Livio Amstutz 8a5badddf6
feat: Login, OP Support and Auth Queries (#177)
* fix: change oidc config

* fix: change oidc config secret

* begin models

* begin repo

* fix: implement grpc app funcs

* fix: add application requests

* fix: converter

* fix: converter

* fix: converter and generate clientid

* fix: tests

* feat: project grant aggregate

* feat: project grant

* fix: project grant check if role existing

* fix: project grant requests

* fix: project grant fixes

* fix: project grant member model

* fix: project grant member aggregate

* fix: project grant member eventstore

* fix: project grant member requests

* feat: user model

* begin repo

* repo models and more

* feat: user command side

* lots of functions

* user command side

* profile requests

* commit before rebase on user

* save

* local config with gopass and more

* begin new auth command (user centric)

* Update internal/user/model/user.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* Update internal/user/repository/eventsourcing/model/address.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* Update internal/user/repository/eventsourcing/model/address.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* Update internal/user/repository/eventsourcing/model/email.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* Update internal/user/repository/eventsourcing/model/email.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* Update internal/user/repository/eventsourcing/model/email.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* Update internal/user/repository/eventsourcing/model/mfa.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* Update internal/user/repository/eventsourcing/model/mfa.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* Update internal/user/repository/eventsourcing/model/password.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* Update internal/user/repository/eventsourcing/model/password.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* Update internal/user/repository/eventsourcing/model/password.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* Update internal/user/repository/eventsourcing/model/phone.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* Update internal/user/repository/eventsourcing/model/phone.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* Update internal/user/repository/eventsourcing/model/phone.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* Update internal/user/repository/eventsourcing/model/user.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* Update internal/user/repository/eventsourcing/model/user.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* Update internal/user/repository/eventsourcing/model/user.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* Update internal/usergrant/repository/eventsourcing/model/user_grant.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* Update internal/usergrant/repository/eventsourcing/model/user_grant.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* Update internal/usergrant/repository/eventsourcing/user_grant.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* Update internal/user/repository/eventsourcing/user_test.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* Update internal/user/repository/eventsourcing/eventstore_mock_test.go

Co-Authored-By: Livio Amstutz <livio.a@gmail.com>

* changes from mr review

* save files into basedir

* changes from mr review

* changes from mr review

* move to auth request

* Update internal/usergrant/repository/eventsourcing/cache.go

Co-authored-by: Silvan <silvan.reusser@gmail.com>

* Update internal/usergrant/repository/eventsourcing/cache.go

Co-authored-by: Silvan <silvan.reusser@gmail.com>

* changes requested on mr

* fix generate codes

* fix return if no events

* password code

* email verification step

* more steps

* lot of mfa

* begin tests

* more next steps

* auth api

* auth api (user)

* auth api (user)

* auth api (user)

* differ requests

* merge

* tests

* fix compilation error

* mock for id generator

* Update internal/user/repository/eventsourcing/model/password.go

Co-authored-by: Silvan <silvan.reusser@gmail.com>

* Update internal/user/repository/eventsourcing/model/user.go

Co-authored-by: Silvan <silvan.reusser@gmail.com>

* requests of mr

* check email

* begin separation of command and query

* otp

* change packages

* some cleanup and fixes

* tests for auth request / next steps

* add VerificationLifetimes to config and make it run

* tests

* fix code challenge validation

* cleanup

* fix merge

* begin view

* repackaging tests and configs

* fix startup config for auth

* add migration

* add PromptSelectAccount

* fix copy / paste

* remove user_agent files

* fixes

* fix sequences in user_session

* token commands

* token queries and signout

* fix

* fix set password test

* add token handler and table

* handle session init

* add session state

* add user view test cases

* change VerifyMyMfaOTP

* some fixes

* fix user repo in auth api

* cleanup

* add user session view test

* fix merge

* begin oidc

* user agent and more

* config

* keys

* key command and query

* add login statics

* key handler

* start login

* login handlers

* lot of fixes

* merge oidc

* add missing exports

* add missing exports

* fix some bugs

* authrequestid in htmls

* getrequest

* update auth request

* fix userid check

* add username to authrequest

* fix user session and auth request handling

* fix UserSessionsByAgentID

* fix auth request tests

* fix user session on UserPasswordChanged and MfaOtpRemoved

* fix MfaTypesSetupPossible

* handle mfa

* fill username

* auth request query checks new events

* fix userSessionByIDs

* fix tokens

* fix userSessionByIDs test

* add user selection

* init code

* user code creation date

* add init user step

* add verification failed types

* add verification failures

* verify init code

* user init code handle

* user init code handle

* fix userSessionByIDs

* update logging

* user agent cookie

* browserinfo from request

* add DeleteAuthRequest

* add static login files to binary

* add login statik to build

* move generate to separate file and remove statik.go files

* remove static dirs from startup.yaml

* generate into separate namespaces

* merge master

* auth request code

* auth request type mapping

* fix keys

* improve tokens

* improve register and basic styling

* fix ailerons font

* improve password reset

* add audience to token

* all oidc apps as audience

* fix test nextStep

* fix email texts

* remove "not set"

* lot of style changes

* improve copy to clipboard

* fix footer

* add cookie handler

* remove placeholders

* fix compilation after merge

* fix auth config

* remove comments

* typo

* use new secrets store

* change default pws to match default policy

* fixes

* add todo

* enable login

* fix db name

* Auth queries (#179)

* my usersession

* org structure/ auth handlers

* working user grant spooler

* auth internal user grants

* search my project orgs

* remove permissions file

* my zitadel permissions

* my zitadel permissions

* remove unused code

* authz

* app searches in view

* token verification

* fix user grant load

* fix tests

* fix tests

* read configs

* remove unused const

* remove todos

* env variables

* app_name

* working authz

* search projects

* global resourceowner

* Update internal/api/auth/permissions.go

Co-authored-by: Livio Amstutz <livio.a@gmail.com>

* Update internal/api/auth/permissions.go

Co-authored-by: Livio Amstutz <livio.a@gmail.com>

* model2 rename

* at least it works

* check token expiry

* search my user grants

* remove token table from authz

Co-authored-by: Livio Amstutz <livio.a@gmail.com>

* fix test

* fix ports and enable console

Co-authored-by: Fabiennne <fabienne.gerschwiler@gmail.com>
Co-authored-by: Fabi <38692350+fgerschwiler@users.noreply.github.com>
Co-authored-by: Silvan <silvan.reusser@gmail.com>
2020-06-05 07:50:04 +02:00

587 lines
14 KiB
Go

package eventsourcing
import (
"context"
"github.com/caos/zitadel/internal/org/repository/eventsourcing/model"
"testing"
"github.com/caos/zitadel/internal/api/auth"
"github.com/caos/zitadel/internal/errors"
es_models "github.com/caos/zitadel/internal/eventstore/models"
org_model "github.com/caos/zitadel/internal/org/model"
)
func Test_isReservedValidation(t *testing.T) {
type res struct {
isErr func(error) bool
agggregateSequence uint64
}
type args struct {
aggregate *es_models.Aggregate
eventType es_models.EventType
Events []*es_models.Event
}
tests := []struct {
name string
args args
res res
}{
{
name: "no events success",
args: args{
aggregate: &es_models.Aggregate{},
eventType: "object.reserved",
Events: []*es_models.Event{},
},
res: res{
isErr: nil,
agggregateSequence: 0,
},
},
{
name: "not reseved success",
args: args{
aggregate: &es_models.Aggregate{},
eventType: "object.reserved",
Events: []*es_models.Event{
{
AggregateID: "asdf",
AggregateType: "org",
Sequence: 45,
Type: "object.released",
},
},
},
res: res{
isErr: nil,
agggregateSequence: 45,
},
},
{
name: "reseved error",
args: args{
aggregate: &es_models.Aggregate{},
eventType: "object.reserved",
Events: []*es_models.Event{
{
AggregateID: "asdf",
AggregateType: "org",
Sequence: 45,
Type: "object.reserved",
},
},
},
res: res{
isErr: errors.IsPreconditionFailed,
agggregateSequence: 0,
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
validate := isReservedValidation(tt.args.aggregate, tt.args.eventType)
err := validate(tt.args.Events...)
if tt.res.isErr == nil && err != nil {
t.Errorf("no error expected got: %v", err)
}
if tt.res.isErr != nil && !tt.res.isErr(err) {
t.Errorf("wrong error got: %v", err)
}
if err == nil && tt.args.aggregate.PreviousSequence != tt.res.agggregateSequence {
t.Errorf("expected sequence %d got %d", tt.res.agggregateSequence, tt.args.aggregate.PreviousSequence)
}
})
}
}
func aggregateWithPrecondition() *es_models.Aggregate {
return nil
}
func Test_uniqueNameAggregate(t *testing.T) {
type res struct {
expected *es_models.Aggregate
isErr func(error) bool
}
type args struct {
ctx context.Context
aggCreator *es_models.AggregateCreator
orgName string
}
tests := []struct {
name string
args args
res res
}{
{
name: "no org name error",
args: args{
ctx: auth.NewMockContext("orgID", "userID"),
aggCreator: es_models.NewAggregateCreator("test"),
orgName: "",
},
res: res{
expected: nil,
isErr: errors.IsPreconditionFailed,
},
},
{
name: "aggregate created",
args: args{
ctx: auth.NewMockContext("orgID", "userID"),
aggCreator: es_models.NewAggregateCreator("test"),
orgName: "asdf",
},
res: res{
expected: aggregateWithPrecondition(),
isErr: nil,
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
got, err := uniqueNameAggregate(tt.args.ctx, tt.args.aggCreator, "", tt.args.orgName)
if tt.res.isErr == nil && err != nil {
t.Errorf("no error expected got: %v", err)
}
if tt.res.isErr != nil && !tt.res.isErr(err) {
t.Errorf("wrong error got %T: %v", err, err)
}
if tt.res.isErr == nil && (got.Precondition == nil || got.Precondition.Query == nil || got.Precondition.Validation == nil) {
t.Errorf("precondition is not set correctly")
}
})
}
}
func Test_uniqueDomainAggregate(t *testing.T) {
type res struct {
expected *es_models.Aggregate
isErr func(error) bool
}
type args struct {
ctx context.Context
aggCreator *es_models.AggregateCreator
orgDomain string
}
tests := []struct {
name string
args args
res res
}{
{
name: "no org domain error",
args: args{
ctx: auth.NewMockContext("orgID", "userID"),
aggCreator: es_models.NewAggregateCreator("test"),
orgDomain: "",
},
res: res{
expected: nil,
isErr: errors.IsPreconditionFailed,
},
},
{
name: "aggregate created",
args: args{
ctx: auth.NewMockContext("orgID", "userID"),
aggCreator: es_models.NewAggregateCreator("test"),
orgDomain: "asdf",
},
res: res{
expected: aggregateWithPrecondition(),
isErr: nil,
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
got, err := uniqueDomainAggregate(tt.args.ctx, tt.args.aggCreator, "", tt.args.orgDomain)
if tt.res.isErr == nil && err != nil {
t.Errorf("no error expected got: %v", err)
}
if tt.res.isErr != nil && !tt.res.isErr(err) {
t.Errorf("wrong error got %T: %v", err, err)
}
if tt.res.isErr == nil && (got.Precondition == nil || got.Precondition.Query == nil || got.Precondition.Validation == nil) {
t.Errorf("precondition is not set correctly")
}
})
}
}
func TestOrgReactivateAggregate(t *testing.T) {
type res struct {
isErr func(error) bool
}
type args struct {
aggCreator *es_models.AggregateCreator
org *model.Org
ctx context.Context
}
tests := []struct {
name string
args args
res res
}{
{
name: "correct",
args: args{
aggCreator: es_models.NewAggregateCreator("test"),
ctx: auth.NewMockContext("org", "user"),
org: &model.Org{
ObjectRoot: es_models.ObjectRoot{
AggregateID: "orgID",
Sequence: 2,
},
State: int32(org_model.ORGSTATE_INACTIVE),
},
},
},
{
name: "already active error",
args: args{
aggCreator: es_models.NewAggregateCreator("test"),
ctx: auth.NewMockContext("org", "user"),
org: &model.Org{
ObjectRoot: es_models.ObjectRoot{
AggregateID: "orgID",
Sequence: 2,
},
State: int32(org_model.ORGSTATE_ACTIVE),
},
},
res: res{
isErr: errors.IsErrorInvalidArgument,
},
},
{
name: "org nil error",
args: args{
aggCreator: es_models.NewAggregateCreator("test"),
ctx: auth.NewMockContext("org", "user"),
org: nil,
},
res: res{
isErr: errors.IsPreconditionFailed,
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
aggregateCreator := orgReactivateAggregate(tt.args.aggCreator, tt.args.org)
aggregate, err := aggregateCreator(tt.args.ctx)
if tt.res.isErr == nil && err != nil {
t.Errorf("no error expected got: %v", err)
}
if tt.res.isErr != nil && !tt.res.isErr(err) {
t.Errorf("wrong error got %T: %v", err, err)
}
if tt.res.isErr == nil && aggregate == nil {
t.Error("aggregate must not be nil")
}
})
}
}
func TestOrgDeactivateAggregate(t *testing.T) {
type res struct {
isErr func(error) bool
}
type args struct {
aggCreator *es_models.AggregateCreator
org *model.Org
ctx context.Context
}
tests := []struct {
name string
args args
res res
}{
{
name: "correct",
args: args{
aggCreator: es_models.NewAggregateCreator("test"),
ctx: auth.NewMockContext("org", "user"),
org: &model.Org{
ObjectRoot: es_models.ObjectRoot{
AggregateID: "orgID",
Sequence: 2,
},
State: int32(org_model.ORGSTATE_ACTIVE),
},
},
},
{
name: "already inactive error",
args: args{
aggCreator: es_models.NewAggregateCreator("test"),
ctx: auth.NewMockContext("org", "user"),
org: &model.Org{
ObjectRoot: es_models.ObjectRoot{
AggregateID: "orgID",
Sequence: 2,
},
State: int32(org_model.ORGSTATE_INACTIVE),
},
},
res: res{
isErr: errors.IsErrorInvalidArgument,
},
},
{
name: "org nil error",
args: args{
aggCreator: es_models.NewAggregateCreator("test"),
ctx: auth.NewMockContext("org", "user"),
org: nil,
},
res: res{
isErr: errors.IsPreconditionFailed,
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
aggregateCreator := orgDeactivateAggregate(tt.args.aggCreator, tt.args.org)
aggregate, err := aggregateCreator(tt.args.ctx)
if tt.res.isErr == nil && err != nil {
t.Errorf("no error expected got: %v", err)
}
if tt.res.isErr != nil && !tt.res.isErr(err) {
t.Errorf("wrong error got %T: %v", err, err)
}
if tt.res.isErr == nil && aggregate == nil {
t.Error("aggregate must not be nil")
}
})
}
}
func TestOrgUpdateAggregates(t *testing.T) {
type res struct {
aggregateCount int
isErr func(error) bool
}
type args struct {
ctx context.Context
aggCreator *es_models.AggregateCreator
existing *model.Org
updated *model.Org
}
tests := []struct {
name string
args args
res res
}{
{
name: "no existing org error",
args: args{
ctx: auth.NewMockContext("org", "user"),
aggCreator: es_models.NewAggregateCreator("test"),
existing: nil,
updated: &model.Org{},
},
res: res{
aggregateCount: 0,
isErr: errors.IsPreconditionFailed,
},
},
{
name: "no updated org error",
args: args{
ctx: auth.NewMockContext("org", "user"),
aggCreator: es_models.NewAggregateCreator("test"),
existing: &model.Org{},
updated: nil,
},
res: res{
aggregateCount: 0,
isErr: errors.IsPreconditionFailed,
},
},
{
name: "no changes",
args: args{
ctx: auth.NewMockContext("org", "user"),
aggCreator: es_models.NewAggregateCreator("test"),
existing: &model.Org{},
updated: &model.Org{},
},
res: res{
aggregateCount: 0,
isErr: errors.IsPreconditionFailed,
},
},
{
name: "name changed",
args: args{
ctx: auth.NewMockContext("org", "user"),
aggCreator: es_models.NewAggregateCreator("test"),
existing: &model.Org{
ObjectRoot: es_models.ObjectRoot{
AggregateID: "sdaf",
Sequence: 5,
},
Domain: "caos.ch",
Name: "coas",
},
updated: &model.Org{
ObjectRoot: es_models.ObjectRoot{
AggregateID: "sdaf",
Sequence: 5,
},
Domain: "caos.ch",
Name: "caos",
},
},
res: res{
aggregateCount: 2,
isErr: nil,
},
},
{
name: "domain changed",
args: args{
ctx: auth.NewMockContext("org", "user"),
aggCreator: es_models.NewAggregateCreator("test"),
existing: &model.Org{
ObjectRoot: es_models.ObjectRoot{
AggregateID: "sdaf",
Sequence: 5,
},
Domain: "caos.swiss",
Name: "caos",
},
updated: &model.Org{
ObjectRoot: es_models.ObjectRoot{
AggregateID: "sdaf",
Sequence: 5,
},
Domain: "caos.ch",
Name: "caos",
},
},
res: res{
aggregateCount: 2,
isErr: nil,
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
got, err := OrgUpdateAggregates(tt.args.ctx, tt.args.aggCreator, tt.args.existing, tt.args.updated)
if tt.res.isErr == nil && err != nil {
t.Errorf("no error expected got: %v", err)
}
if tt.res.isErr != nil && !tt.res.isErr(err) {
t.Errorf("wrong error got %T: %v", err, err)
}
if tt.res.isErr == nil && len(got) != tt.res.aggregateCount {
t.Errorf("OrgUpdateAggregates() aggregate count = %d, wanted count %d", len(got), tt.res.aggregateCount)
}
})
}
}
func TestOrgCreatedAggregates(t *testing.T) {
type res struct {
aggregateCount int
isErr func(error) bool
}
type args struct {
ctx context.Context
aggCreator *es_models.AggregateCreator
org *model.Org
}
tests := []struct {
name string
args args
res res
}{
{
name: "no org error",
args: args{
ctx: auth.NewMockContext("org", "user"),
aggCreator: es_models.NewAggregateCreator("test"),
org: nil,
},
res: res{
aggregateCount: 0,
isErr: errors.IsPreconditionFailed,
},
},
{
name: "org successful",
args: args{
ctx: auth.NewMockContext("org", "user"),
aggCreator: es_models.NewAggregateCreator("test"),
org: &model.Org{
ObjectRoot: es_models.ObjectRoot{
AggregateID: "sdaf",
Sequence: 5,
},
Domain: "caos.ch",
Name: "caos",
},
},
res: res{
aggregateCount: 3,
isErr: nil,
},
},
{
name: "no domain error",
args: args{
ctx: auth.NewMockContext("org", "user"),
aggCreator: es_models.NewAggregateCreator("test"),
org: &model.Org{
ObjectRoot: es_models.ObjectRoot{
AggregateID: "sdaf",
Sequence: 5,
},
Name: "caos",
},
},
res: res{
aggregateCount: 2,
isErr: errors.IsPreconditionFailed,
},
},
{
name: "no name error",
args: args{
ctx: auth.NewMockContext("org", "user"),
aggCreator: es_models.NewAggregateCreator("test"),
org: &model.Org{
ObjectRoot: es_models.ObjectRoot{
AggregateID: "sdaf",
Sequence: 5,
},
Domain: "caos.ch",
},
},
res: res{
aggregateCount: 2,
isErr: errors.IsPreconditionFailed,
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
got, err := orgCreatedAggregates(tt.args.ctx, tt.args.aggCreator, tt.args.org)
if tt.res.isErr == nil && err != nil {
t.Errorf("no error expected got %T: %v", err, err)
}
if tt.res.isErr != nil && !tt.res.isErr(err) {
t.Errorf("wrong error got %T: %v", err, err)
}
if tt.res.isErr == nil && len(got) != tt.res.aggregateCount {
t.Errorf("OrgUpdateAggregates() aggregate count = %d, wanted count %d", len(got), tt.res.aggregateCount)
}
})
}
}