bearer token")
+	}
+	res = h.do(http.MethodGet, "/api/whoami", "", "Authorization: Bearer "+token)
+	if res.status != http.StatusOK {
+		t.Fatalf("session bearer in OIDC mode = %d: %s", res.status, res.body)
+	}
+}
+
 // TestAuthModeAPIKey covers every way a request can present a key in apikey
 // mode, and the invariant that matters: the right key always works and every
 // other credential never does.