mirror of
https://github.com/zitadel/zitadel.git
synced 2025-08-11 10:47:37 +00:00
query: implement SearchUsersByMetadata + test
This commit is contained in:
Marco Ardizzone
210
internal/query/users_by_metadata.go
Normal file
210
internal/query/users_by_metadata.go
Normal file
@@ -0,0 +1,210 @@
|
|||||||
|
package query
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"database/sql"
|
||||||
|
"slices"
|
||||||
|
|
||||||
|
sq "github.com/Masterminds/squirrel"
|
||||||
|
"github.com/zitadel/logging"
|
||||||
|
"golang.org/x/text/language"
|
||||||
|
|
||||||
|
"github.com/zitadel/zitadel/internal/api/authz"
|
||||||
|
"github.com/zitadel/zitadel/internal/domain"
|
||||||
|
"github.com/zitadel/zitadel/internal/telemetry/tracing"
|
||||||
|
"github.com/zitadel/zitadel/internal/zerrors"
|
||||||
|
)
|
||||||
|
|
||||||
|
type UsersByMetadataSearchQueries struct {
|
||||||
|
SearchRequest
|
||||||
|
Queries []SearchQuery
|
||||||
|
}
|
||||||
|
|
||||||
|
type UserByMetadata struct {
|
||||||
|
ResourceOwner string `json:"resource_owner,omitempty"`
|
||||||
|
Key string `json:"key,omitempty"`
|
||||||
|
Value []byte `json:"value,omitempty"`
|
||||||
|
User *User `json:"user,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type UsersByMetadata struct {
|
||||||
|
SearchResponse
|
||||||
|
UsersByMeta []*UserByMetadata
|
||||||
|
}
|
||||||
|
|
||||||
|
func (q *Queries) SearchUsersByMetadata(ctx context.Context, queries *UsersByMetadataSearchQueries, permissionCheck domain.PermissionCheck) (usersByMeta *UsersByMetadata, err error) {
|
||||||
|
ctx, span := tracing.NewSpan(ctx)
|
||||||
|
defer func() { span.EndWithError(err) }()
|
||||||
|
|
||||||
|
permissionCheckV2 := PermissionV2(ctx, permissionCheck)
|
||||||
|
|
||||||
|
query, scan := prepareUserByMetadataListQuery()
|
||||||
|
query = userPermissionCheckV2(ctx, query, permissionCheckV2, queries.Queries)
|
||||||
|
|
||||||
|
for _, q := range queries.Queries {
|
||||||
|
query = q.toQuery(query)
|
||||||
|
}
|
||||||
|
|
||||||
|
eq := sq.Eq{
|
||||||
|
UserMetadataInstanceIDCol.identifier(): authz.GetInstance(ctx).InstanceID(),
|
||||||
|
}
|
||||||
|
|
||||||
|
stmt, args, err := queries.toQuery(query).Where(eq).ToSql()
|
||||||
|
if err != nil {
|
||||||
|
return nil, zerrors.ThrowInternal(err, "QUERY-J1CvYA", "Errors.Query.SQLStatement")
|
||||||
|
}
|
||||||
|
|
||||||
|
err = q.client.QueryContext(ctx, func(rows *sql.Rows) error {
|
||||||
|
usersByMeta, err = scan(rows)
|
||||||
|
return err
|
||||||
|
}, stmt, args...)
|
||||||
|
if err != nil {
|
||||||
|
logging.Errorf("Got error: %v", err)
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
if permissionCheck != nil && !authz.GetFeatures(ctx).PermissionCheckV2 {
|
||||||
|
usersByMetadataCheckPermission(ctx, usersByMeta, permissionCheck)
|
||||||
|
}
|
||||||
|
|
||||||
|
return usersByMeta, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func prepareUserByMetadataListQuery() (sq.SelectBuilder, func(*sql.Rows) (*UsersByMetadata, error)) {
|
||||||
|
return sq.Select(
|
||||||
|
UserMetadataKeyCol.identifier(),
|
||||||
|
UserMetadataValueCol.identifier(),
|
||||||
|
|
||||||
|
UserIDCol.identifier(),
|
||||||
|
UserStateCol.identifier(),
|
||||||
|
UserUsernameCol.identifier(),
|
||||||
|
UserTypeCol.identifier(),
|
||||||
|
|
||||||
|
HumanUserIDCol.identifier(),
|
||||||
|
HumanFirstNameCol.identifier(),
|
||||||
|
HumanLastNameCol.identifier(),
|
||||||
|
HumanNickNameCol.identifier(),
|
||||||
|
HumanDisplayNameCol.identifier(),
|
||||||
|
HumanPreferredLanguageCol.identifier(),
|
||||||
|
HumanGenderCol.identifier(),
|
||||||
|
HumanAvatarURLCol.identifier(),
|
||||||
|
HumanEmailCol.identifier(),
|
||||||
|
HumanIsEmailVerifiedCol.identifier(),
|
||||||
|
HumanPhoneCol.identifier(),
|
||||||
|
HumanIsPhoneVerifiedCol.identifier(),
|
||||||
|
HumanPasswordChangeRequiredCol.identifier(),
|
||||||
|
HumanPasswordChangedCol.identifier(),
|
||||||
|
HumanMFAInitSkippedCol.identifier(),
|
||||||
|
|
||||||
|
MachineUserIDCol.identifier(),
|
||||||
|
MachineNameCol.identifier(),
|
||||||
|
MachineDescriptionCol.identifier(),
|
||||||
|
MachineSecretCol.identifier(),
|
||||||
|
MachineAccessTokenTypeCol.identifier(),
|
||||||
|
|
||||||
|
countColumn.identifier()).
|
||||||
|
From(userMetadataTable.identifier()).
|
||||||
|
Join(join(UserIDCol, UserMetadataUserIDCol)).
|
||||||
|
LeftJoin(join(HumanUserIDCol, UserIDCol)).
|
||||||
|
LeftJoin(join(MachineUserIDCol, UserIDCol)).
|
||||||
|
PlaceholderFormat(sq.Dollar),
|
||||||
|
func(rows *sql.Rows) (*UsersByMetadata, error) {
|
||||||
|
usersByMeta := make([]*UserByMetadata, 0)
|
||||||
|
var count uint64
|
||||||
|
for rows.Next() {
|
||||||
|
userByMeta := new(UserByMetadata)
|
||||||
|
userByMeta.User = new(User)
|
||||||
|
userByMeta.User.Human = new(Human)
|
||||||
|
userByMeta.User.Machine = new(Machine)
|
||||||
|
|
||||||
|
human, machine := sqlHuman{}, sqlMachine{}
|
||||||
|
|
||||||
|
err := rows.Scan(
|
||||||
|
&userByMeta.Key,
|
||||||
|
&userByMeta.Value,
|
||||||
|
|
||||||
|
&userByMeta.User.ID,
|
||||||
|
&userByMeta.User.State,
|
||||||
|
&userByMeta.User.Username,
|
||||||
|
&userByMeta.User.Type,
|
||||||
|
|
||||||
|
&human.humanID,
|
||||||
|
&human.firstName,
|
||||||
|
&human.lastName,
|
||||||
|
&human.nickName,
|
||||||
|
&human.displayName,
|
||||||
|
&human.preferredLanguage,
|
||||||
|
&human.gender,
|
||||||
|
&human.avatarKey,
|
||||||
|
&human.email,
|
||||||
|
&human.isEmailVerified,
|
||||||
|
&human.phone,
|
||||||
|
&human.isPhoneVerified,
|
||||||
|
&human.passwordChangeRequired,
|
||||||
|
&human.passwordChanged,
|
||||||
|
&human.mfaInitSkipped,
|
||||||
|
|
||||||
|
&machine.machineID,
|
||||||
|
&machine.name,
|
||||||
|
&machine.description,
|
||||||
|
&machine.encodedSecret,
|
||||||
|
&machine.accessTokenType,
|
||||||
|
|
||||||
|
&count,
|
||||||
|
)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
if human.humanID.Valid {
|
||||||
|
userByMeta.User.Human.FirstName = human.firstName.String
|
||||||
|
userByMeta.User.Human.LastName = human.lastName.String
|
||||||
|
userByMeta.User.Human.NickName = human.nickName.String
|
||||||
|
userByMeta.User.Human.DisplayName = human.displayName.String
|
||||||
|
|
||||||
|
userByMeta.User.Human.PreferredLanguage, err = language.Parse(human.preferredLanguage.String)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
userByMeta.User.Human.Gender = domain.Gender(human.gender.Int32)
|
||||||
|
userByMeta.User.Human.AvatarKey = human.avatarKey.String
|
||||||
|
userByMeta.User.Human.Email = domain.EmailAddress(human.email.String)
|
||||||
|
userByMeta.User.Human.IsEmailVerified = human.isEmailVerified.Bool
|
||||||
|
userByMeta.User.Human.Phone = domain.PhoneNumber(human.phone.String)
|
||||||
|
userByMeta.User.Human.IsPhoneVerified = human.isPhoneVerified.Bool
|
||||||
|
userByMeta.User.Human.PasswordChangeRequired = human.passwordChangeRequired.Bool
|
||||||
|
userByMeta.User.Human.PasswordChanged = human.passwordChanged.Time
|
||||||
|
userByMeta.User.Human.MFAInitSkipped = human.mfaInitSkipped.Time
|
||||||
|
}
|
||||||
|
|
||||||
|
if machine.machineID.Valid {
|
||||||
|
userByMeta.User.Machine.Name = machine.name.String
|
||||||
|
userByMeta.User.Machine.Description = machine.description.String
|
||||||
|
userByMeta.User.Machine.EncodedSecret = machine.encodedSecret.String
|
||||||
|
userByMeta.User.Machine.AccessTokenType = domain.OIDCTokenType(machine.accessTokenType.Int32)
|
||||||
|
}
|
||||||
|
|
||||||
|
usersByMeta = append(usersByMeta, userByMeta)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := rows.Close(); err != nil {
|
||||||
|
return nil, zerrors.ThrowInternal(err, "QUERY-hwTK0J", "Errors.Query.CloseRows")
|
||||||
|
}
|
||||||
|
|
||||||
|
return &UsersByMetadata{
|
||||||
|
UsersByMeta: usersByMeta,
|
||||||
|
SearchResponse: SearchResponse{
|
||||||
|
Count: count,
|
||||||
|
},
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func usersByMetadataCheckPermission(ctx context.Context, users *UsersByMetadata, permissionCheck domain.PermissionCheck) {
|
||||||
|
users.UsersByMeta = slices.DeleteFunc(users.UsersByMeta,
|
||||||
|
func(user *UserByMetadata) bool {
|
||||||
|
return userCheckPermission(ctx, user.ResourceOwner, user.User.ID, permissionCheck) != nil
|
||||||
|
},
|
||||||
|
)
|
||||||
|
}
|
||||||
847
internal/query/users_by_metadata_test.go
Normal file
847
internal/query/users_by_metadata_test.go
Normal file
@@ -0,0 +1,847 @@
|
|||||||
|
package query
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"database/sql/driver"
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"regexp"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"github.com/DATA-DOG/go-sqlmock"
|
||||||
|
"github.com/stretchr/testify/assert"
|
||||||
|
"github.com/stretchr/testify/require"
|
||||||
|
"golang.org/x/text/language"
|
||||||
|
|
||||||
|
"github.com/zitadel/zitadel/internal/api/authz"
|
||||||
|
"github.com/zitadel/zitadel/internal/database"
|
||||||
|
"github.com/zitadel/zitadel/internal/domain"
|
||||||
|
permissionmock "github.com/zitadel/zitadel/internal/domain/mock"
|
||||||
|
"github.com/zitadel/zitadel/internal/feature"
|
||||||
|
)
|
||||||
|
|
||||||
|
var columns = []string{
|
||||||
|
"projections.user_metadata5.key",
|
||||||
|
"projections.user_metadata5.value",
|
||||||
|
"projections.users14.id",
|
||||||
|
"projections.users14.state",
|
||||||
|
"projections.users14.username",
|
||||||
|
"projections.users14.type",
|
||||||
|
"projections.users14_humans.user_id",
|
||||||
|
"projections.users14_humans.first_name",
|
||||||
|
"projections.users14_humans.last_name",
|
||||||
|
"projections.users14_humans.nick_name",
|
||||||
|
"projections.users14_humans.display_name",
|
||||||
|
"projections.users14_humans.preferred_language",
|
||||||
|
"projections.users14_humans.gender",
|
||||||
|
"projections.users14_humans.avatar_key",
|
||||||
|
"projections.users14_humans.email",
|
||||||
|
"projections.users14_humans.is_email_verified",
|
||||||
|
"projections.users14_humans.phone",
|
||||||
|
"projections.users14_humans.is_phone_verified",
|
||||||
|
"projections.users14_humans.password_change_required",
|
||||||
|
"projections.users14_humans.password_changed",
|
||||||
|
"projections.users14_humans.mfa_init_skipped",
|
||||||
|
"projections.users14_machines.user_id",
|
||||||
|
"projections.users14_machines.name",
|
||||||
|
"projections.users14_machines.description",
|
||||||
|
"projections.users14_machines.secret",
|
||||||
|
"projections.users14_machines.access_token_type",
|
||||||
|
"COUNT(*) OVER ()",
|
||||||
|
}
|
||||||
|
|
||||||
|
const baseQuery = `SELECT projections.user_metadata5.key, projections.user_metadata5.value,
|
||||||
|
projections.users14.id, projections.users14.state, projections.users14.username, projections.users14.type,
|
||||||
|
projections.users14_humans.user_id, projections.users14_humans.first_name, projections.users14_humans.last_name, projections.users14_humans.nick_name, projections.users14_humans.display_name, projections.users14_humans.preferred_language, projections.users14_humans.gender, projections.users14_humans.avatar_key, projections.users14_humans.email, projections.users14_humans.is_email_verified, projections.users14_humans.phone, projections.users14_humans.is_phone_verified, projections.users14_humans.password_change_required, projections.users14_humans.password_changed, projections.users14_humans.mfa_init_skipped,
|
||||||
|
projections.users14_machines.user_id, projections.users14_machines.name, projections.users14_machines.description, projections.users14_machines.secret, projections.users14_machines.access_token_type,
|
||||||
|
COUNT(*) OVER ()
|
||||||
|
FROM projections.user_metadata5
|
||||||
|
JOIN projections.users14 ON projections.user_metadata5.user_id = projections.users14.id
|
||||||
|
AND projections.user_metadata5.instance_id = projections.users14.instance_id
|
||||||
|
LEFT JOIN projections.users14_humans ON projections.users14.id = projections.users14_humans.user_id
|
||||||
|
AND projections.users14.instance_id = projections.users14_humans.instance_id
|
||||||
|
LEFT JOIN projections.users14_machines ON projections.users14.id = projections.users14_machines.user_id
|
||||||
|
AND projections.users14.instance_id = projections.users14_machines.instance_id
|
||||||
|
`
|
||||||
|
|
||||||
|
const permissionQuery = `INNER JOIN eventstore.permitted_orgs($1, $2, $3, $4, $5) permissions ON (permissions.instance_permitted OR projections.users14.resource_owner = ANY(permissions.org_ids) OR projections.users14.id = $6)`
|
||||||
|
|
||||||
|
func TestUsersByMetadata(t *testing.T) {
|
||||||
|
t.Parallel()
|
||||||
|
|
||||||
|
tt := []struct {
|
||||||
|
testName string
|
||||||
|
|
||||||
|
inputCtx context.Context
|
||||||
|
inputQueriesFunc func(*testing.T) *UsersByMetadataSearchQueries
|
||||||
|
inputPermissionCheckMock domain.PermissionCheck
|
||||||
|
|
||||||
|
mockMatcher sqlmock.QueryMatcher
|
||||||
|
mockExpectations func(*sqlmock.ExpectedQuery) *sqlmock.ExpectedQuery
|
||||||
|
|
||||||
|
expectedQuery string
|
||||||
|
expectedUsersByMeta *UsersByMetadata
|
||||||
|
expectedError error
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
testName: "sql should return error",
|
||||||
|
inputCtx: authz.NewMockContext("instance-1", "org-1", "user-1"),
|
||||||
|
inputQueriesFunc: func(t *testing.T) *UsersByMetadataSearchQueries {
|
||||||
|
keyQ, err := NewUserMetadataKeySearchQuery("test key", TextEquals)
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
return &UsersByMetadataSearchQueries{
|
||||||
|
Queries: []SearchQuery{keyQ},
|
||||||
|
}
|
||||||
|
},
|
||||||
|
mockExpectations: func(q *sqlmock.ExpectedQuery) *sqlmock.ExpectedQuery {
|
||||||
|
return q.WithArgs("test key", "instance-1").WillReturnError(errors.New("mocked error"))
|
||||||
|
},
|
||||||
|
mockMatcher: &baseMatcher{},
|
||||||
|
expectedQuery: baseQuery,
|
||||||
|
expectedError: errors.New("mocked error"),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
testName: "v2 perms disabled/matching by key should return 2 records/permission granted",
|
||||||
|
inputCtx: authz.NewMockContext("instance-1", "org-1", "user-1"),
|
||||||
|
inputPermissionCheckMock: permissionmock.MockPermissionCheckOK(),
|
||||||
|
inputQueriesFunc: func(t *testing.T) *UsersByMetadataSearchQueries {
|
||||||
|
keyQ, err := NewUserMetadataKeySearchQuery("test key", TextEquals)
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
return &UsersByMetadataSearchQueries{
|
||||||
|
Queries: []SearchQuery{keyQ},
|
||||||
|
}
|
||||||
|
},
|
||||||
|
mockExpectations: func(q *sqlmock.ExpectedQuery) *sqlmock.ExpectedQuery {
|
||||||
|
results := sqlmock.NewRows(columns)
|
||||||
|
results.AddRows(
|
||||||
|
[]driver.Value{
|
||||||
|
// user_metadata5.key, user_metadata5.value, users14.id, users14.state, users14.username, users14.type
|
||||||
|
"test key", "test value 1", "id-1", domain.UserStateActive, "username 1", domain.UserTypeHuman,
|
||||||
|
// users14_humans.user_id, users14_humans.first_name, users14_humans.last_name, users14_humans.nick_name, users14_humans.display_name, users14_humans.preferred_language, users14_humans.gender, users14_humans.avatar_key, users14_humans.email, users14_humans.is_email_verified, users14_humans.phone, users14_humans.is_phone_verified, users14_humans.password_change_required, users14_humans.password_changed, users14_humans.mfa_init_skipped
|
||||||
|
"id-1", "User", "Name", "Nickyname", "User 'Nickyname' Name", "it", domain.GenderMale, "avatar_key", "nicky@username.com", true, "12345678", true, false, nil, nil,
|
||||||
|
// users14_machines.user_id, users14_machines.name, users14_machines.description, users14_machines.secret, users14_machines.access_token_type
|
||||||
|
nil, nil, nil, nil, nil,
|
||||||
|
// COUNT(*) OVER ()
|
||||||
|
2,
|
||||||
|
},
|
||||||
|
[]driver.Value{
|
||||||
|
// user_metadata5.key, user_metadata5.value, users14.id, users14.state, users14.username, users14.type
|
||||||
|
"test key", "test value 2", "id-2", domain.UserStateActive, "username 2", domain.UserTypeMachine,
|
||||||
|
// users14_humans.user_id, users14_humans.first_name, users14_humans.last_name, users14_humans.nick_name, users14_humans.display_name, users14_humans.preferred_language, users14_humans.gender, users14_humans.avatar_key, users14_humans.email, users14_humans.is_email_verified, users14_humans.phone, users14_humans.is_phone_verified, users14_humans.password_change_required, users14_humans.password_changed, users14_humans.mfa_init_skipped
|
||||||
|
nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil,
|
||||||
|
// users14_machines.user_id, users14_machines.name, users14_machines.description, users14_machines.secret, users14_machines.access_token_type
|
||||||
|
"id-2", "robot", "this is a robot", "giga secret 1234!", domain.OIDCTokenTypeJWT,
|
||||||
|
// COUNT(*) OVER ()
|
||||||
|
2,
|
||||||
|
},
|
||||||
|
)
|
||||||
|
return q.WithArgs("test key", "instance-1").WillReturnRows(results)
|
||||||
|
},
|
||||||
|
mockMatcher: &whereMatcher{matcher: &baseMatcher{}, toMatch: "user_metadata5.key"},
|
||||||
|
expectedQuery: baseQuery,
|
||||||
|
expectedUsersByMeta: &UsersByMetadata{
|
||||||
|
SearchResponse: SearchResponse{Count: 2},
|
||||||
|
UsersByMeta: []*UserByMetadata{
|
||||||
|
{
|
||||||
|
ResourceOwner: "",
|
||||||
|
Key: "test key",
|
||||||
|
Value: []byte("test value 1"),
|
||||||
|
User: humanUser("id-1", "username 1", "User", "Name", "Nickyname", "nicky@username.com", domain.UserStateActive),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
ResourceOwner: "",
|
||||||
|
Key: "test key",
|
||||||
|
Value: []byte("test value 2"),
|
||||||
|
User: machineUser("id-2", "username 2", "robot", "this is a robot", "giga secret 1234!", domain.OIDCTokenTypeJWT, domain.UserStateActive),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
testName: "v2 perms disabled/matching by key should return 2 records/permission denied/empty result",
|
||||||
|
inputCtx: authz.NewMockContext("instance-1", "org-1", "user-1"),
|
||||||
|
inputPermissionCheckMock: permissionmock.MockPermissionCheckErr(errors.New("permission denied")),
|
||||||
|
inputQueriesFunc: func(t *testing.T) *UsersByMetadataSearchQueries {
|
||||||
|
keyQ, err := NewUserMetadataKeySearchQuery("test key", TextEquals)
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
return &UsersByMetadataSearchQueries{
|
||||||
|
Queries: []SearchQuery{keyQ},
|
||||||
|
}
|
||||||
|
},
|
||||||
|
mockMatcher: &whereMatcher{matcher: &baseMatcher{}, toMatch: "user_metadata5.key"},
|
||||||
|
mockExpectations: func(q *sqlmock.ExpectedQuery) *sqlmock.ExpectedQuery {
|
||||||
|
results := sqlmock.NewRows(columns)
|
||||||
|
results.AddRows(
|
||||||
|
[]driver.Value{
|
||||||
|
// user_metadata5.key, user_metadata5.value, users14.id, users14.state, users14.username, users14.type
|
||||||
|
"test key", "test value 1", "id-1", domain.UserStateActive, "username 1", domain.UserTypeHuman,
|
||||||
|
// users14_humans.user_id, users14_humans.first_name, users14_humans.last_name, users14_humans.nick_name, users14_humans.display_name, users14_humans.preferred_language, users14_humans.gender, users14_humans.avatar_key, users14_humans.email, users14_humans.is_email_verified, users14_humans.phone, users14_humans.is_phone_verified, users14_humans.password_change_required, users14_humans.password_changed, users14_humans.mfa_init_skipped
|
||||||
|
"id-1", "User", "Name", "Nickyname", "User 'Nickyname' Name", "it", domain.GenderMale, "avatar_key", "nicky@username.com", true, "12345678", true, false, nil, nil,
|
||||||
|
// users14_machines.user_id, users14_machines.name, users14_machines.description, users14_machines.secret, users14_machines.access_token_type
|
||||||
|
nil, nil, nil, nil, nil,
|
||||||
|
// COUNT(*) OVER ()
|
||||||
|
2,
|
||||||
|
},
|
||||||
|
[]driver.Value{
|
||||||
|
// user_metadata5.key, user_metadata5.value, users14.id, users14.state, users14.username, users14.type
|
||||||
|
"test key", "test value 2", "id-2", domain.UserStateActive, "username 2", domain.UserTypeMachine,
|
||||||
|
// users14_humans.user_id, users14_humans.first_name, users14_humans.last_name, users14_humans.nick_name, users14_humans.display_name, users14_humans.preferred_language, users14_humans.gender, users14_humans.avatar_key, users14_humans.email, users14_humans.is_email_verified, users14_humans.phone, users14_humans.is_phone_verified, users14_humans.password_change_required, users14_humans.password_changed, users14_humans.mfa_init_skipped
|
||||||
|
nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil,
|
||||||
|
// users14_machines.user_id, users14_machines.name, users14_machines.description, users14_machines.secret, users14_machines.access_token_type
|
||||||
|
"id-2", "robot", "this is a robot", "giga secret 1234!", domain.OIDCTokenTypeJWT,
|
||||||
|
// COUNT(*) OVER ()
|
||||||
|
2,
|
||||||
|
},
|
||||||
|
)
|
||||||
|
return q.WithArgs("test key", "instance-1").WillReturnRows(results)
|
||||||
|
},
|
||||||
|
expectedQuery: baseQuery,
|
||||||
|
expectedUsersByMeta: &UsersByMetadata{
|
||||||
|
SearchResponse: SearchResponse{Count: 2},
|
||||||
|
UsersByMeta: []*UserByMetadata{},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
testName: "v2 perms disabled/matching by key ignore case should return 2 records/permission granted",
|
||||||
|
inputCtx: authz.NewMockContext("instance-1", "org-1", "user-1"),
|
||||||
|
inputPermissionCheckMock: permissionmock.MockPermissionCheckOK(),
|
||||||
|
inputQueriesFunc: func(t *testing.T) *UsersByMetadataSearchQueries {
|
||||||
|
keyQ, err := NewUserMetadataKeySearchQuery("Test key", TextEqualsIgnoreCase)
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
return &UsersByMetadataSearchQueries{
|
||||||
|
Queries: []SearchQuery{keyQ},
|
||||||
|
}
|
||||||
|
},
|
||||||
|
mockMatcher: &whereMatcher{matcher: &baseMatcher{}, toMatch: "LOWER(projections.user_metadata5.key)"},
|
||||||
|
mockExpectations: func(q *sqlmock.ExpectedQuery) *sqlmock.ExpectedQuery {
|
||||||
|
results := sqlmock.NewRows(columns)
|
||||||
|
results.AddRows(
|
||||||
|
[]driver.Value{
|
||||||
|
// user_metadata5.key, user_metadata5.value, users14.id, users14.state, users14.username, users14.type
|
||||||
|
"test key", "test value 1", "id-1", domain.UserStateActive, "username 1", domain.UserTypeHuman,
|
||||||
|
// users14_humans.user_id, users14_humans.first_name, users14_humans.last_name, users14_humans.nick_name, users14_humans.display_name, users14_humans.preferred_language, users14_humans.gender, users14_humans.avatar_key, users14_humans.email, users14_humans.is_email_verified, users14_humans.phone, users14_humans.is_phone_verified, users14_humans.password_change_required, users14_humans.password_changed, users14_humans.mfa_init_skipped
|
||||||
|
"id-1", "User", "Name", "Nickyname", "User 'Nickyname' Name", "it", domain.GenderMale, "avatar_key", "nicky@username.com", true, "12345678", true, false, nil, nil,
|
||||||
|
// users14_machines.user_id, users14_machines.name, users14_machines.description, users14_machines.secret, users14_machines.access_token_type
|
||||||
|
nil, nil, nil, nil, nil,
|
||||||
|
// COUNT(*) OVER ()
|
||||||
|
2,
|
||||||
|
},
|
||||||
|
[]driver.Value{
|
||||||
|
// user_metadata5.key, user_metadata5.value, users14.id, users14.state, users14.username, users14.type
|
||||||
|
"Test key", "test value 2", "id-2", domain.UserStateActive, "username 2", domain.UserTypeMachine,
|
||||||
|
// users14_humans.user_id, users14_humans.first_name, users14_humans.last_name, users14_humans.nick_name, users14_humans.display_name, users14_humans.preferred_language, users14_humans.gender, users14_humans.avatar_key, users14_humans.email, users14_humans.is_email_verified, users14_humans.phone, users14_humans.is_phone_verified, users14_humans.password_change_required, users14_humans.password_changed, users14_humans.mfa_init_skipped
|
||||||
|
nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil,
|
||||||
|
// users14_machines.user_id, users14_machines.name, users14_machines.description, users14_machines.secret, users14_machines.access_token_type
|
||||||
|
"id-2", "robot", "this is a robot", "giga secret 1234!", domain.OIDCTokenTypeJWT,
|
||||||
|
// COUNT(*) OVER ()
|
||||||
|
2,
|
||||||
|
},
|
||||||
|
)
|
||||||
|
return q.WithArgs("test key", "instance-1").WillReturnRows(results)
|
||||||
|
},
|
||||||
|
expectedQuery: baseQuery,
|
||||||
|
expectedUsersByMeta: &UsersByMetadata{
|
||||||
|
SearchResponse: SearchResponse{Count: 2},
|
||||||
|
UsersByMeta: []*UserByMetadata{
|
||||||
|
{
|
||||||
|
ResourceOwner: "",
|
||||||
|
Key: "test key",
|
||||||
|
Value: []byte("test value 1"),
|
||||||
|
User: humanUser("id-1", "username 1", "User", "Name", "Nickyname", "nicky@username.com", domain.UserStateActive),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
ResourceOwner: "",
|
||||||
|
Key: "Test key",
|
||||||
|
Value: []byte("test value 2"),
|
||||||
|
User: machineUser("id-2", "username 2", "robot", "this is a robot", "giga secret 1234!", domain.OIDCTokenTypeJWT, domain.UserStateActive),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
testName: "v2 perms enabled/matching by key ignore case should return 2 records",
|
||||||
|
inputCtx: authz.NewMockContext("instance-1", "org-1", "user-1", authz.WithMockFeatures(feature.Features{PermissionCheckV2: true})),
|
||||||
|
inputPermissionCheckMock: permissionmock.MockPermissionCheckOK(),
|
||||||
|
inputQueriesFunc: func(t *testing.T) *UsersByMetadataSearchQueries {
|
||||||
|
keyQ, err := NewUserMetadataKeySearchQuery("Test key", TextEqualsIgnoreCase)
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
return &UsersByMetadataSearchQueries{
|
||||||
|
Queries: []SearchQuery{keyQ},
|
||||||
|
}
|
||||||
|
},
|
||||||
|
mockExpectations: func(q *sqlmock.ExpectedQuery) *sqlmock.ExpectedQuery {
|
||||||
|
results := sqlmock.NewRows(columns)
|
||||||
|
results.AddRows(
|
||||||
|
[]driver.Value{
|
||||||
|
// user_metadata5.key, user_metadata5.value, users14.id, users14.state, users14.username, users14.type
|
||||||
|
"test key", "test value 1", "id-1", domain.UserStateActive, "username 1", domain.UserTypeHuman,
|
||||||
|
// users14_humans.user_id, users14_humans.first_name, users14_humans.last_name, users14_humans.nick_name, users14_humans.display_name, users14_humans.preferred_language, users14_humans.gender, users14_humans.avatar_key, users14_humans.email, users14_humans.is_email_verified, users14_humans.phone, users14_humans.is_phone_verified, users14_humans.password_change_required, users14_humans.password_changed, users14_humans.mfa_init_skipped
|
||||||
|
"id-1", "User", "Name", "Nickyname", "User 'Nickyname' Name", "it", domain.GenderMale, "avatar_key", "nicky@username.com", true, "12345678", true, false, nil, nil,
|
||||||
|
// users14_machines.user_id, users14_machines.name, users14_machines.description, users14_machines.secret, users14_machines.access_token_type
|
||||||
|
nil, nil, nil, nil, nil,
|
||||||
|
// COUNT(*) OVER ()
|
||||||
|
2,
|
||||||
|
},
|
||||||
|
[]driver.Value{
|
||||||
|
// user_metadata5.key, user_metadata5.value, users14.id, users14.state, users14.username, users14.type
|
||||||
|
"Test key", "test value 2", "id-2", domain.UserStateActive, "username 2", domain.UserTypeMachine,
|
||||||
|
// users14_humans.user_id, users14_humans.first_name, users14_humans.last_name, users14_humans.nick_name, users14_humans.display_name, users14_humans.preferred_language, users14_humans.gender, users14_humans.avatar_key, users14_humans.email, users14_humans.is_email_verified, users14_humans.phone, users14_humans.is_phone_verified, users14_humans.password_change_required, users14_humans.password_changed, users14_humans.mfa_init_skipped
|
||||||
|
nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil,
|
||||||
|
// users14_machines.user_id, users14_machines.name, users14_machines.description, users14_machines.secret, users14_machines.access_token_type
|
||||||
|
"id-2", "robot", "this is a robot", "giga secret 1234!", domain.OIDCTokenTypeJWT,
|
||||||
|
// COUNT(*) OVER ()
|
||||||
|
2,
|
||||||
|
},
|
||||||
|
)
|
||||||
|
return q.
|
||||||
|
WithArgs("instance-1", "user-1", sqlmock.AnyArg(), domain.PermissionUserRead, sqlmock.AnyArg(), "user-1", "test key", "instance-1").
|
||||||
|
WillReturnRows(results)
|
||||||
|
},
|
||||||
|
mockMatcher: &whereMatcher{matcher: &baseMatcher{}, toMatch: "LOWER(projections.user_metadata5.key)"},
|
||||||
|
expectedQuery: baseQuery + permissionQuery,
|
||||||
|
expectedUsersByMeta: &UsersByMetadata{
|
||||||
|
SearchResponse: SearchResponse{Count: 2},
|
||||||
|
UsersByMeta: []*UserByMetadata{
|
||||||
|
{
|
||||||
|
ResourceOwner: "",
|
||||||
|
Key: "test key",
|
||||||
|
Value: []byte("test value 1"),
|
||||||
|
User: humanUser("id-1", "username 1", "User", "Name", "Nickyname", "nicky@username.com", domain.UserStateActive),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
ResourceOwner: "",
|
||||||
|
Key: "Test key",
|
||||||
|
Value: []byte("test value 2"),
|
||||||
|
User: machineUser("id-2", "username 2", "robot", "this is a robot", "giga secret 1234!", domain.OIDCTokenTypeJWT, domain.UserStateActive),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
testName: "v2 perms enabled/matching by OR-ed keys should return 2 records",
|
||||||
|
inputCtx: authz.NewMockContext("instance-1", "org-1", "user-1", authz.WithMockFeatures(feature.Features{PermissionCheckV2: true})),
|
||||||
|
inputPermissionCheckMock: permissionmock.MockPermissionCheckOK(),
|
||||||
|
inputQueriesFunc: func(t *testing.T) *UsersByMetadataSearchQueries {
|
||||||
|
keyQ1, err := NewUserMetadataKeySearchQuery("test key 1", TextEqualsIgnoreCase)
|
||||||
|
require.NoError(t, err)
|
||||||
|
keyQ2, err := NewUserMetadataKeySearchQuery("test key 2", TextEqualsIgnoreCase)
|
||||||
|
require.NoError(t, err)
|
||||||
|
orQ, err := NewOrQuery(keyQ1, keyQ2)
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
return &UsersByMetadataSearchQueries{
|
||||||
|
Queries: []SearchQuery{orQ},
|
||||||
|
}
|
||||||
|
},
|
||||||
|
mockExpectations: func(q *sqlmock.ExpectedQuery) *sqlmock.ExpectedQuery {
|
||||||
|
results := sqlmock.NewRows(columns)
|
||||||
|
results.AddRows(
|
||||||
|
[]driver.Value{
|
||||||
|
// user_metadata5.key, user_metadata5.value, users14.id, users14.state, users14.username, users14.type
|
||||||
|
"test key 1", "test value 1", "id-1", domain.UserStateActive, "username 1", domain.UserTypeHuman,
|
||||||
|
// users14_humans.user_id, users14_humans.first_name, users14_humans.last_name, users14_humans.nick_name, users14_humans.display_name, users14_humans.preferred_language, users14_humans.gender, users14_humans.avatar_key, users14_humans.email, users14_humans.is_email_verified, users14_humans.phone, users14_humans.is_phone_verified, users14_humans.password_change_required, users14_humans.password_changed, users14_humans.mfa_init_skipped
|
||||||
|
"id-1", "User", "Name", "Nickyname", "User 'Nickyname' Name", "it", domain.GenderMale, "avatar_key", "nicky@username.com", true, "12345678", true, false, nil, nil,
|
||||||
|
// users14_machines.user_id, users14_machines.name, users14_machines.description, users14_machines.secret, users14_machines.access_token_type
|
||||||
|
nil, nil, nil, nil, nil,
|
||||||
|
// COUNT(*) OVER ()
|
||||||
|
2,
|
||||||
|
},
|
||||||
|
[]driver.Value{
|
||||||
|
// user_metadata5.key, user_metadata5.value, users14.id, users14.state, users14.username, users14.type
|
||||||
|
"test key 2", "test value 2", "id-2", domain.UserStateActive, "username 2", domain.UserTypeMachine,
|
||||||
|
// users14_humans.user_id, users14_humans.first_name, users14_humans.last_name, users14_humans.nick_name, users14_humans.display_name, users14_humans.preferred_language, users14_humans.gender, users14_humans.avatar_key, users14_humans.email, users14_humans.is_email_verified, users14_humans.phone, users14_humans.is_phone_verified, users14_humans.password_change_required, users14_humans.password_changed, users14_humans.mfa_init_skipped
|
||||||
|
nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil,
|
||||||
|
// users14_machines.user_id, users14_machines.name, users14_machines.description, users14_machines.secret, users14_machines.access_token_type
|
||||||
|
"id-2", "robot", "this is a robot", "giga secret 1234!", domain.OIDCTokenTypeJWT,
|
||||||
|
// COUNT(*) OVER ()
|
||||||
|
2,
|
||||||
|
},
|
||||||
|
)
|
||||||
|
return q.
|
||||||
|
WithArgs("instance-1", "user-1", sqlmock.AnyArg(), domain.PermissionUserRead, sqlmock.AnyArg(), "user-1", "test key 1", "test key 2", "instance-1").
|
||||||
|
WillReturnRows(results)
|
||||||
|
},
|
||||||
|
mockMatcher: &whereMatcher{matcher: &baseMatcher{}, toMatch: "LOWER(projections.user_metadata5.key),OR"},
|
||||||
|
expectedQuery: baseQuery + permissionQuery,
|
||||||
|
expectedUsersByMeta: &UsersByMetadata{
|
||||||
|
SearchResponse: SearchResponse{Count: 2},
|
||||||
|
UsersByMeta: []*UserByMetadata{
|
||||||
|
{
|
||||||
|
ResourceOwner: "",
|
||||||
|
Key: "test key 1",
|
||||||
|
Value: []byte("test value 1"),
|
||||||
|
User: humanUser("id-1", "username 1", "User", "Name", "Nickyname", "nicky@username.com", domain.UserStateActive),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
ResourceOwner: "",
|
||||||
|
Key: "test key 2",
|
||||||
|
Value: []byte("test value 2"),
|
||||||
|
User: machineUser("id-2", "username 2", "robot", "this is a robot", "giga secret 1234!", domain.OIDCTokenTypeJWT, domain.UserStateActive),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
testName: "v2 perms enabled/matching by NOT-OR-ed keys should return 2 records",
|
||||||
|
inputCtx: authz.NewMockContext("instance-1", "org-1", "user-1", authz.WithMockFeatures(feature.Features{PermissionCheckV2: true})),
|
||||||
|
inputPermissionCheckMock: permissionmock.MockPermissionCheckOK(),
|
||||||
|
inputQueriesFunc: func(t *testing.T) *UsersByMetadataSearchQueries {
|
||||||
|
keyQ1, err := NewUserMetadataKeySearchQuery("unmatch key 1", TextEquals)
|
||||||
|
require.NoError(t, err)
|
||||||
|
keyQ2, err := NewUserMetadataKeySearchQuery("unmatch key 2", TextEquals)
|
||||||
|
require.NoError(t, err)
|
||||||
|
orQ, err := NewOrQuery(keyQ1, keyQ2)
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
notQ, err := NewNotQuery(orQ)
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
return &UsersByMetadataSearchQueries{
|
||||||
|
Queries: []SearchQuery{notQ},
|
||||||
|
}
|
||||||
|
},
|
||||||
|
mockExpectations: func(q *sqlmock.ExpectedQuery) *sqlmock.ExpectedQuery {
|
||||||
|
results := sqlmock.NewRows(columns)
|
||||||
|
results.AddRows(
|
||||||
|
[]driver.Value{
|
||||||
|
// user_metadata5.key, user_metadata5.value, users14.id, users14.state, users14.username, users14.type
|
||||||
|
"test key 1", "test value 1", "id-1", domain.UserStateActive, "username 1", domain.UserTypeHuman,
|
||||||
|
// users14_humans.user_id, users14_humans.first_name, users14_humans.last_name, users14_humans.nick_name, users14_humans.display_name, users14_humans.preferred_language, users14_humans.gender, users14_humans.avatar_key, users14_humans.email, users14_humans.is_email_verified, users14_humans.phone, users14_humans.is_phone_verified, users14_humans.password_change_required, users14_humans.password_changed, users14_humans.mfa_init_skipped
|
||||||
|
"id-1", "User", "Name", "Nickyname", "User 'Nickyname' Name", "it", domain.GenderMale, "avatar_key", "nicky@username.com", true, "12345678", true, false, nil, nil,
|
||||||
|
// users14_machines.user_id, users14_machines.name, users14_machines.description, users14_machines.secret, users14_machines.access_token_type
|
||||||
|
nil, nil, nil, nil, nil,
|
||||||
|
// COUNT(*) OVER ()
|
||||||
|
2,
|
||||||
|
},
|
||||||
|
[]driver.Value{
|
||||||
|
// user_metadata5.key, user_metadata5.value, users14.id, users14.state, users14.username, users14.type
|
||||||
|
"test key 2", "test value 2", "id-2", domain.UserStateActive, "username 2", domain.UserTypeMachine,
|
||||||
|
// users14_humans.user_id, users14_humans.first_name, users14_humans.last_name, users14_humans.nick_name, users14_humans.display_name, users14_humans.preferred_language, users14_humans.gender, users14_humans.avatar_key, users14_humans.email, users14_humans.is_email_verified, users14_humans.phone, users14_humans.is_phone_verified, users14_humans.password_change_required, users14_humans.password_changed, users14_humans.mfa_init_skipped
|
||||||
|
nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil,
|
||||||
|
// users14_machines.user_id, users14_machines.name, users14_machines.description, users14_machines.secret, users14_machines.access_token_type
|
||||||
|
"id-2", "robot", "this is a robot", "giga secret 1234!", domain.OIDCTokenTypeJWT,
|
||||||
|
// COUNT(*) OVER ()
|
||||||
|
2,
|
||||||
|
},
|
||||||
|
)
|
||||||
|
return q.
|
||||||
|
WithArgs("instance-1", "user-1", sqlmock.AnyArg(), domain.PermissionUserRead, sqlmock.AnyArg(), "user-1", "unmatch key 1", "unmatch key 2", "instance-1").
|
||||||
|
WillReturnRows(results)
|
||||||
|
},
|
||||||
|
mockMatcher: &whereMatcher{matcher: &baseMatcher{}, toMatch: "projections.user_metadata5.key,OR,NOT"},
|
||||||
|
expectedQuery: baseQuery + permissionQuery,
|
||||||
|
expectedUsersByMeta: &UsersByMetadata{
|
||||||
|
SearchResponse: SearchResponse{Count: 2},
|
||||||
|
UsersByMeta: []*UserByMetadata{
|
||||||
|
{
|
||||||
|
ResourceOwner: "",
|
||||||
|
Key: "test key 1",
|
||||||
|
Value: []byte("test value 1"),
|
||||||
|
User: humanUser("id-1", "username 1", "User", "Name", "Nickyname", "nicky@username.com", domain.UserStateActive),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
ResourceOwner: "",
|
||||||
|
Key: "test key 2",
|
||||||
|
Value: []byte("test value 2"),
|
||||||
|
User: machineUser("id-2", "username 2", "robot", "this is a robot", "giga secret 1234!", domain.OIDCTokenTypeJWT, domain.UserStateActive),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
testName: "v2 perms enabled/matching by NOT-AND-ed keys should return 2 records with limit",
|
||||||
|
inputCtx: authz.NewMockContext("instance-1", "org-1", "user-1", authz.WithMockFeatures(feature.Features{PermissionCheckV2: true})),
|
||||||
|
inputPermissionCheckMock: permissionmock.MockPermissionCheckOK(),
|
||||||
|
inputQueriesFunc: func(t *testing.T) *UsersByMetadataSearchQueries {
|
||||||
|
keyQ1, err := NewUserMetadataKeySearchQuery("unmatch key 1", TextEquals)
|
||||||
|
require.NoError(t, err)
|
||||||
|
keyQ2, err := NewUserMetadataKeySearchQuery("unmatch key 2", TextEquals)
|
||||||
|
require.NoError(t, err)
|
||||||
|
orQ, err := NewAndQuery(keyQ1, keyQ2)
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
notQ, err := NewNotQuery(orQ)
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
return &UsersByMetadataSearchQueries{
|
||||||
|
Queries: []SearchQuery{notQ},
|
||||||
|
SearchRequest: SearchRequest{
|
||||||
|
Limit: 2,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
},
|
||||||
|
mockExpectations: func(q *sqlmock.ExpectedQuery) *sqlmock.ExpectedQuery {
|
||||||
|
results := sqlmock.NewRows(columns)
|
||||||
|
results.AddRows(
|
||||||
|
[]driver.Value{
|
||||||
|
// user_metadata5.key, user_metadata5.value, users14.id, users14.state, users14.username, users14.type
|
||||||
|
"test key 1", "test value 1", "id-1", domain.UserStateActive, "username 1", domain.UserTypeHuman,
|
||||||
|
// users14_humans.user_id, users14_humans.first_name, users14_humans.last_name, users14_humans.nick_name, users14_humans.display_name, users14_humans.preferred_language, users14_humans.gender, users14_humans.avatar_key, users14_humans.email, users14_humans.is_email_verified, users14_humans.phone, users14_humans.is_phone_verified, users14_humans.password_change_required, users14_humans.password_changed, users14_humans.mfa_init_skipped
|
||||||
|
"id-1", "User", "Name", "Nickyname", "User 'Nickyname' Name", "it", domain.GenderMale, "avatar_key", "nicky@username.com", true, "12345678", true, false, nil, nil,
|
||||||
|
// users14_machines.user_id, users14_machines.name, users14_machines.description, users14_machines.secret, users14_machines.access_token_type
|
||||||
|
nil, nil, nil, nil, nil,
|
||||||
|
// COUNT(*) OVER ()
|
||||||
|
2,
|
||||||
|
},
|
||||||
|
[]driver.Value{
|
||||||
|
// user_metadata5.key, user_metadata5.value, users14.id, users14.state, users14.username, users14.type
|
||||||
|
"test key 2", "test value 2", "id-2", domain.UserStateActive, "username 2", domain.UserTypeMachine,
|
||||||
|
// users14_humans.user_id, users14_humans.first_name, users14_humans.last_name, users14_humans.nick_name, users14_humans.display_name, users14_humans.preferred_language, users14_humans.gender, users14_humans.avatar_key, users14_humans.email, users14_humans.is_email_verified, users14_humans.phone, users14_humans.is_phone_verified, users14_humans.password_change_required, users14_humans.password_changed, users14_humans.mfa_init_skipped
|
||||||
|
nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil,
|
||||||
|
// users14_machines.user_id, users14_machines.name, users14_machines.description, users14_machines.secret, users14_machines.access_token_type
|
||||||
|
"id-2", "robot", "this is a robot", "giga secret 1234!", domain.OIDCTokenTypeJWT,
|
||||||
|
// COUNT(*) OVER ()
|
||||||
|
2,
|
||||||
|
},
|
||||||
|
)
|
||||||
|
return q.
|
||||||
|
WithArgs("instance-1", "user-1", sqlmock.AnyArg(), domain.PermissionUserRead, sqlmock.AnyArg(), "user-1", "unmatch key 1", "unmatch key 2", "instance-1").
|
||||||
|
WillReturnRows(results)
|
||||||
|
},
|
||||||
|
mockMatcher: &limitMatcher{matcher: &whereMatcher{matcher: &baseMatcher{}, toMatch: "projections.user_metadata5.key,AND,NOT"}, expectedLimit: "2"},
|
||||||
|
expectedQuery: baseQuery + permissionQuery,
|
||||||
|
expectedUsersByMeta: &UsersByMetadata{
|
||||||
|
SearchResponse: SearchResponse{Count: 2},
|
||||||
|
UsersByMeta: []*UserByMetadata{
|
||||||
|
{
|
||||||
|
ResourceOwner: "",
|
||||||
|
Key: "test key 1",
|
||||||
|
Value: []byte("test value 1"),
|
||||||
|
User: humanUser("id-1", "username 1", "User", "Name", "Nickyname", "nicky@username.com", domain.UserStateActive),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
ResourceOwner: "",
|
||||||
|
Key: "test key 2",
|
||||||
|
Value: []byte("test value 2"),
|
||||||
|
User: machineUser("id-2", "username 2", "robot", "this is a robot", "giga secret 1234!", domain.OIDCTokenTypeJWT, domain.UserStateActive),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
testName: "v2 perms enabled/matching by NOT-AND-ed keys should return 2 records with limit and offset",
|
||||||
|
inputCtx: authz.NewMockContext("instance-1", "org-1", "user-1", authz.WithMockFeatures(feature.Features{PermissionCheckV2: true})),
|
||||||
|
inputPermissionCheckMock: permissionmock.MockPermissionCheckOK(),
|
||||||
|
inputQueriesFunc: func(t *testing.T) *UsersByMetadataSearchQueries {
|
||||||
|
keyQ1, err := NewUserMetadataKeySearchQuery("unmatch key 1", TextEquals)
|
||||||
|
require.NoError(t, err)
|
||||||
|
keyQ2, err := NewUserMetadataKeySearchQuery("unmatch key 2", TextEquals)
|
||||||
|
require.NoError(t, err)
|
||||||
|
orQ, err := NewAndQuery(keyQ1, keyQ2)
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
notQ, err := NewNotQuery(orQ)
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
return &UsersByMetadataSearchQueries{
|
||||||
|
Queries: []SearchQuery{notQ},
|
||||||
|
SearchRequest: SearchRequest{Limit: 2, Offset: 1},
|
||||||
|
}
|
||||||
|
},
|
||||||
|
mockExpectations: func(q *sqlmock.ExpectedQuery) *sqlmock.ExpectedQuery {
|
||||||
|
results := sqlmock.NewRows(columns)
|
||||||
|
results.AddRows(
|
||||||
|
[]driver.Value{
|
||||||
|
// user_metadata5.key, user_metadata5.value, users14.id, users14.state, users14.username, users14.type
|
||||||
|
"test key 1", "test value 1", "id-1", domain.UserStateActive, "username 1", domain.UserTypeHuman,
|
||||||
|
// users14_humans.user_id, users14_humans.first_name, users14_humans.last_name, users14_humans.nick_name, users14_humans.display_name, users14_humans.preferred_language, users14_humans.gender, users14_humans.avatar_key, users14_humans.email, users14_humans.is_email_verified, users14_humans.phone, users14_humans.is_phone_verified, users14_humans.password_change_required, users14_humans.password_changed, users14_humans.mfa_init_skipped
|
||||||
|
"id-1", "User", "Name", "Nickyname", "User 'Nickyname' Name", "it", domain.GenderMale, "avatar_key", "nicky@username.com", true, "12345678", true, false, nil, nil,
|
||||||
|
// users14_machines.user_id, users14_machines.name, users14_machines.description, users14_machines.secret, users14_machines.access_token_type
|
||||||
|
nil, nil, nil, nil, nil,
|
||||||
|
// COUNT(*) OVER ()
|
||||||
|
2,
|
||||||
|
},
|
||||||
|
[]driver.Value{
|
||||||
|
// user_metadata5.key, user_metadata5.value, users14.id, users14.state, users14.username, users14.type
|
||||||
|
"test key 2", "test value 2", "id-2", domain.UserStateActive, "username 2", domain.UserTypeMachine,
|
||||||
|
// users14_humans.user_id, users14_humans.first_name, users14_humans.last_name, users14_humans.nick_name, users14_humans.display_name, users14_humans.preferred_language, users14_humans.gender, users14_humans.avatar_key, users14_humans.email, users14_humans.is_email_verified, users14_humans.phone, users14_humans.is_phone_verified, users14_humans.password_change_required, users14_humans.password_changed, users14_humans.mfa_init_skipped
|
||||||
|
nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil,
|
||||||
|
// users14_machines.user_id, users14_machines.name, users14_machines.description, users14_machines.secret, users14_machines.access_token_type
|
||||||
|
"id-2", "robot", "this is a robot", "giga secret 1234!", domain.OIDCTokenTypeJWT,
|
||||||
|
// COUNT(*) OVER ()
|
||||||
|
2,
|
||||||
|
},
|
||||||
|
)
|
||||||
|
return q.
|
||||||
|
WithArgs("instance-1", "user-1", sqlmock.AnyArg(), domain.PermissionUserRead, sqlmock.AnyArg(), "user-1", "unmatch key 1", "unmatch key 2", "instance-1").
|
||||||
|
WillReturnRows(results)
|
||||||
|
},
|
||||||
|
mockMatcher: &offsetMatcher{matcher: &limitMatcher{matcher: &whereMatcher{matcher: &baseMatcher{}, toMatch: "projections.user_metadata5.key,AND,NOT"}, expectedLimit: "2"}, expectedOffset: "1"},
|
||||||
|
expectedQuery: baseQuery + permissionQuery,
|
||||||
|
expectedUsersByMeta: &UsersByMetadata{
|
||||||
|
SearchResponse: SearchResponse{Count: 2},
|
||||||
|
UsersByMeta: []*UserByMetadata{
|
||||||
|
{
|
||||||
|
ResourceOwner: "",
|
||||||
|
Key: "test key 1",
|
||||||
|
Value: []byte("test value 1"),
|
||||||
|
User: humanUser("id-1", "username 1", "User", "Name", "Nickyname", "nicky@username.com", domain.UserStateActive),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
ResourceOwner: "",
|
||||||
|
Key: "test key 2",
|
||||||
|
Value: []byte("test value 2"),
|
||||||
|
User: machineUser("id-2", "username 2", "robot", "this is a robot", "giga secret 1234!", domain.OIDCTokenTypeJWT, domain.UserStateActive),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
testName: "v2 perms enabled/matching by NOT-AND-ed keys should return 2 records with limit, offset and sorting",
|
||||||
|
inputCtx: authz.NewMockContext("instance-1", "org-1", "user-1", authz.WithMockFeatures(feature.Features{PermissionCheckV2: true})),
|
||||||
|
inputPermissionCheckMock: permissionmock.MockPermissionCheckOK(),
|
||||||
|
inputQueriesFunc: func(t *testing.T) *UsersByMetadataSearchQueries {
|
||||||
|
keyQ1, err := NewUserMetadataKeySearchQuery("unmatch key 1", TextEquals)
|
||||||
|
require.NoError(t, err)
|
||||||
|
keyQ2, err := NewUserMetadataKeySearchQuery("unmatch key 2", TextEquals)
|
||||||
|
require.NoError(t, err)
|
||||||
|
orQ, err := NewAndQuery(keyQ1, keyQ2)
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
notQ, err := NewNotQuery(orQ)
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
return &UsersByMetadataSearchQueries{
|
||||||
|
Queries: []SearchQuery{notQ},
|
||||||
|
SearchRequest: SearchRequest{Limit: 2, Offset: 1, SortingColumn: UserMetadataKeyCol},
|
||||||
|
}
|
||||||
|
},
|
||||||
|
mockExpectations: func(q *sqlmock.ExpectedQuery) *sqlmock.ExpectedQuery {
|
||||||
|
results := sqlmock.NewRows(columns)
|
||||||
|
results.AddRows(
|
||||||
|
[]driver.Value{
|
||||||
|
// user_metadata5.key, user_metadata5.value, users14.id, users14.state, users14.username, users14.type
|
||||||
|
"test key 2", "test value 2", "id-2", domain.UserStateActive, "username 2", domain.UserTypeMachine,
|
||||||
|
// users14_humans.user_id, users14_humans.first_name, users14_humans.last_name, users14_humans.nick_name, users14_humans.display_name, users14_humans.preferred_language, users14_humans.gender, users14_humans.avatar_key, users14_humans.email, users14_humans.is_email_verified, users14_humans.phone, users14_humans.is_phone_verified, users14_humans.password_change_required, users14_humans.password_changed, users14_humans.mfa_init_skipped
|
||||||
|
nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil,
|
||||||
|
// users14_machines.user_id, users14_machines.name, users14_machines.description, users14_machines.secret, users14_machines.access_token_type
|
||||||
|
"id-2", "robot", "this is a robot", "giga secret 1234!", domain.OIDCTokenTypeJWT,
|
||||||
|
// COUNT(*) OVER ()
|
||||||
|
2,
|
||||||
|
},
|
||||||
|
[]driver.Value{
|
||||||
|
// user_metadata5.key, user_metadata5.value, users14.id, users14.state, users14.username, users14.type
|
||||||
|
"test key 1", "test value 1", "id-1", domain.UserStateActive, "username 1", domain.UserTypeHuman,
|
||||||
|
// users14_humans.user_id, users14_humans.first_name, users14_humans.last_name, users14_humans.nick_name, users14_humans.display_name, users14_humans.preferred_language, users14_humans.gender, users14_humans.avatar_key, users14_humans.email, users14_humans.is_email_verified, users14_humans.phone, users14_humans.is_phone_verified, users14_humans.password_change_required, users14_humans.password_changed, users14_humans.mfa_init_skipped
|
||||||
|
"id-1", "User", "Name", "Nickyname", "User 'Nickyname' Name", "it", domain.GenderMale, "avatar_key", "nicky@username.com", true, "12345678", true, false, nil, nil,
|
||||||
|
// users14_machines.user_id, users14_machines.name, users14_machines.description, users14_machines.secret, users14_machines.access_token_type
|
||||||
|
nil, nil, nil, nil, nil,
|
||||||
|
// COUNT(*) OVER ()
|
||||||
|
2,
|
||||||
|
},
|
||||||
|
)
|
||||||
|
return q.
|
||||||
|
WithArgs("instance-1", "user-1", sqlmock.AnyArg(), domain.PermissionUserRead, sqlmock.AnyArg(), "user-1", "unmatch key 1", "unmatch key 2", "instance-1").
|
||||||
|
WillReturnRows(results)
|
||||||
|
},
|
||||||
|
mockMatcher: &orderMatcher{matcher: &offsetMatcher{matcher: &limitMatcher{matcher: &whereMatcher{matcher: &baseMatcher{}, toMatch: "projections.user_metadata5.key,AND,NOT"}, expectedLimit: "2"}, expectedOffset: "1"}, expectedSorting: []string{"projections.user_metadata5.key DESC"}},
|
||||||
|
expectedQuery: baseQuery + permissionQuery,
|
||||||
|
expectedUsersByMeta: &UsersByMetadata{
|
||||||
|
SearchResponse: SearchResponse{Count: 2},
|
||||||
|
UsersByMeta: []*UserByMetadata{
|
||||||
|
{
|
||||||
|
ResourceOwner: "",
|
||||||
|
Key: "test key 2",
|
||||||
|
Value: []byte("test value 2"),
|
||||||
|
User: machineUser("id-2", "username 2", "robot", "this is a robot", "giga secret 1234!", domain.OIDCTokenTypeJWT, domain.UserStateActive),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
ResourceOwner: "",
|
||||||
|
Key: "test key 1",
|
||||||
|
Value: []byte("test value 1"),
|
||||||
|
User: humanUser("id-1", "username 1", "User", "Name", "Nickyname", "nicky@username.com", domain.UserStateActive),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tc := range tt {
|
||||||
|
t.Run(tc.testName, func(t *testing.T) {
|
||||||
|
// t.Parallel()
|
||||||
|
|
||||||
|
// Given
|
||||||
|
db, mock, err := sqlmock.New(sqlmock.QueryMatcherOption(tc.mockMatcher))
|
||||||
|
require.NoError(t, err)
|
||||||
|
q := Queries{
|
||||||
|
client: &database.DB{DB: db},
|
||||||
|
}
|
||||||
|
defer db.Close()
|
||||||
|
|
||||||
|
tc.mockExpectations(mock.ExpectQuery(tc.expectedQuery))
|
||||||
|
|
||||||
|
// Test
|
||||||
|
res, err := q.SearchUsersByMetadata(tc.inputCtx, tc.inputQueriesFunc(t), tc.inputPermissionCheckMock)
|
||||||
|
|
||||||
|
// Verify
|
||||||
|
require.NoError(t, mock.ExpectationsWereMet())
|
||||||
|
assert.Equal(t, tc.expectedError, err)
|
||||||
|
assert.Equal(t, tc.expectedUsersByMeta, res)
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
type baseMatcher struct{}
|
||||||
|
|
||||||
|
func (m *baseMatcher) Match(expectedSQL, actualSQL string) error {
|
||||||
|
strippedExpected := strings.ReplaceAll(expectedSQL, "\n", " ")
|
||||||
|
strippedActual := strings.ReplaceAll(actualSQL, "\n", " ")
|
||||||
|
|
||||||
|
beforeWhere, _, _ := strings.Cut(strippedExpected, "WHERE")
|
||||||
|
if !strings.Contains(strippedActual, beforeWhere) {
|
||||||
|
return errors.New("actual SQL query does not contain expected sql")
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
type whereMatcher struct {
|
||||||
|
matcher sqlmock.QueryMatcher
|
||||||
|
toMatch string
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m *whereMatcher) Match(expectedSQL, actualSQL string) error {
|
||||||
|
existingMatchingErrs := m.matcher.Match(expectedSQL, actualSQL)
|
||||||
|
|
||||||
|
strippedActual := strings.ReplaceAll(actualSQL, "\n", " ")
|
||||||
|
|
||||||
|
collector := []error{existingMatchingErrs}
|
||||||
|
|
||||||
|
if !strings.Contains(strippedActual, "WHERE") {
|
||||||
|
collector = append(collector, fmt.Errorf(`no WHERE clause found in actual SQL "%s"`, strippedActual))
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, v := range strings.Split(m.toMatch, ",") {
|
||||||
|
if !strings.Contains(strippedActual, v) {
|
||||||
|
collector = append(collector, fmt.Errorf(`value "%s" is not contained in actual SQL "%s"`, v, strippedActual))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return errors.Join(collector...)
|
||||||
|
}
|
||||||
|
|
||||||
|
type limitMatcher struct {
|
||||||
|
expectedLimit string
|
||||||
|
matcher sqlmock.QueryMatcher
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m *limitMatcher) Match(expectedSQL, actualSQL string) error {
|
||||||
|
existingMatchingErrs := m.matcher.Match(expectedSQL, actualSQL)
|
||||||
|
|
||||||
|
strippedActual := strings.ReplaceAll(actualSQL, "\n", " ")
|
||||||
|
|
||||||
|
re := regexp.MustCompile(`(?i)LIMIT\s+(\d+)`)
|
||||||
|
matches := re.FindStringSubmatch(strippedActual)
|
||||||
|
|
||||||
|
collector := []error{existingMatchingErrs}
|
||||||
|
|
||||||
|
if len(matches) == 0 {
|
||||||
|
return errors.Join(append(collector, fmt.Errorf(`no LIMIT clause found in actual SQL "%s"`, strippedActual))...)
|
||||||
|
}
|
||||||
|
|
||||||
|
if matches[1] != m.expectedLimit {
|
||||||
|
collector = append(collector, fmt.Errorf(`limit "%s" is not contained in actual SQL "%s"`, matches[1], strippedActual))
|
||||||
|
}
|
||||||
|
|
||||||
|
return errors.Join(collector...)
|
||||||
|
}
|
||||||
|
|
||||||
|
type offsetMatcher struct {
|
||||||
|
expectedOffset string
|
||||||
|
matcher sqlmock.QueryMatcher
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m *offsetMatcher) Match(expectedSQL, actualSQL string) error {
|
||||||
|
existingMatchingErrs := m.matcher.Match(expectedSQL, actualSQL)
|
||||||
|
|
||||||
|
strippedActual := strings.ReplaceAll(actualSQL, "\n", " ")
|
||||||
|
|
||||||
|
re := regexp.MustCompile(`(?i)OFFSET\s+(\d+)`)
|
||||||
|
matches := re.FindStringSubmatch(strippedActual)
|
||||||
|
|
||||||
|
collector := []error{existingMatchingErrs}
|
||||||
|
|
||||||
|
if len(matches) == 0 {
|
||||||
|
return errors.Join(append(collector, fmt.Errorf(`no OFFSET clause found in actual SQL "%s"`, strippedActual))...)
|
||||||
|
}
|
||||||
|
|
||||||
|
if matches[1] != m.expectedOffset {
|
||||||
|
collector = append(collector, fmt.Errorf(`offset "%s" is not contained in actual SQL "%s"`, matches[1], strippedActual))
|
||||||
|
}
|
||||||
|
|
||||||
|
return errors.Join(collector...)
|
||||||
|
}
|
||||||
|
|
||||||
|
type orderMatcher struct {
|
||||||
|
expectedSorting []string
|
||||||
|
matcher sqlmock.QueryMatcher
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m *orderMatcher) Match(expectedSQL, actualSQL string) error {
|
||||||
|
existingMatchingErrs := m.matcher.Match(expectedSQL, actualSQL)
|
||||||
|
|
||||||
|
strippedActual := strings.ReplaceAll(actualSQL, "\n", " ")
|
||||||
|
|
||||||
|
re := regexp.MustCompile(`(?i)ORDER\s+BY\s+([^\s,]+(?:\s+(?:ASC|DESC))?(?:\s*,\s*[^\s,]+(?:\s+(?:ASC|DESC))?)*)`)
|
||||||
|
matches := re.FindStringSubmatch(strippedActual)
|
||||||
|
|
||||||
|
collector := []error{existingMatchingErrs}
|
||||||
|
|
||||||
|
if len(matches) == 0 {
|
||||||
|
return errors.Join(append(collector, fmt.Errorf(`no ORDER BY clause found in actual SQL "%s"`, strippedActual))...)
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, sortValue := range m.expectedSorting {
|
||||||
|
if !strings.Contains(matches[1], sortValue) {
|
||||||
|
collector = append(collector, fmt.Errorf(`ORDER BY value "%s" is not contained in actual SQL "%s"`, sortValue, strippedActual))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return errors.Join(collector...)
|
||||||
|
}
|
||||||
|
|
||||||
|
func machineUser(id, username, machineName, machineDescription, encodedSecret string, tokenType domain.OIDCTokenType, state domain.UserState) *User {
|
||||||
|
return &User{
|
||||||
|
ID: id,
|
||||||
|
State: state,
|
||||||
|
Type: domain.UserTypeMachine,
|
||||||
|
Username: username,
|
||||||
|
Human: &Human{},
|
||||||
|
Machine: &Machine{
|
||||||
|
Name: machineName,
|
||||||
|
Description: machineDescription,
|
||||||
|
EncodedSecret: encodedSecret,
|
||||||
|
AccessTokenType: tokenType,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func humanUser(id, username, firstName, lastName, nickname string, email domain.EmailAddress, state domain.UserState) *User {
|
||||||
|
return &User{
|
||||||
|
ID: id,
|
||||||
|
State: state,
|
||||||
|
Type: domain.UserTypeHuman,
|
||||||
|
Username: username,
|
||||||
|
Human: &Human{
|
||||||
|
FirstName: firstName,
|
||||||
|
LastName: lastName,
|
||||||
|
NickName: nickname,
|
||||||
|
DisplayName: fmt.Sprintf("%s '%s' %s", firstName, nickname, lastName),
|
||||||
|
AvatarKey: "avatar_key",
|
||||||
|
PreferredLanguage: language.MustParse("it"),
|
||||||
|
Gender: domain.GenderMale,
|
||||||
|
Email: email,
|
||||||
|
IsEmailVerified: true,
|
||||||
|
Phone: "12345678",
|
||||||
|
IsPhoneVerified: true,
|
||||||
|
PasswordChangeRequired: false,
|
||||||
|
},
|
||||||
|
Machine: &Machine{},
|
||||||
|
}
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user