steveandClaude Opus 4.8
84edf3e42a
OIDC is pansy's primary login path (Authentik the target IdP); local auth (#4) remains the fallback and both issue the same session cookie. - deps: github.com/coreos/go-oidc/v3 + golang.org/x/oauth2 (both pure Go; CGO stays off). - api/oidc.go: lazy issuer discovery (retried per-request, never crashes a server that also serves local auth), GET /auth/oidc/login builds an authorization-code URL with PKCE S256 + random state + nonce stashed in a short-lived HttpOnly cookie, GET /auth/oidc/callback verifies state (constant-time), exchanges the code with the PKCE verifier, verifies the ID token + nonce, and starts a pansy session. Failures redirect to /login?error=... ; success to /gardens. - service.LoginOIDC: (issuer,subject) match -> login; else *verified* email match -> link onto the existing account; else JIT-create (the IdP gates access, so PANSY_REGISTRATION doesn't apply). Unverified email colliding with an existing account is refused (takeover guard); no email is refused (email is the account key). Reuses the atomic CreateUser. - store: GetUserByOIDC + LinkOIDC (unique-pair backstop). - config: OIDCReady() (needs issuer+client+BaseURL for the redirect URI); /auth/providers now reports oidc from it and defaults the button label to "Sign in with Authentik". OIDC routes are only registered when ready, so an unconfigured instance 404s them. - PANSY_LOCAL_AUTH=false rejects/hides local auth but not OIDC. Tests: service provisioning (JIT, repeat login, link, unverified-collision refusal, no-email, name fallback, works with local auth off); api (routes-absent-when-unconfigured, providers reporting, login redirect with PKCE params + tx cookie via a fake discovery server, callback state/error paths). Smoke-tested: unreachable issuer degrades to error=oidc_unavailable with the server still up and local auth working. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi
392 lines
14 KiB
Go
392 lines
14 KiB
Go
package service
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"gitea.stevedudenhoeffer.com/steve/pansy/internal/config"
|
|
"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
|
|
"gitea.stevedudenhoeffer.com/steve/pansy/internal/store"
|
|
)
|
|
|
|
// newTestService builds a Service over a fresh in-memory database.
|
|
func newTestService(t *testing.T, cfg *config.Config) *Service {
|
|
t.Helper()
|
|
db, err := store.Open(":memory:")
|
|
if err != nil {
|
|
t.Fatalf("store.Open: %v", err)
|
|
}
|
|
t.Cleanup(func() { db.Close() })
|
|
if err := db.Migrate(context.Background()); err != nil {
|
|
t.Fatalf("Migrate: %v", err)
|
|
}
|
|
return New(db, cfg)
|
|
}
|
|
|
|
func openConfig() *config.Config {
|
|
return &config.Config{Registration: config.RegistrationOpen, LocalAuth: true}
|
|
}
|
|
|
|
func mustRegister(t *testing.T, s *Service, email, name, pw string) *domain.User {
|
|
t.Helper()
|
|
u, err := s.Register(context.Background(), RegisterInput{Email: email, DisplayName: name, Password: pw})
|
|
if err != nil {
|
|
t.Fatalf("Register(%s): %v", email, err)
|
|
}
|
|
return u
|
|
}
|
|
|
|
func TestRegisterFirstUserIsAdmin(t *testing.T) {
|
|
s := newTestService(t, openConfig())
|
|
|
|
first := mustRegister(t, s, "[email protected]", "Alice", "password123")
|
|
if !first.IsAdmin {
|
|
t.Error("first user should be admin")
|
|
}
|
|
|
|
second := mustRegister(t, s, "[email protected]", "Bob", "password123")
|
|
if second.IsAdmin {
|
|
t.Error("second user should not be admin")
|
|
}
|
|
}
|
|
|
|
func TestRegisterNormalizesAndRejectsDuplicateEmail(t *testing.T) {
|
|
s := newTestService(t, openConfig())
|
|
mustRegister(t, s, "[email protected]", "Alice", "password123")
|
|
|
|
// Stored normalized (lowercased).
|
|
u, err := s.store.GetUserByEmail(context.Background(), "[email protected]")
|
|
if err != nil {
|
|
t.Fatalf("lookup normalized email: %v", err)
|
|
}
|
|
if u.Email != "[email protected]" {
|
|
t.Errorf("stored email = %q, want lowercased", u.Email)
|
|
}
|
|
|
|
// A different-cased duplicate is rejected.
|
|
_, err = s.Register(context.Background(), RegisterInput{Email: "[email protected]", DisplayName: "A2", Password: "password123"})
|
|
if !errors.Is(err, domain.ErrEmailTaken) {
|
|
t.Errorf("duplicate register err = %v, want ErrEmailTaken", err)
|
|
}
|
|
}
|
|
|
|
func TestRegisterRejectsBlankFields(t *testing.T) {
|
|
s := newTestService(t, openConfig())
|
|
_, err := s.Register(context.Background(), RegisterInput{Email: " ", DisplayName: "", Password: ""})
|
|
if !errors.Is(err, domain.ErrInvalidInput) {
|
|
t.Errorf("blank register err = %v, want ErrInvalidInput", err)
|
|
}
|
|
}
|
|
|
|
func TestRegistrationClosedAllowsBootstrapThenBlocks(t *testing.T) {
|
|
cfg := openConfig()
|
|
cfg.Registration = config.RegistrationClosed
|
|
s := newTestService(t, cfg)
|
|
|
|
// The very first user may register even when closed (bootstrap).
|
|
first := mustRegister(t, s, "[email protected]", "Admin", "password123")
|
|
if !first.IsAdmin {
|
|
t.Error("bootstrap user should be admin")
|
|
}
|
|
|
|
// Subsequent signups are blocked.
|
|
_, err := s.Register(context.Background(), RegisterInput{Email: "[email protected]", DisplayName: "Bob", Password: "password123"})
|
|
if !errors.Is(err, domain.ErrRegistrationClosed) {
|
|
t.Errorf("closed register err = %v, want ErrRegistrationClosed", err)
|
|
}
|
|
}
|
|
|
|
func TestRejectsOverlongPassword(t *testing.T) {
|
|
s := newTestService(t, openConfig())
|
|
long := strings.Repeat("a", maxPasswordLen+1)
|
|
|
|
if _, err := s.Register(context.Background(), RegisterInput{Email: "[email protected]", DisplayName: "A", Password: long}); !errors.Is(err, domain.ErrInvalidInput) {
|
|
t.Errorf("register overlong err = %v, want ErrInvalidInput", err)
|
|
}
|
|
|
|
mustRegister(t, s, "[email protected]", "Bob", "password123")
|
|
if _, err := s.Login(context.Background(), "[email protected]", long); !errors.Is(err, domain.ErrInvalidCredentials) {
|
|
t.Errorf("login overlong err = %v, want ErrInvalidCredentials", err)
|
|
}
|
|
}
|
|
|
|
func TestLocalAuthDisabledRejectsRegisterAndLogin(t *testing.T) {
|
|
cfg := openConfig()
|
|
cfg.LocalAuth = false
|
|
s := newTestService(t, cfg)
|
|
|
|
if _, err := s.Register(context.Background(), RegisterInput{Email: "[email protected]", DisplayName: "A", Password: "password123"}); !errors.Is(err, domain.ErrLocalAuthDisabled) {
|
|
t.Errorf("register err = %v, want ErrLocalAuthDisabled", err)
|
|
}
|
|
if _, err := s.Login(context.Background(), "[email protected]", "password123"); !errors.Is(err, domain.ErrLocalAuthDisabled) {
|
|
t.Errorf("login err = %v, want ErrLocalAuthDisabled", err)
|
|
}
|
|
}
|
|
|
|
func TestLoginSucceedsAndFailsIndistinguishably(t *testing.T) {
|
|
s := newTestService(t, openConfig())
|
|
mustRegister(t, s, "[email protected]", "Alice", "correct-horse")
|
|
|
|
// Correct credentials (case-insensitive email).
|
|
u, err := s.Login(context.Background(), "[email protected]", "correct-horse")
|
|
if err != nil {
|
|
t.Fatalf("login correct: %v", err)
|
|
}
|
|
if u.Email != "[email protected]" {
|
|
t.Errorf("logged-in user = %q", u.Email)
|
|
}
|
|
|
|
// Wrong password and unknown email both yield the same sentinel.
|
|
if _, err := s.Login(context.Background(), "[email protected]", "wrong"); !errors.Is(err, domain.ErrInvalidCredentials) {
|
|
t.Errorf("wrong-password err = %v, want ErrInvalidCredentials", err)
|
|
}
|
|
if _, err := s.Login(context.Background(), "[email protected]", "whatever"); !errors.Is(err, domain.ErrInvalidCredentials) {
|
|
t.Errorf("unknown-email err = %v, want ErrInvalidCredentials", err)
|
|
}
|
|
}
|
|
|
|
func TestLoginRejectsOIDCOnlyUser(t *testing.T) {
|
|
s := newTestService(t, openConfig())
|
|
// Simulate an OIDC-only account (no password hash) directly in the store.
|
|
iss, sub := "https://idp.example", "subject-1"
|
|
if _, err := s.store.CreateUser(context.Background(), &domain.User{
|
|
Email: "[email protected]", DisplayName: "O", OIDCIssuer: &iss, OIDCSubject: &sub,
|
|
}, true); err != nil {
|
|
t.Fatalf("seed oidc user: %v", err)
|
|
}
|
|
if _, err := s.Login(context.Background(), "[email protected]", "anything"); !errors.Is(err, domain.ErrInvalidCredentials) {
|
|
t.Errorf("oidc-only login err = %v, want ErrInvalidCredentials", err)
|
|
}
|
|
}
|
|
|
|
func TestSessionLifecycle(t *testing.T) {
|
|
s := newTestService(t, openConfig())
|
|
u := mustRegister(t, s, "[email protected]", "Alice", "password123")
|
|
|
|
token, _, err := s.CreateSession(context.Background(), u.ID)
|
|
if err != nil {
|
|
t.Fatalf("CreateSession: %v", err)
|
|
}
|
|
|
|
got, exp, err := s.ResolveSession(context.Background(), token)
|
|
if err != nil {
|
|
t.Fatalf("ResolveSession: %v", err)
|
|
}
|
|
if got.ID != u.ID {
|
|
t.Errorf("resolved user %d, want %d", got.ID, u.ID)
|
|
}
|
|
if !exp.After(s.now()) {
|
|
t.Errorf("resolved expiry %v is not in the future", exp)
|
|
}
|
|
|
|
// Logout invalidates it.
|
|
if err := s.Logout(context.Background(), token); err != nil {
|
|
t.Fatalf("Logout: %v", err)
|
|
}
|
|
if _, _, err := s.ResolveSession(context.Background(), token); !errors.Is(err, domain.ErrNotFound) {
|
|
t.Errorf("resolve after logout err = %v, want ErrNotFound", err)
|
|
}
|
|
}
|
|
|
|
func TestResolveSessionRejectsGarbageToken(t *testing.T) {
|
|
s := newTestService(t, openConfig())
|
|
if _, _, err := s.ResolveSession(context.Background(), "not-a-real-token"); !errors.Is(err, domain.ErrNotFound) {
|
|
t.Errorf("garbage token err = %v, want ErrNotFound", err)
|
|
}
|
|
if _, _, err := s.ResolveSession(context.Background(), ""); !errors.Is(err, domain.ErrNotFound) {
|
|
t.Errorf("empty token err = %v, want ErrNotFound", err)
|
|
}
|
|
}
|
|
|
|
func TestSessionExpiryAndLazyDeletion(t *testing.T) {
|
|
s := newTestService(t, openConfig())
|
|
u := mustRegister(t, s, "[email protected]", "Alice", "password123")
|
|
|
|
base := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
|
|
s.now = func() time.Time { return base }
|
|
|
|
token, _, err := s.CreateSession(context.Background(), u.ID)
|
|
if err != nil {
|
|
t.Fatalf("CreateSession: %v", err)
|
|
}
|
|
|
|
// Jump past the 30-day TTL: the session must be treated as gone...
|
|
s.now = func() time.Time { return base.Add(sessionTTL + time.Hour) }
|
|
if _, _, err := s.ResolveSession(context.Background(), token); !errors.Is(err, domain.ErrNotFound) {
|
|
t.Fatalf("expired resolve err = %v, want ErrNotFound", err)
|
|
}
|
|
// ...and lazily deleted from the store.
|
|
if _, err := s.store.GetSession(context.Background(), hashToken(token)); !errors.Is(err, domain.ErrNotFound) {
|
|
t.Errorf("expired session row still present: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestSessionSlidingRenewal(t *testing.T) {
|
|
s := newTestService(t, openConfig())
|
|
u := mustRegister(t, s, "[email protected]", "Alice", "password123")
|
|
|
|
base := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
|
|
s.now = func() time.Time { return base }
|
|
token, firstExp, err := s.CreateSession(context.Background(), u.ID)
|
|
if err != nil {
|
|
t.Fatalf("CreateSession: %v", err)
|
|
}
|
|
|
|
// Use it 10 days later; expiry should slide forward.
|
|
s.now = func() time.Time { return base.Add(10 * 24 * time.Hour) }
|
|
_, resolvedExp, err := s.ResolveSession(context.Background(), token)
|
|
if err != nil {
|
|
t.Fatalf("ResolveSession: %v", err)
|
|
}
|
|
if !resolvedExp.After(firstExp) {
|
|
t.Errorf("returned expiry did not slide: %v not after %v", resolvedExp, firstExp)
|
|
}
|
|
sess, err := s.store.GetSession(context.Background(), hashToken(token))
|
|
if err != nil {
|
|
t.Fatalf("GetSession: %v", err)
|
|
}
|
|
newExp, err := parseTime(sess.ExpiresAt)
|
|
if err != nil {
|
|
t.Fatalf("parse expiry: %v", err)
|
|
}
|
|
if !newExp.After(firstExp) {
|
|
t.Errorf("expiry did not slide: new %v not after first %v", newExp, firstExp)
|
|
}
|
|
}
|
|
|
|
func TestCleanupExpiredSessions(t *testing.T) {
|
|
s := newTestService(t, openConfig())
|
|
u := mustRegister(t, s, "[email protected]", "Alice", "password123")
|
|
|
|
base := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
|
|
s.now = func() time.Time { return base }
|
|
if _, _, err := s.CreateSession(context.Background(), u.ID); err != nil {
|
|
t.Fatalf("CreateSession: %v", err)
|
|
}
|
|
|
|
// Before expiry: nothing to clean.
|
|
if n, err := s.CleanupExpiredSessions(context.Background()); err != nil || n != 0 {
|
|
t.Fatalf("early cleanup = (%d, %v), want (0, nil)", n, err)
|
|
}
|
|
|
|
// After expiry: the one session is purged.
|
|
s.now = func() time.Time { return base.Add(sessionTTL + time.Hour) }
|
|
if n, err := s.CleanupExpiredSessions(context.Background()); err != nil || n != 1 {
|
|
t.Fatalf("late cleanup = (%d, %v), want (1, nil)", n, err)
|
|
}
|
|
}
|
|
|
|
func TestProvidersReflectsConfig(t *testing.T) {
|
|
// No OIDC configured → local only.
|
|
s := newTestService(t, openConfig())
|
|
p := s.Providers()
|
|
if !p.Local || p.OIDC {
|
|
t.Errorf("providers = %+v, want local=true oidc=false", p)
|
|
}
|
|
|
|
// OIDC configured with a base URL → reported ready.
|
|
ready := openConfig()
|
|
ready.BaseURL = "https://pansy.example.com"
|
|
ready.OIDC = config.OIDCConfig{Issuer: "https://idp.example", ClientID: "cid", ButtonLabel: "Sign in with Authentik"}
|
|
if got := newTestService(t, ready).Providers(); !got.OIDC || got.OIDCLabel != "Sign in with Authentik" {
|
|
t.Errorf("providers = %+v, want oidc=true with Authentik label", got)
|
|
}
|
|
|
|
// OIDC configured but no base URL → not ready (can't build a redirect URI).
|
|
noBase := openConfig()
|
|
noBase.OIDC = config.OIDCConfig{Issuer: "https://idp.example", ClientID: "cid"}
|
|
if got := newTestService(t, noBase).Providers(); got.OIDC {
|
|
t.Error("OIDC should be false without a base URL")
|
|
}
|
|
}
|
|
|
|
func oidcIdentity(sub, email, name string, verified bool) OIDCIdentity {
|
|
return OIDCIdentity{Issuer: "https://idp.example", Subject: sub, Email: email, EmailVerified: verified, Name: name}
|
|
}
|
|
|
|
func TestLoginOIDCJITProvisionsThenReturnsSameUser(t *testing.T) {
|
|
s := newTestService(t, openConfig())
|
|
|
|
u, err := s.LoginOIDC(context.Background(), oidcIdentity("sub-1", "[email protected]", "Alice", true))
|
|
if err != nil {
|
|
t.Fatalf("LoginOIDC create: %v", err)
|
|
}
|
|
if !u.IsAdmin {
|
|
t.Error("first provisioned OIDC user should be admin")
|
|
}
|
|
if u.OIDCSubject == nil || *u.OIDCSubject != "sub-1" {
|
|
t.Errorf("oidc subject not stamped: %+v", u.OIDCSubject)
|
|
}
|
|
|
|
// A second login with the same identity returns the same user (no duplicate).
|
|
again, err := s.LoginOIDC(context.Background(), oidcIdentity("sub-1", "[email protected]", "Alice", true))
|
|
if err != nil {
|
|
t.Fatalf("LoginOIDC repeat: %v", err)
|
|
}
|
|
if again.ID != u.ID {
|
|
t.Errorf("repeat login made a new user: %d vs %d", again.ID, u.ID)
|
|
}
|
|
}
|
|
|
|
func TestLoginOIDCLinksExistingLocalAccount(t *testing.T) {
|
|
s := newTestService(t, openConfig())
|
|
local := mustRegister(t, s, "[email protected]", "Bob", "password123")
|
|
|
|
linked, err := s.LoginOIDC(context.Background(), oidcIdentity("sub-2", "[email protected]", "Bob", true))
|
|
if err != nil {
|
|
t.Fatalf("LoginOIDC link: %v", err)
|
|
}
|
|
if linked.ID != local.ID {
|
|
t.Errorf("linked to a new user %d, want existing %d", linked.ID, local.ID)
|
|
}
|
|
if linked.OIDCSubject == nil || *linked.OIDCSubject != "sub-2" {
|
|
t.Error("existing account was not stamped with the oidc identity")
|
|
}
|
|
// Local password still works after linking (one account, two methods).
|
|
if _, err := s.Login(context.Background(), "[email protected]", "password123"); err != nil {
|
|
t.Errorf("local login after linking failed: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestLoginOIDCRefusesUnverifiedEmailCollision(t *testing.T) {
|
|
s := newTestService(t, openConfig())
|
|
mustRegister(t, s, "[email protected]", "Carol", "password123")
|
|
|
|
_, err := s.LoginOIDC(context.Background(), oidcIdentity("sub-3", "[email protected]", "Carol", false))
|
|
if !errors.Is(err, domain.ErrOIDCEmailUnverified) {
|
|
t.Errorf("unverified collision err = %v, want ErrOIDCEmailUnverified", err)
|
|
}
|
|
}
|
|
|
|
func TestLoginOIDCRequiresEmail(t *testing.T) {
|
|
s := newTestService(t, openConfig())
|
|
_, err := s.LoginOIDC(context.Background(), oidcIdentity("sub-4", "", "No Email", true))
|
|
if !errors.Is(err, domain.ErrOIDCNoEmail) {
|
|
t.Errorf("no-email err = %v, want ErrOIDCNoEmail", err)
|
|
}
|
|
}
|
|
|
|
func TestLoginOIDCFallsBackToEmailLocalPartForName(t *testing.T) {
|
|
s := newTestService(t, openConfig())
|
|
u, err := s.LoginOIDC(context.Background(), oidcIdentity("sub-5", "[email protected]", "", true))
|
|
if err != nil {
|
|
t.Fatalf("LoginOIDC: %v", err)
|
|
}
|
|
if u.DisplayName != "dave" {
|
|
t.Errorf("display name = %q, want %q", u.DisplayName, "dave")
|
|
}
|
|
}
|
|
|
|
func TestLocalAuthDisabledDoesNotBlockOIDC(t *testing.T) {
|
|
cfg := openConfig()
|
|
cfg.LocalAuth = false
|
|
s := newTestService(t, cfg)
|
|
// OIDC provisioning must work even when local auth is off (pure-Authentik).
|
|
if _, err := s.LoginOIDC(context.Background(), oidcIdentity("sub-6", "[email protected]", "Erin", true)); err != nil {
|
|
t.Errorf("LoginOIDC with local auth disabled: %v", err)
|
|
}
|
|
}
|