mirror of
https://github.com/zitadel/zitadel.git
synced 2025-08-12 03:37:34 +00:00
chore(tests): use a coverage server binary (#8407)
# Which Problems Are Solved Use a single server instance for API integration tests. This optimizes the time taken for the integration test pipeline, because it allows running tests on multiple packages in parallel. Also, it saves time by not start and stopping a zitadel server for every package. # How the Problems Are Solved - Build a binary with `go build -race -cover ....` - Integration tests only construct clients. The server remains running in the background. - The integration package and tested packages now fully utilize the API. No more direct database access trough `query` and `command` packages. - Use Makefile recipes to setup, start and stop the server in the background. - The binary has the race detector enabled - Init and setup jobs are configured to halt immediately on race condition - Because the server runs in the background, races are only logged. When the server is stopped and race logs exist, the Makefile recipe will throw an error and print the logs. - Makefile recipes include logic to print logs and convert coverage reports after the server is stopped. - Some tests need a downstream HTTP server to make requests, like quota and milestones. A new `integration/sink` package creates an HTTP server and uses websockets to forward HTTP request back to the test packages. The package API uses Go channels for abstraction and easy usage. # Additional Changes - Integration test files already used the `//go:build integration` directive. In order to properly split integration from unit tests, integration test files need to be in a `integration_test` subdirectory of their package. - `UseIsolatedInstance` used to overwrite the `Tester.Client` for each instance. Now a `Instance` object is returned with a gRPC client that is connected to the isolated instance's hostname. - The `Tester` type is now `Instance`. The object is created for the first instance, used by default in any test. Isolated instances are also `Instance` objects and therefore benefit from the same methods and values. The first instance and any other us capable of creating an isolated instance over the system API. - All test packages run in an Isolated instance by calling `NewInstance()` - Individual tests that use an isolated instance use `t.Parallel()` # Additional Context - Closes #6684 - https://go.dev/doc/articles/race_detector - https://go.dev/doc/build-cover --------- Co-authored-by: Stefan Benz <46600784+stebenz@users.noreply.github.com>
This commit is contained in:
Tim Möhlmann
326
internal/api/grpc/admin/integration_test/iam_member_test.go
Normal file
326
internal/api/grpc/admin/integration_test/iam_member_test.go
Normal file
@@ -0,0 +1,326 @@
|
||||
//go:build integration
|
||||
|
||||
package admin_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/brianvoe/gofakeit/v6"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"google.golang.org/protobuf/types/known/timestamppb"
|
||||
|
||||
"github.com/zitadel/zitadel/internal/integration"
|
||||
admin_pb "github.com/zitadel/zitadel/pkg/grpc/admin"
|
||||
"github.com/zitadel/zitadel/pkg/grpc/member"
|
||||
"github.com/zitadel/zitadel/pkg/grpc/object"
|
||||
)
|
||||
|
||||
var iamRoles = []string{
|
||||
"IAM_OWNER",
|
||||
"IAM_OWNER_VIEWER",
|
||||
"IAM_ORG_MANAGER",
|
||||
"IAM_USER_MANAGER",
|
||||
"IAM_ADMIN_IMPERSONATOR",
|
||||
"IAM_END_USER_IMPERSONATOR",
|
||||
}
|
||||
|
||||
func TestServer_ListIAMMemberRoles(t *testing.T) {
|
||||
got, err := Client.ListIAMMemberRoles(AdminCTX, &admin_pb.ListIAMMemberRolesRequest{})
|
||||
require.NoError(t, err)
|
||||
assert.ElementsMatch(t, iamRoles, got.GetRoles())
|
||||
}
|
||||
|
||||
func TestServer_ListIAMMembers(t *testing.T) {
|
||||
user := Instance.CreateHumanUserVerified(AdminCTX, Instance.DefaultOrg.Id, gofakeit.Email())
|
||||
_, err := Client.AddIAMMember(AdminCTX, &admin_pb.AddIAMMemberRequest{
|
||||
UserId: user.GetUserId(),
|
||||
Roles: iamRoles,
|
||||
})
|
||||
require.NoError(t, err)
|
||||
type args struct {
|
||||
ctx context.Context
|
||||
req *admin_pb.ListIAMMembersRequest
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
args args
|
||||
want *admin_pb.ListIAMMembersResponse
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "permission error",
|
||||
args: args{
|
||||
ctx: Instance.WithAuthorization(CTX, integration.UserTypeOrgOwner),
|
||||
req: &admin_pb.ListIAMMembersRequest{
|
||||
Query: &object.ListQuery{},
|
||||
Queries: []*member.SearchQuery{{
|
||||
Query: &member.SearchQuery_UserIdQuery{
|
||||
UserIdQuery: &member.UserIDQuery{
|
||||
UserId: user.GetUserId(),
|
||||
},
|
||||
},
|
||||
}},
|
||||
},
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "success",
|
||||
args: args{
|
||||
ctx: AdminCTX,
|
||||
req: &admin_pb.ListIAMMembersRequest{
|
||||
Query: &object.ListQuery{},
|
||||
Queries: []*member.SearchQuery{{
|
||||
Query: &member.SearchQuery_UserIdQuery{
|
||||
UserIdQuery: &member.UserIDQuery{
|
||||
UserId: user.GetUserId(),
|
||||
},
|
||||
},
|
||||
}},
|
||||
},
|
||||
},
|
||||
want: &admin_pb.ListIAMMembersResponse{
|
||||
Result: []*member.Member{{
|
||||
UserId: user.GetUserId(),
|
||||
Roles: iamRoles,
|
||||
}},
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
assert.EventuallyWithT(t, func(ct *assert.CollectT) {
|
||||
got, err := Client.ListIAMMembers(tt.args.ctx, tt.args.req)
|
||||
if tt.wantErr {
|
||||
assert.Error(ct, err)
|
||||
return
|
||||
}
|
||||
require.NoError(ct, err)
|
||||
wantResult := tt.want.GetResult()
|
||||
gotResult := got.GetResult()
|
||||
|
||||
if assert.Len(ct, gotResult, len(wantResult)) {
|
||||
for i, want := range wantResult {
|
||||
assert.Equal(ct, want.GetUserId(), gotResult[i].GetUserId())
|
||||
assert.ElementsMatch(ct, want.GetRoles(), gotResult[i].GetRoles())
|
||||
}
|
||||
}
|
||||
}, time.Minute, time.Second)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestServer_AddIAMMember(t *testing.T) {
|
||||
user := Instance.CreateHumanUserVerified(AdminCTX, Instance.DefaultOrg.Id, gofakeit.Email())
|
||||
type args struct {
|
||||
ctx context.Context
|
||||
req *admin_pb.AddIAMMemberRequest
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
args args
|
||||
want *admin_pb.AddIAMMemberResponse
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "permission error",
|
||||
args: args{
|
||||
ctx: Instance.WithAuthorization(CTX, integration.UserTypeOrgOwner),
|
||||
req: &admin_pb.AddIAMMemberRequest{
|
||||
UserId: user.GetUserId(),
|
||||
Roles: iamRoles,
|
||||
},
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "success",
|
||||
args: args{
|
||||
ctx: AdminCTX,
|
||||
req: &admin_pb.AddIAMMemberRequest{
|
||||
UserId: user.GetUserId(),
|
||||
Roles: iamRoles,
|
||||
},
|
||||
},
|
||||
want: &admin_pb.AddIAMMemberResponse{
|
||||
Details: &object.ObjectDetails{
|
||||
ResourceOwner: Instance.ID(),
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "unknown roles error",
|
||||
args: args{
|
||||
ctx: AdminCTX,
|
||||
req: &admin_pb.AddIAMMemberRequest{
|
||||
UserId: user.GetUserId(),
|
||||
Roles: []string{"FOO", "BAR"},
|
||||
},
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "org role error",
|
||||
args: args{
|
||||
ctx: AdminCTX,
|
||||
req: &admin_pb.AddIAMMemberRequest{
|
||||
UserId: user.GetUserId(),
|
||||
Roles: []string{"ORG_OWNER"},
|
||||
},
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
got, err := Client.AddIAMMember(tt.args.ctx, tt.args.req)
|
||||
if tt.wantErr {
|
||||
assert.Error(t, err)
|
||||
return
|
||||
}
|
||||
require.NoError(t, err)
|
||||
integration.AssertDetails(t, tt.want, got)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestServer_UpdateIAMMember(t *testing.T) {
|
||||
user := Instance.CreateHumanUserVerified(AdminCTX, Instance.DefaultOrg.Id, gofakeit.Email())
|
||||
_, err := Client.AddIAMMember(AdminCTX, &admin_pb.AddIAMMemberRequest{
|
||||
UserId: user.GetUserId(),
|
||||
Roles: []string{"IAM_OWNER"},
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
type args struct {
|
||||
ctx context.Context
|
||||
req *admin_pb.UpdateIAMMemberRequest
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
args args
|
||||
want *admin_pb.UpdateIAMMemberResponse
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "permission error",
|
||||
args: args{
|
||||
ctx: Instance.WithAuthorization(CTX, integration.UserTypeOrgOwner),
|
||||
req: &admin_pb.UpdateIAMMemberRequest{
|
||||
UserId: user.GetUserId(),
|
||||
Roles: iamRoles,
|
||||
},
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "success",
|
||||
args: args{
|
||||
ctx: AdminCTX,
|
||||
req: &admin_pb.UpdateIAMMemberRequest{
|
||||
UserId: user.GetUserId(),
|
||||
Roles: iamRoles,
|
||||
},
|
||||
},
|
||||
want: &admin_pb.UpdateIAMMemberResponse{
|
||||
Details: &object.ObjectDetails{
|
||||
ResourceOwner: Instance.ID(),
|
||||
ChangeDate: timestamppb.Now(),
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "unknown roles error",
|
||||
args: args{
|
||||
ctx: AdminCTX,
|
||||
req: &admin_pb.UpdateIAMMemberRequest{
|
||||
UserId: user.GetUserId(),
|
||||
Roles: []string{"FOO", "BAR"},
|
||||
},
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "org role error",
|
||||
args: args{
|
||||
ctx: AdminCTX,
|
||||
req: &admin_pb.UpdateIAMMemberRequest{
|
||||
UserId: user.GetUserId(),
|
||||
Roles: []string{"ORG_OWNER"},
|
||||
},
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
got, err := Client.UpdateIAMMember(tt.args.ctx, tt.args.req)
|
||||
if tt.wantErr {
|
||||
assert.Error(t, err)
|
||||
return
|
||||
}
|
||||
require.NoError(t, err)
|
||||
integration.AssertDetails(t, tt.want, got)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestServer_RemoveIAMMember(t *testing.T) {
|
||||
user := Instance.CreateHumanUserVerified(AdminCTX, Instance.DefaultOrg.Id, gofakeit.Email())
|
||||
_, err := Client.AddIAMMember(AdminCTX, &admin_pb.AddIAMMemberRequest{
|
||||
UserId: user.GetUserId(),
|
||||
Roles: []string{"IAM_OWNER"},
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
type args struct {
|
||||
ctx context.Context
|
||||
req *admin_pb.RemoveIAMMemberRequest
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
args args
|
||||
want *admin_pb.RemoveIAMMemberResponse
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "permission error",
|
||||
args: args{
|
||||
ctx: Instance.WithAuthorization(CTX, integration.UserTypeOrgOwner),
|
||||
req: &admin_pb.RemoveIAMMemberRequest{
|
||||
UserId: user.GetUserId(),
|
||||
},
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "success",
|
||||
args: args{
|
||||
ctx: AdminCTX,
|
||||
req: &admin_pb.RemoveIAMMemberRequest{
|
||||
UserId: user.GetUserId(),
|
||||
},
|
||||
},
|
||||
want: &admin_pb.RemoveIAMMemberResponse{
|
||||
Details: &object.ObjectDetails{
|
||||
ResourceOwner: Instance.ID(),
|
||||
ChangeDate: timestamppb.Now(),
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
got, err := Client.RemoveIAMMember(tt.args.ctx, tt.args.req)
|
||||
if tt.wantErr {
|
||||
assert.Error(t, err)
|
||||
return
|
||||
}
|
||||
require.NoError(t, err)
|
||||
integration.AssertDetails(t, tt.want, got)
|
||||
})
|
||||
}
|
||||
}
|
||||
172
internal/api/grpc/admin/integration_test/iam_settings_test.go
Normal file
172
internal/api/grpc/admin/integration_test/iam_settings_test.go
Normal file
@@ -0,0 +1,172 @@
|
||||
//go:build integration
|
||||
|
||||
package admin_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"google.golang.org/protobuf/types/known/timestamppb"
|
||||
|
||||
"github.com/zitadel/zitadel/internal/integration"
|
||||
admin_pb "github.com/zitadel/zitadel/pkg/grpc/admin"
|
||||
"github.com/zitadel/zitadel/pkg/grpc/object"
|
||||
"github.com/zitadel/zitadel/pkg/grpc/settings"
|
||||
)
|
||||
|
||||
func TestServer_GetSecurityPolicy(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
instance := integration.NewInstance(CTX)
|
||||
adminCtx := instance.WithAuthorization(CTX, integration.UserTypeIAMOwner)
|
||||
|
||||
_, err := instance.Client.Admin.SetSecurityPolicy(adminCtx, &admin_pb.SetSecurityPolicyRequest{
|
||||
EnableIframeEmbedding: true,
|
||||
AllowedOrigins: []string{"foo.com", "bar.com"},
|
||||
EnableImpersonation: true,
|
||||
})
|
||||
require.NoError(t, err)
|
||||
tests := []struct {
|
||||
name string
|
||||
ctx context.Context
|
||||
want *admin_pb.GetSecurityPolicyResponse
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "permission error",
|
||||
ctx: instance.WithAuthorization(CTX, integration.UserTypeOrgOwner),
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "success",
|
||||
ctx: adminCtx,
|
||||
want: &admin_pb.GetSecurityPolicyResponse{
|
||||
Policy: &settings.SecurityPolicy{
|
||||
EnableIframeEmbedding: true,
|
||||
AllowedOrigins: []string{"foo.com", "bar.com"},
|
||||
EnableImpersonation: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
resp, err := instance.Client.Admin.GetSecurityPolicy(tt.ctx, &admin_pb.GetSecurityPolicyRequest{})
|
||||
if tt.wantErr {
|
||||
assert.Error(t, err)
|
||||
return
|
||||
}
|
||||
require.NoError(t, err)
|
||||
got, want := resp.GetPolicy(), tt.want.GetPolicy()
|
||||
assert.Equal(t, want.GetEnableIframeEmbedding(), got.GetEnableIframeEmbedding(), "enable iframe embedding")
|
||||
assert.Equal(t, want.GetAllowedOrigins(), got.GetAllowedOrigins(), "allowed origins")
|
||||
assert.Equal(t, want.GetEnableImpersonation(), got.GetEnableImpersonation(), "enable impersonation")
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestServer_SetSecurityPolicy(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
instance := integration.NewInstance(CTX)
|
||||
adminCtx := instance.WithAuthorization(CTX, integration.UserTypeIAMOwner)
|
||||
|
||||
type args struct {
|
||||
ctx context.Context
|
||||
req *admin_pb.SetSecurityPolicyRequest
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
args args
|
||||
want *admin_pb.SetSecurityPolicyResponse
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "permission error",
|
||||
args: args{
|
||||
ctx: instance.WithAuthorization(CTX, integration.UserTypeOrgOwner),
|
||||
req: &admin_pb.SetSecurityPolicyRequest{
|
||||
EnableIframeEmbedding: true,
|
||||
AllowedOrigins: []string{"foo.com", "bar.com"},
|
||||
EnableImpersonation: true,
|
||||
},
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "success allowed origins",
|
||||
args: args{
|
||||
ctx: adminCtx,
|
||||
req: &admin_pb.SetSecurityPolicyRequest{
|
||||
AllowedOrigins: []string{"foo.com", "bar.com"},
|
||||
},
|
||||
},
|
||||
want: &admin_pb.SetSecurityPolicyResponse{
|
||||
Details: &object.ObjectDetails{
|
||||
ChangeDate: timestamppb.Now(),
|
||||
ResourceOwner: instance.ID(),
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "success iframe embedding",
|
||||
args: args{
|
||||
ctx: adminCtx,
|
||||
req: &admin_pb.SetSecurityPolicyRequest{
|
||||
EnableIframeEmbedding: true,
|
||||
},
|
||||
},
|
||||
want: &admin_pb.SetSecurityPolicyResponse{
|
||||
Details: &object.ObjectDetails{
|
||||
ChangeDate: timestamppb.Now(),
|
||||
ResourceOwner: instance.ID(),
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "success impersonation",
|
||||
args: args{
|
||||
ctx: adminCtx,
|
||||
req: &admin_pb.SetSecurityPolicyRequest{
|
||||
EnableImpersonation: true,
|
||||
},
|
||||
},
|
||||
want: &admin_pb.SetSecurityPolicyResponse{
|
||||
Details: &object.ObjectDetails{
|
||||
ChangeDate: timestamppb.Now(),
|
||||
ResourceOwner: instance.ID(),
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "success all",
|
||||
args: args{
|
||||
ctx: adminCtx,
|
||||
req: &admin_pb.SetSecurityPolicyRequest{
|
||||
EnableIframeEmbedding: true,
|
||||
AllowedOrigins: []string{"foo.com", "bar.com"},
|
||||
EnableImpersonation: true,
|
||||
},
|
||||
},
|
||||
want: &admin_pb.SetSecurityPolicyResponse{
|
||||
Details: &object.ObjectDetails{
|
||||
ChangeDate: timestamppb.Now(),
|
||||
ResourceOwner: instance.ID(),
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
got, err := instance.Client.Admin.SetSecurityPolicy(tt.args.ctx, tt.args.req)
|
||||
if tt.wantErr {
|
||||
assert.Error(t, err)
|
||||
return
|
||||
}
|
||||
require.NoError(t, err)
|
||||
integration.AssertDetails(t, tt.want, got)
|
||||
})
|
||||
}
|
||||
}
|
||||
492
internal/api/grpc/admin/integration_test/import_test.go
Normal file
492
internal/api/grpc/admin/integration_test/import_test.go
Normal file
@@ -0,0 +1,492 @@
|
||||
//go:build integration
|
||||
|
||||
package admin_test
|
||||
|
||||
import (
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/brianvoe/gofakeit/v6"
|
||||
"github.com/google/uuid"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/zitadel/zitadel/internal/integration"
|
||||
"github.com/zitadel/zitadel/pkg/grpc/admin"
|
||||
"github.com/zitadel/zitadel/pkg/grpc/management"
|
||||
v1 "github.com/zitadel/zitadel/pkg/grpc/v1"
|
||||
)
|
||||
|
||||
func TestServer_ImportData(t *testing.T) {
|
||||
orgIDs := generateIDs(10)
|
||||
projectIDs := generateIDs(10)
|
||||
userIDs := generateIDs(10)
|
||||
grantIDs := generateIDs(10)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
req *admin.ImportDataRequest
|
||||
want *admin.ImportDataResponse
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "success",
|
||||
req: &admin.ImportDataRequest{
|
||||
Data: &admin.ImportDataRequest_DataOrgs{
|
||||
DataOrgs: &admin.ImportDataOrg{
|
||||
Orgs: []*admin.DataOrg{
|
||||
{
|
||||
OrgId: orgIDs[0],
|
||||
Org: &management.AddOrgRequest{
|
||||
Name: gofakeit.ProductName(),
|
||||
},
|
||||
Projects: []*v1.DataProject{
|
||||
{
|
||||
ProjectId: projectIDs[0],
|
||||
Project: &management.AddProjectRequest{
|
||||
Name: gofakeit.AppName(),
|
||||
ProjectRoleAssertion: true,
|
||||
},
|
||||
},
|
||||
{
|
||||
ProjectId: projectIDs[1],
|
||||
Project: &management.AddProjectRequest{
|
||||
Name: gofakeit.AppName(),
|
||||
ProjectRoleAssertion: false,
|
||||
},
|
||||
},
|
||||
},
|
||||
ProjectRoles: []*management.AddProjectRoleRequest{
|
||||
{
|
||||
ProjectId: projectIDs[0],
|
||||
RoleKey: "role1",
|
||||
DisplayName: "role1",
|
||||
},
|
||||
{
|
||||
ProjectId: projectIDs[0],
|
||||
RoleKey: "role2",
|
||||
DisplayName: "role2",
|
||||
},
|
||||
{
|
||||
ProjectId: projectIDs[1],
|
||||
RoleKey: "role3",
|
||||
DisplayName: "role3",
|
||||
},
|
||||
{
|
||||
ProjectId: projectIDs[1],
|
||||
RoleKey: "role4",
|
||||
DisplayName: "role4",
|
||||
},
|
||||
},
|
||||
HumanUsers: []*v1.DataHumanUser{
|
||||
{
|
||||
UserId: userIDs[0],
|
||||
User: &management.ImportHumanUserRequest{
|
||||
UserName: gofakeit.Username(),
|
||||
Profile: &management.ImportHumanUserRequest_Profile{
|
||||
FirstName: gofakeit.FirstName(),
|
||||
LastName: gofakeit.LastName(),
|
||||
DisplayName: gofakeit.Username(),
|
||||
PreferredLanguage: gofakeit.LanguageBCP(),
|
||||
},
|
||||
Email: &management.ImportHumanUserRequest_Email{
|
||||
Email: gofakeit.Email(),
|
||||
IsEmailVerified: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
UserId: userIDs[1],
|
||||
User: &management.ImportHumanUserRequest{
|
||||
UserName: gofakeit.Username(),
|
||||
Profile: &management.ImportHumanUserRequest_Profile{
|
||||
FirstName: gofakeit.FirstName(),
|
||||
LastName: gofakeit.LastName(),
|
||||
DisplayName: gofakeit.Username(),
|
||||
PreferredLanguage: gofakeit.LanguageBCP(),
|
||||
},
|
||||
Email: &management.ImportHumanUserRequest_Email{
|
||||
Email: gofakeit.Email(),
|
||||
IsEmailVerified: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
ProjectGrants: []*v1.DataProjectGrant{
|
||||
{
|
||||
GrantId: grantIDs[0],
|
||||
ProjectGrant: &management.AddProjectGrantRequest{
|
||||
ProjectId: projectIDs[0],
|
||||
GrantedOrgId: orgIDs[1],
|
||||
RoleKeys: []string{"role1", "role2"},
|
||||
},
|
||||
},
|
||||
{
|
||||
GrantId: grantIDs[1],
|
||||
ProjectGrant: &management.AddProjectGrantRequest{
|
||||
ProjectId: projectIDs[1],
|
||||
GrantedOrgId: orgIDs[1],
|
||||
RoleKeys: []string{"role3", "role4"},
|
||||
},
|
||||
},
|
||||
{
|
||||
GrantId: grantIDs[2],
|
||||
ProjectGrant: &management.AddProjectGrantRequest{
|
||||
ProjectId: projectIDs[0],
|
||||
GrantedOrgId: orgIDs[2],
|
||||
RoleKeys: []string{"role1", "role2"},
|
||||
},
|
||||
},
|
||||
{
|
||||
GrantId: grantIDs[3],
|
||||
ProjectGrant: &management.AddProjectGrantRequest{
|
||||
ProjectId: projectIDs[1],
|
||||
GrantedOrgId: orgIDs[2],
|
||||
RoleKeys: []string{"role3", "role4"},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
OrgId: orgIDs[1],
|
||||
Org: &management.AddOrgRequest{
|
||||
Name: gofakeit.ProductName(),
|
||||
},
|
||||
UserGrants: []*management.AddUserGrantRequest{
|
||||
{
|
||||
UserId: userIDs[0],
|
||||
ProjectId: projectIDs[0],
|
||||
ProjectGrantId: grantIDs[0],
|
||||
},
|
||||
{
|
||||
UserId: userIDs[0],
|
||||
ProjectId: projectIDs[1],
|
||||
ProjectGrantId: grantIDs[1],
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
OrgId: orgIDs[2],
|
||||
Org: &management.AddOrgRequest{
|
||||
Name: gofakeit.ProductName(),
|
||||
},
|
||||
UserGrants: []*management.AddUserGrantRequest{
|
||||
{
|
||||
UserId: userIDs[1],
|
||||
ProjectId: projectIDs[0],
|
||||
ProjectGrantId: grantIDs[2],
|
||||
},
|
||||
{
|
||||
UserId: userIDs[1],
|
||||
ProjectId: projectIDs[1],
|
||||
ProjectGrantId: grantIDs[3],
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
Timeout: time.Minute.String(),
|
||||
},
|
||||
want: &admin.ImportDataResponse{
|
||||
Success: &admin.ImportDataSuccess{
|
||||
Orgs: []*admin.ImportDataSuccessOrg{
|
||||
{
|
||||
OrgId: orgIDs[0],
|
||||
ProjectIds: projectIDs[0:2],
|
||||
ProjectRoles: []string{
|
||||
projectIDs[0] + "_role1",
|
||||
projectIDs[0] + "_role2",
|
||||
projectIDs[1] + "_role3",
|
||||
projectIDs[1] + "_role4",
|
||||
},
|
||||
HumanUserIds: userIDs[0:2],
|
||||
ProjectGrants: []*admin.ImportDataSuccessProjectGrant{
|
||||
{
|
||||
GrantId: grantIDs[0],
|
||||
ProjectId: projectIDs[0],
|
||||
OrgId: orgIDs[1],
|
||||
},
|
||||
{
|
||||
GrantId: grantIDs[1],
|
||||
ProjectId: projectIDs[1],
|
||||
OrgId: orgIDs[1],
|
||||
},
|
||||
{
|
||||
GrantId: grantIDs[2],
|
||||
ProjectId: projectIDs[0],
|
||||
OrgId: orgIDs[2],
|
||||
},
|
||||
{
|
||||
GrantId: grantIDs[3],
|
||||
ProjectId: projectIDs[1],
|
||||
OrgId: orgIDs[2],
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
OrgId: orgIDs[1],
|
||||
UserGrants: []*admin.ImportDataSuccessUserGrant{
|
||||
{
|
||||
ProjectId: projectIDs[0],
|
||||
UserId: userIDs[0],
|
||||
},
|
||||
{
|
||||
UserId: userIDs[0],
|
||||
ProjectId: projectIDs[1],
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
OrgId: orgIDs[2],
|
||||
UserGrants: []*admin.ImportDataSuccessUserGrant{
|
||||
{
|
||||
ProjectId: projectIDs[0],
|
||||
UserId: userIDs[1],
|
||||
},
|
||||
{
|
||||
UserId: userIDs[1],
|
||||
ProjectId: projectIDs[1],
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "duplicate project grant error",
|
||||
req: &admin.ImportDataRequest{
|
||||
Data: &admin.ImportDataRequest_DataOrgs{
|
||||
DataOrgs: &admin.ImportDataOrg{
|
||||
Orgs: []*admin.DataOrg{
|
||||
{
|
||||
OrgId: orgIDs[3],
|
||||
Org: &management.AddOrgRequest{
|
||||
Name: gofakeit.ProductName(),
|
||||
},
|
||||
Projects: []*v1.DataProject{
|
||||
{
|
||||
ProjectId: projectIDs[2],
|
||||
Project: &management.AddProjectRequest{
|
||||
Name: gofakeit.AppName(),
|
||||
ProjectRoleAssertion: true,
|
||||
},
|
||||
},
|
||||
{
|
||||
ProjectId: projectIDs[3],
|
||||
Project: &management.AddProjectRequest{
|
||||
Name: gofakeit.AppName(),
|
||||
ProjectRoleAssertion: false,
|
||||
},
|
||||
},
|
||||
},
|
||||
ProjectRoles: []*management.AddProjectRoleRequest{
|
||||
{
|
||||
ProjectId: projectIDs[2],
|
||||
RoleKey: "role1",
|
||||
DisplayName: "role1",
|
||||
},
|
||||
{
|
||||
ProjectId: projectIDs[2],
|
||||
RoleKey: "role2",
|
||||
DisplayName: "role2",
|
||||
},
|
||||
{
|
||||
ProjectId: projectIDs[3],
|
||||
RoleKey: "role3",
|
||||
DisplayName: "role3",
|
||||
},
|
||||
{
|
||||
ProjectId: projectIDs[3],
|
||||
RoleKey: "role4",
|
||||
DisplayName: "role4",
|
||||
},
|
||||
},
|
||||
ProjectGrants: []*v1.DataProjectGrant{
|
||||
{
|
||||
GrantId: grantIDs[4],
|
||||
ProjectGrant: &management.AddProjectGrantRequest{
|
||||
ProjectId: projectIDs[2],
|
||||
GrantedOrgId: orgIDs[4],
|
||||
RoleKeys: []string{"role1", "role2"},
|
||||
},
|
||||
},
|
||||
{
|
||||
GrantId: grantIDs[4],
|
||||
ProjectGrant: &management.AddProjectGrantRequest{
|
||||
ProjectId: projectIDs[2],
|
||||
GrantedOrgId: orgIDs[4],
|
||||
RoleKeys: []string{"role1", "role2"},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
Timeout: time.Minute.String(),
|
||||
},
|
||||
want: &admin.ImportDataResponse{
|
||||
Errors: []*admin.ImportDataError{
|
||||
{
|
||||
Type: "project_grant",
|
||||
Id: orgIDs[3] + "_" + projectIDs[2] + "_" + orgIDs[4],
|
||||
Message: "ID=V3-DKcYh Message=Errors.Project.Grant.AlreadyExists Parent=(ERROR: duplicate key value violates unique constraint \"unique_constraints_pkey\" (SQLSTATE 23505))",
|
||||
},
|
||||
},
|
||||
Success: &admin.ImportDataSuccess{
|
||||
Orgs: []*admin.ImportDataSuccessOrg{
|
||||
{
|
||||
OrgId: orgIDs[3],
|
||||
ProjectIds: projectIDs[2:4],
|
||||
ProjectRoles: []string{
|
||||
projectIDs[2] + "_role1",
|
||||
projectIDs[2] + "_role2",
|
||||
projectIDs[3] + "_role3",
|
||||
projectIDs[3] + "_role4",
|
||||
},
|
||||
ProjectGrants: []*admin.ImportDataSuccessProjectGrant{
|
||||
{
|
||||
GrantId: grantIDs[4],
|
||||
ProjectId: projectIDs[2],
|
||||
OrgId: orgIDs[4],
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "duplicate project grant member error",
|
||||
req: &admin.ImportDataRequest{
|
||||
Data: &admin.ImportDataRequest_DataOrgs{
|
||||
DataOrgs: &admin.ImportDataOrg{
|
||||
Orgs: []*admin.DataOrg{
|
||||
{
|
||||
OrgId: orgIDs[5],
|
||||
Org: &management.AddOrgRequest{
|
||||
Name: gofakeit.ProductName(),
|
||||
},
|
||||
Projects: []*v1.DataProject{
|
||||
{
|
||||
ProjectId: projectIDs[4],
|
||||
Project: &management.AddProjectRequest{
|
||||
Name: gofakeit.AppName(),
|
||||
ProjectRoleAssertion: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
ProjectRoles: []*management.AddProjectRoleRequest{
|
||||
{
|
||||
ProjectId: projectIDs[4],
|
||||
RoleKey: "role1",
|
||||
DisplayName: "role1",
|
||||
},
|
||||
},
|
||||
HumanUsers: []*v1.DataHumanUser{
|
||||
{
|
||||
UserId: userIDs[2],
|
||||
User: &management.ImportHumanUserRequest{
|
||||
UserName: gofakeit.Username(),
|
||||
Profile: &management.ImportHumanUserRequest_Profile{
|
||||
FirstName: gofakeit.FirstName(),
|
||||
LastName: gofakeit.LastName(),
|
||||
DisplayName: gofakeit.Username(),
|
||||
PreferredLanguage: gofakeit.LanguageBCP(),
|
||||
},
|
||||
Email: &management.ImportHumanUserRequest_Email{
|
||||
Email: gofakeit.Email(),
|
||||
IsEmailVerified: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
ProjectGrants: []*v1.DataProjectGrant{
|
||||
{
|
||||
GrantId: grantIDs[5],
|
||||
ProjectGrant: &management.AddProjectGrantRequest{
|
||||
ProjectId: projectIDs[4],
|
||||
GrantedOrgId: orgIDs[6],
|
||||
RoleKeys: []string{"role1", "role2"},
|
||||
},
|
||||
},
|
||||
},
|
||||
ProjectGrantMembers: []*management.AddProjectGrantMemberRequest{
|
||||
{
|
||||
ProjectId: projectIDs[4],
|
||||
GrantId: grantIDs[5],
|
||||
UserId: userIDs[2],
|
||||
Roles: []string{"PROJECT_GRANT_OWNER"},
|
||||
},
|
||||
{
|
||||
ProjectId: projectIDs[4],
|
||||
GrantId: grantIDs[5],
|
||||
UserId: userIDs[2],
|
||||
Roles: []string{"PROJECT_GRANT_OWNER"},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
Timeout: time.Minute.String(),
|
||||
},
|
||||
want: &admin.ImportDataResponse{
|
||||
Errors: []*admin.ImportDataError{
|
||||
{
|
||||
Type: "project_grant_member",
|
||||
Id: orgIDs[5] + "_" + projectIDs[4] + "_" + grantIDs[5] + "_" + userIDs[2],
|
||||
Message: "ID=V3-DKcYh Message=Errors.Project.Member.AlreadyExists Parent=(ERROR: duplicate key value violates unique constraint \"unique_constraints_pkey\" (SQLSTATE 23505))",
|
||||
},
|
||||
},
|
||||
Success: &admin.ImportDataSuccess{
|
||||
Orgs: []*admin.ImportDataSuccessOrg{
|
||||
{
|
||||
OrgId: orgIDs[5],
|
||||
ProjectIds: projectIDs[4:5],
|
||||
ProjectRoles: []string{
|
||||
projectIDs[4] + "_role1",
|
||||
},
|
||||
HumanUserIds: userIDs[2:3],
|
||||
ProjectGrants: []*admin.ImportDataSuccessProjectGrant{
|
||||
{
|
||||
GrantId: grantIDs[5],
|
||||
ProjectId: projectIDs[4],
|
||||
OrgId: orgIDs[6],
|
||||
},
|
||||
},
|
||||
ProjectGrantMembers: []*admin.ImportDataSuccessProjectGrantMember{
|
||||
{
|
||||
ProjectId: projectIDs[4],
|
||||
GrantId: grantIDs[5],
|
||||
UserId: userIDs[2],
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
got, err := Client.ImportData(AdminCTX, tt.req)
|
||||
if tt.wantErr {
|
||||
assert.Error(t, err)
|
||||
return
|
||||
}
|
||||
require.NoError(t, err)
|
||||
integration.EqualProto(t, tt.want, got)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func generateIDs(n int) []string {
|
||||
ids := make([]string, n)
|
||||
for i := range ids {
|
||||
ids[i] = uuid.NewString()
|
||||
}
|
||||
return ids
|
||||
}
|
||||
20
internal/api/grpc/admin/integration_test/information_test.go
Normal file
20
internal/api/grpc/admin/integration_test/information_test.go
Normal file
@@ -0,0 +1,20 @@
|
||||
//go:build integration
|
||||
|
||||
package admin_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/zitadel/zitadel/pkg/grpc/admin"
|
||||
)
|
||||
|
||||
func TestServer_Healthz(t *testing.T) {
|
||||
ctx, cancel := context.WithTimeout(AdminCTX, time.Minute)
|
||||
defer cancel()
|
||||
_, err := Instance.Client.Admin.Healthz(ctx, &admin.HealthzRequest{})
|
||||
require.NoError(t, err)
|
||||
}
|
||||
@@ -0,0 +1,97 @@
|
||||
//go:build integration
|
||||
|
||||
package admin_test
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/http/cookiejar"
|
||||
"net/url"
|
||||
"testing"
|
||||
|
||||
"github.com/muhlemmer/gu"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/zitadel/zitadel/internal/integration"
|
||||
"github.com/zitadel/zitadel/pkg/grpc/admin"
|
||||
)
|
||||
|
||||
func TestServer_Restrictions_DisallowPublicOrgRegistration(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
instance := integration.NewInstance(CTX)
|
||||
regOrgUrl, err := url.Parse("http://" + instance.Domain + ":8080/ui/login/register/org")
|
||||
require.NoError(t, err)
|
||||
// The CSRF cookie must be sent with every request.
|
||||
// We can simulate a browser session using a cookie jar.
|
||||
jar, err := cookiejar.New(nil)
|
||||
require.NoError(t, err)
|
||||
browserSession := &http.Client{Jar: jar}
|
||||
var csrfToken string
|
||||
iamOwnerCtx := instance.WithAuthorization(CTX, integration.UserTypeIAMOwner)
|
||||
|
||||
t.Run("public org registration is allowed by default", func(tt *testing.T) {
|
||||
csrfToken = awaitPubOrgRegAllowed(tt, iamOwnerCtx, instance.Client, browserSession, regOrgUrl)
|
||||
})
|
||||
t.Run("disallowing public org registration disables the endpoints", func(tt *testing.T) {
|
||||
_, err = instance.Client.Admin.SetRestrictions(iamOwnerCtx, &admin.SetRestrictionsRequest{DisallowPublicOrgRegistration: gu.Ptr(true)})
|
||||
require.NoError(tt, err)
|
||||
awaitPubOrgRegDisallowed(tt, iamOwnerCtx, instance.Client, browserSession, regOrgUrl, csrfToken)
|
||||
})
|
||||
t.Run("allowing public org registration again re-enables the endpoints", func(tt *testing.T) {
|
||||
_, err = instance.Client.Admin.SetRestrictions(iamOwnerCtx, &admin.SetRestrictionsRequest{DisallowPublicOrgRegistration: gu.Ptr(false)})
|
||||
require.NoError(tt, err)
|
||||
awaitPubOrgRegAllowed(tt, iamOwnerCtx, instance.Client, browserSession, regOrgUrl)
|
||||
})
|
||||
}
|
||||
|
||||
// awaitPubOrgRegAllowed doesn't accept a CSRF token, as we expected it to always produce a new one
|
||||
func awaitPubOrgRegAllowed(t *testing.T, ctx context.Context, cc *integration.Client, client *http.Client, parsedURL *url.URL) string {
|
||||
csrfToken := awaitGetSSRGetResponse(t, ctx, client, parsedURL, http.StatusOK)
|
||||
awaitPostFormResponse(t, ctx, client, parsedURL, http.StatusOK, csrfToken)
|
||||
restrictions, err := cc.Admin.GetRestrictions(ctx, &admin.GetRestrictionsRequest{})
|
||||
require.NoError(t, err)
|
||||
require.False(t, restrictions.DisallowPublicOrgRegistration)
|
||||
return csrfToken
|
||||
}
|
||||
|
||||
// awaitPubOrgRegDisallowed accepts an old CSRF token, as we don't expect to get a CSRF token from the GET request anymore
|
||||
func awaitPubOrgRegDisallowed(t *testing.T, ctx context.Context, cc *integration.Client, client *http.Client, parsedURL *url.URL, reuseOldCSRFToken string) {
|
||||
awaitGetSSRGetResponse(t, ctx, client, parsedURL, http.StatusNotFound)
|
||||
awaitPostFormResponse(t, ctx, client, parsedURL, http.StatusConflict, reuseOldCSRFToken)
|
||||
restrictions, err := cc.Admin.GetRestrictions(ctx, &admin.GetRestrictionsRequest{})
|
||||
require.NoError(t, err)
|
||||
require.True(t, restrictions.DisallowPublicOrgRegistration)
|
||||
}
|
||||
|
||||
// awaitGetSSRGetResponse cuts the CSRF token from the response body if it exists
|
||||
func awaitGetSSRGetResponse(t *testing.T, ctx context.Context, client *http.Client, parsedURL *url.URL, expectCode int) string {
|
||||
var csrfToken []byte
|
||||
await(t, ctx, func(tt *assert.CollectT) {
|
||||
resp, err := client.Get(parsedURL.String())
|
||||
require.NoError(tt, err)
|
||||
body, err := io.ReadAll(resp.Body)
|
||||
require.NoError(tt, err)
|
||||
searchField := `<input type="hidden" name="gorilla.csrf.Token" value="`
|
||||
_, after, hasCsrfToken := bytes.Cut(body, []byte(searchField))
|
||||
if hasCsrfToken {
|
||||
csrfToken, _, _ = bytes.Cut(after, []byte(`">`))
|
||||
}
|
||||
assert.Equal(tt, resp.StatusCode, expectCode)
|
||||
})
|
||||
return string(csrfToken)
|
||||
}
|
||||
|
||||
// awaitPostFormResponse needs a valid CSRF token to make it to the actual endpoint implementation and get the expected status code
|
||||
func awaitPostFormResponse(t *testing.T, ctx context.Context, client *http.Client, parsedURL *url.URL, expectCode int, csrfToken string) {
|
||||
await(t, ctx, func(tt *assert.CollectT) {
|
||||
resp, err := client.PostForm(parsedURL.String(), url.Values{
|
||||
"gorilla.csrf.Token": {csrfToken},
|
||||
})
|
||||
require.NoError(tt, err)
|
||||
assert.Equal(tt, resp.StatusCode, expectCode)
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,264 @@
|
||||
//go:build integration
|
||||
|
||||
package admin_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"io"
|
||||
"net/http"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"golang.org/x/text/language"
|
||||
"google.golang.org/grpc/codes"
|
||||
"google.golang.org/grpc/status"
|
||||
|
||||
"github.com/zitadel/zitadel/internal/integration"
|
||||
"github.com/zitadel/zitadel/pkg/grpc/admin"
|
||||
"github.com/zitadel/zitadel/pkg/grpc/management"
|
||||
"github.com/zitadel/zitadel/pkg/grpc/text"
|
||||
"github.com/zitadel/zitadel/pkg/grpc/user"
|
||||
)
|
||||
|
||||
func TestServer_Restrictions_AllowedLanguages(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
|
||||
defer cancel()
|
||||
|
||||
var (
|
||||
defaultAndAllowedLanguage = language.German
|
||||
supportedLanguagesStr = []string{language.German.String(), language.English.String(), language.Japanese.String()}
|
||||
disallowedLanguage = language.Spanish
|
||||
unsupportedLanguage = language.Afrikaans
|
||||
)
|
||||
|
||||
instance := integration.NewInstance(ctx)
|
||||
iamOwnerCtx := instance.WithAuthorization(ctx, integration.UserTypeIAMOwner)
|
||||
|
||||
t.Run("assumed defaults are correct", func(tt *testing.T) {
|
||||
tt.Run("languages are not restricted by default", func(ttt *testing.T) {
|
||||
restrictions, err := instance.Client.Admin.GetRestrictions(iamOwnerCtx, &admin.GetRestrictionsRequest{})
|
||||
require.NoError(ttt, err)
|
||||
require.Len(ttt, restrictions.AllowedLanguages, 0)
|
||||
})
|
||||
tt.Run("default language is English by default", func(ttt *testing.T) {
|
||||
defaultLang, err := instance.Client.Admin.GetDefaultLanguage(iamOwnerCtx, &admin.GetDefaultLanguageRequest{})
|
||||
require.NoError(ttt, err)
|
||||
require.Equal(ttt, language.Make(defaultLang.Language), language.English)
|
||||
})
|
||||
tt.Run("the discovery endpoint returns all supported languages", func(ttt *testing.T) {
|
||||
awaitDiscoveryEndpoint(ttt, instance.Domain, supportedLanguagesStr, nil)
|
||||
})
|
||||
})
|
||||
t.Run("restricting the default language fails", func(tt *testing.T) {
|
||||
_, err := instance.Client.Admin.SetRestrictions(iamOwnerCtx, &admin.SetRestrictionsRequest{AllowedLanguages: &admin.SelectLanguages{List: []string{defaultAndAllowedLanguage.String()}}})
|
||||
expectStatus, ok := status.FromError(err)
|
||||
require.True(tt, ok)
|
||||
require.Equal(tt, codes.FailedPrecondition, expectStatus.Code())
|
||||
})
|
||||
t.Run("not defining any restrictions throws an error", func(tt *testing.T) {
|
||||
_, err := instance.Client.Admin.SetRestrictions(iamOwnerCtx, &admin.SetRestrictionsRequest{})
|
||||
expectStatus, ok := status.FromError(err)
|
||||
require.True(tt, ok)
|
||||
require.Equal(tt, codes.InvalidArgument, expectStatus.Code())
|
||||
})
|
||||
t.Run("setting the default language works", func(tt *testing.T) {
|
||||
setAndAwaitDefaultLanguage(iamOwnerCtx, instance.Client, tt, defaultAndAllowedLanguage)
|
||||
})
|
||||
t.Run("restricting allowed languages works", func(tt *testing.T) {
|
||||
setAndAwaitAllowedLanguages(iamOwnerCtx, instance.Client, tt, []string{defaultAndAllowedLanguage.String()})
|
||||
})
|
||||
t.Run("GetAllowedLanguage returns only the allowed languages", func(tt *testing.T) {
|
||||
expectContains, expectNotContains := []string{defaultAndAllowedLanguage.String()}, []string{disallowedLanguage.String()}
|
||||
adminResp, err := instance.Client.Admin.GetAllowedLanguages(iamOwnerCtx, &admin.GetAllowedLanguagesRequest{})
|
||||
require.NoError(t, err)
|
||||
langs := adminResp.GetLanguages()
|
||||
assert.Condition(t, contains(langs, expectContains))
|
||||
assert.Condition(t, not(contains(langs, expectNotContains)))
|
||||
})
|
||||
t.Run("setting the default language to a disallowed language fails", func(tt *testing.T) {
|
||||
_, err := instance.Client.Admin.SetDefaultLanguage(iamOwnerCtx, &admin.SetDefaultLanguageRequest{Language: disallowedLanguage.String()})
|
||||
expectStatus, ok := status.FromError(err)
|
||||
require.True(tt, ok)
|
||||
require.Equal(tt, codes.FailedPrecondition, expectStatus.Code())
|
||||
})
|
||||
t.Run("the list of supported languages includes the disallowed languages", func(tt *testing.T) {
|
||||
supported, err := instance.Client.Admin.GetSupportedLanguages(iamOwnerCtx, &admin.GetSupportedLanguagesRequest{})
|
||||
require.NoError(tt, err)
|
||||
require.Condition(tt, contains(supported.GetLanguages(), supportedLanguagesStr))
|
||||
})
|
||||
t.Run("the disallowed language is not listed in the discovery endpoint", func(tt *testing.T) {
|
||||
awaitDiscoveryEndpoint(tt, instance.Domain, []string{defaultAndAllowedLanguage.String()}, []string{disallowedLanguage.String()})
|
||||
})
|
||||
t.Run("the login ui is rendered in the default language", func(tt *testing.T) {
|
||||
awaitLoginUILanguage(tt, instance.Domain, disallowedLanguage, defaultAndAllowedLanguage, "Passwort")
|
||||
})
|
||||
t.Run("preferred languages are not restricted by the supported languages", func(tt *testing.T) {
|
||||
tt.Run("change user profile", func(ttt *testing.T) {
|
||||
resp, err := instance.Client.Mgmt.ListUsers(iamOwnerCtx, &management.ListUsersRequest{Queries: []*user.SearchQuery{{Query: &user.SearchQuery_UserNameQuery{UserNameQuery: &user.UserNameQuery{
|
||||
UserName: "zitadel-admin@zitadel.localhost"}},
|
||||
}}})
|
||||
require.NoError(ttt, err)
|
||||
require.Len(ttt, resp.GetResult(), 1)
|
||||
humanAdmin := resp.GetResult()[0]
|
||||
profile := humanAdmin.GetHuman().GetProfile()
|
||||
require.NotEqual(ttt, unsupportedLanguage.String(), profile.GetPreferredLanguage())
|
||||
_, updateErr := instance.Client.Mgmt.UpdateHumanProfile(iamOwnerCtx, &management.UpdateHumanProfileRequest{
|
||||
PreferredLanguage: unsupportedLanguage.String(),
|
||||
UserId: humanAdmin.GetId(),
|
||||
FirstName: profile.GetFirstName(),
|
||||
LastName: profile.GetLastName(),
|
||||
NickName: profile.GetNickName(),
|
||||
DisplayName: profile.GetDisplayName(),
|
||||
Gender: profile.GetGender(),
|
||||
})
|
||||
require.NoError(ttt, updateErr)
|
||||
})
|
||||
})
|
||||
t.Run("custom texts are only restricted by the supported languages", func(tt *testing.T) {
|
||||
_, err := instance.Client.Admin.SetCustomLoginText(iamOwnerCtx, &admin.SetCustomLoginTextsRequest{
|
||||
Language: disallowedLanguage.String(),
|
||||
EmailVerificationText: &text.EmailVerificationScreenText{
|
||||
Description: "hodor",
|
||||
},
|
||||
})
|
||||
assert.NoError(tt, err)
|
||||
_, err = instance.Client.Mgmt.SetCustomLoginText(iamOwnerCtx, &management.SetCustomLoginTextsRequest{
|
||||
Language: disallowedLanguage.String(),
|
||||
EmailVerificationText: &text.EmailVerificationScreenText{
|
||||
Description: "hodor",
|
||||
},
|
||||
})
|
||||
assert.NoError(tt, err)
|
||||
_, err = instance.Client.Mgmt.SetCustomInitMessageText(iamOwnerCtx, &management.SetCustomInitMessageTextRequest{
|
||||
Language: disallowedLanguage.String(),
|
||||
Text: "hodor",
|
||||
})
|
||||
assert.NoError(tt, err)
|
||||
_, err = instance.Client.Admin.SetDefaultInitMessageText(iamOwnerCtx, &admin.SetDefaultInitMessageTextRequest{
|
||||
Language: disallowedLanguage.String(),
|
||||
Text: "hodor",
|
||||
})
|
||||
assert.NoError(tt, err)
|
||||
})
|
||||
t.Run("allowing all languages works", func(tt *testing.T) {
|
||||
tt.Run("restricting allowed languages works", func(ttt *testing.T) {
|
||||
setAndAwaitAllowedLanguages(iamOwnerCtx, instance.Client, ttt, make([]string, 0))
|
||||
})
|
||||
})
|
||||
|
||||
t.Run("allowing the language makes it usable again", func(tt *testing.T) {
|
||||
tt.Run("the previously disallowed language is listed in the discovery endpoint again", func(ttt *testing.T) {
|
||||
awaitDiscoveryEndpoint(ttt, instance.Domain, []string{disallowedLanguage.String()}, nil)
|
||||
})
|
||||
tt.Run("the login ui is rendered in the previously disallowed language", func(ttt *testing.T) {
|
||||
awaitLoginUILanguage(ttt, instance.Domain, disallowedLanguage, disallowedLanguage, "Contraseña")
|
||||
})
|
||||
})
|
||||
}
|
||||
|
||||
func setAndAwaitAllowedLanguages(ctx context.Context, cc *integration.Client, t *testing.T, selectLanguages []string) {
|
||||
_, err := cc.Admin.SetRestrictions(ctx, &admin.SetRestrictionsRequest{AllowedLanguages: &admin.SelectLanguages{List: selectLanguages}})
|
||||
require.NoError(t, err)
|
||||
awaitCtx, awaitCancel := context.WithTimeout(ctx, 10*time.Second)
|
||||
defer awaitCancel()
|
||||
await(t, awaitCtx, func(tt *assert.CollectT) {
|
||||
restrictions, getErr := cc.Admin.GetRestrictions(awaitCtx, &admin.GetRestrictionsRequest{})
|
||||
expectLanguages := selectLanguages
|
||||
if len(selectLanguages) == 0 {
|
||||
expectLanguages = nil
|
||||
}
|
||||
assert.NoError(tt, getErr)
|
||||
assert.Equal(tt, expectLanguages, restrictions.GetAllowedLanguages())
|
||||
})
|
||||
}
|
||||
|
||||
func setAndAwaitDefaultLanguage(ctx context.Context, cc *integration.Client, t *testing.T, lang language.Tag) {
|
||||
_, err := cc.Admin.SetDefaultLanguage(ctx, &admin.SetDefaultLanguageRequest{Language: lang.String()})
|
||||
require.NoError(t, err)
|
||||
awaitCtx, awaitCancel := context.WithTimeout(ctx, 10*time.Second)
|
||||
defer awaitCancel()
|
||||
await(t, awaitCtx, func(tt *assert.CollectT) {
|
||||
defaultLang, getErr := cc.Admin.GetDefaultLanguage(awaitCtx, &admin.GetDefaultLanguageRequest{})
|
||||
assert.NoError(tt, getErr)
|
||||
assert.Equal(tt, lang.String(), defaultLang.GetLanguage())
|
||||
})
|
||||
}
|
||||
|
||||
func awaitDiscoveryEndpoint(t *testing.T, domain string, containsUILocales, notContainsUILocales []string) {
|
||||
awaitCtx, awaitCancel := context.WithTimeout(context.Background(), 10*time.Second)
|
||||
defer awaitCancel()
|
||||
await(t, awaitCtx, func(tt *assert.CollectT) {
|
||||
req, err := http.NewRequestWithContext(awaitCtx, http.MethodGet, "http://"+domain+":8080/.well-known/openid-configuration", nil)
|
||||
require.NoError(tt, err)
|
||||
resp, err := http.DefaultClient.Do(req)
|
||||
require.NoError(tt, err)
|
||||
require.Equal(tt, http.StatusOK, resp.StatusCode)
|
||||
body, err := io.ReadAll(resp.Body)
|
||||
defer func() {
|
||||
require.NoError(tt, resp.Body.Close())
|
||||
}()
|
||||
require.NoError(tt, err)
|
||||
doc := struct {
|
||||
UILocalesSupported []string `json:"ui_locales_supported"`
|
||||
}{}
|
||||
require.NoError(tt, json.Unmarshal(body, &doc))
|
||||
if containsUILocales != nil {
|
||||
assert.Condition(tt, contains(doc.UILocalesSupported, containsUILocales))
|
||||
}
|
||||
if notContainsUILocales != nil {
|
||||
assert.Condition(tt, not(contains(doc.UILocalesSupported, notContainsUILocales)))
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
func awaitLoginUILanguage(t *testing.T, domain string, acceptLanguage language.Tag, expectLang language.Tag, containsText string) {
|
||||
awaitCtx, awaitCancel := context.WithTimeout(context.Background(), 10*time.Second)
|
||||
defer awaitCancel()
|
||||
await(t, awaitCtx, func(tt *assert.CollectT) {
|
||||
req, err := http.NewRequestWithContext(awaitCtx, http.MethodGet, "http://"+domain+":8080/ui/login/register", nil)
|
||||
req.Header.Set("Accept-Language", acceptLanguage.String())
|
||||
require.NoError(tt, err)
|
||||
resp, err := http.DefaultClient.Do(req)
|
||||
require.NoError(tt, err)
|
||||
assert.Equal(tt, http.StatusOK, resp.StatusCode)
|
||||
body, err := io.ReadAll(resp.Body)
|
||||
defer func() {
|
||||
require.NoError(tt, resp.Body.Close())
|
||||
}()
|
||||
require.NoError(tt, err)
|
||||
assert.Containsf(tt, string(body), containsText, "login ui language is in "+expectLang.String())
|
||||
})
|
||||
}
|
||||
|
||||
// We would love to use assert.Contains here, but it doesn't work with slices of strings
|
||||
func contains(container []string, subset []string) assert.Comparison {
|
||||
return func() bool {
|
||||
if subset == nil {
|
||||
return true
|
||||
}
|
||||
for _, str := range subset {
|
||||
var found bool
|
||||
for _, containerStr := range container {
|
||||
if str == containerStr {
|
||||
found = true
|
||||
break
|
||||
}
|
||||
}
|
||||
if !found {
|
||||
return false
|
||||
}
|
||||
}
|
||||
return true
|
||||
}
|
||||
}
|
||||
|
||||
func not(cmp assert.Comparison) assert.Comparison {
|
||||
return func() bool {
|
||||
return !cmp()
|
||||
}
|
||||
}
|
||||
61
internal/api/grpc/admin/integration_test/server_test.go
Normal file
61
internal/api/grpc/admin/integration_test/server_test.go
Normal file
@@ -0,0 +1,61 @@
|
||||
//go:build integration
|
||||
|
||||
package admin_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"os"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/zitadel/zitadel/internal/integration"
|
||||
admin_pb "github.com/zitadel/zitadel/pkg/grpc/admin"
|
||||
)
|
||||
|
||||
var (
|
||||
CTX, AdminCTX context.Context
|
||||
Instance *integration.Instance
|
||||
Client admin_pb.AdminServiceClient
|
||||
)
|
||||
|
||||
func TestMain(m *testing.M) {
|
||||
os.Exit(func() int {
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
|
||||
defer cancel()
|
||||
|
||||
Instance = integration.NewInstance(ctx)
|
||||
CTX = ctx
|
||||
AdminCTX = Instance.WithAuthorization(ctx, integration.UserTypeIAMOwner)
|
||||
Client = Instance.Client.Admin
|
||||
return m.Run()
|
||||
}())
|
||||
}
|
||||
|
||||
func await(t *testing.T, ctx context.Context, cb func(*assert.CollectT)) {
|
||||
deadline, ok := ctx.Deadline()
|
||||
require.True(t, ok, "context must have deadline")
|
||||
require.EventuallyWithT(
|
||||
t,
|
||||
func(tt *assert.CollectT) {
|
||||
defer func() {
|
||||
// Panics are not recovered and don't mark the test as failed, so we need to do that ourselves
|
||||
require.Nil(t, recover(), "panic in await callback")
|
||||
}()
|
||||
cb(tt)
|
||||
},
|
||||
time.Until(deadline),
|
||||
time.Second,
|
||||
"awaiting successful callback failed",
|
||||
)
|
||||
}
|
||||
|
||||
var _ assert.TestingT = (*noopAssertionT)(nil)
|
||||
|
||||
type noopAssertionT struct{}
|
||||
|
||||
func (*noopAssertionT) FailNow() {}
|
||||
|
||||
func (*noopAssertionT) Errorf(string, ...interface{}) {}
|
||||
Reference in New Issue
Block a user