329 lines
16 KiB
Go
329 lines
16 KiB
Go
package authconfig
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"encoding/json"
|
|
"errors"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/aritmolab/thothii/tools/tht/internal/config"
|
|
"github.com/aritmolab/thothii/tools/tht/internal/safeio"
|
|
)
|
|
|
|
func TestRunConfiguresLocalRegistryAndRedactsStatusJSON(t *testing.T) {
|
|
directory := newAuthDirectory(t)
|
|
passwordFile := writePasswordFile(t, "this is a local test password\n")
|
|
installation := authInstallation(directory)
|
|
|
|
var stdout, stderr bytes.Buffer
|
|
if code := Run(context.Background(), installation, []string{
|
|
"configure", "--mode", "local", "--public-url", "http://127.0.0.1:8080",
|
|
"--admin-user", "admin", "--admin-display-name", "Local administrator", "--password-file", passwordFile,
|
|
}, strings.NewReader(""), &stdout, &stderr); code != 0 {
|
|
t.Fatalf("local configure = %d, stdout=%q stderr=%q", code, stdout.String(), stderr.String())
|
|
}
|
|
if stdout.Len() != 0 || stderr.Len() != 0 {
|
|
t.Fatalf("local configure wrote machine output: stdout=%q stderr=%q", stdout.String(), stderr.String())
|
|
}
|
|
|
|
stdout.Reset()
|
|
if code := Run(context.Background(), installation, []string{"status", "--json"}, strings.NewReader(""), &stdout, &stderr); code != 0 {
|
|
t.Fatalf("status = %d, stderr=%q", code, stderr.String())
|
|
}
|
|
var status struct {
|
|
Mode string `json:"mode"`
|
|
PublicURL string `json:"publicUrl"`
|
|
UserCounts map[string]int `json:"userCounts"`
|
|
Revision string `json:"configRevision"`
|
|
}
|
|
if err := json.Unmarshal(stdout.Bytes(), &status); err != nil {
|
|
t.Fatalf("status stdout is not pristine JSON: %q: %v", stdout.String(), err)
|
|
}
|
|
if status.Mode != "local" || status.PublicURL != "http://127.0.0.1:8080" || status.UserCounts["admin"] != 1 || status.Revision == "" {
|
|
t.Fatalf("status = %#v", status)
|
|
}
|
|
if strings.Contains(stdout.String()+stderr.String(), "this is a local test password") || strings.Contains(stdout.String()+stderr.String(), "$argon2id$") {
|
|
t.Fatalf("status exposed password material: stdout=%q stderr=%q", stdout.String(), stderr.String())
|
|
}
|
|
}
|
|
|
|
func TestRunConfiguresOIDCFixedGroupsAndRefusesIdenticalGroups(t *testing.T) {
|
|
for name, test := range map[string]struct {
|
|
args []string
|
|
wantMode string
|
|
}{
|
|
"configured": {
|
|
args: []string{"configure", "--mode", "oidc", "--public-url", "https://thothii.example.org", "--issuer", "https://authentik.example.org/application/o/thothii/", "--client-id", "thothii", "--authentik-base-url", "https://authentik.example.org", "--user-group", "TOT Users", "--admin-group", "TOT Admin"},
|
|
wantMode: "oidc",
|
|
},
|
|
"ambiguous groups": {
|
|
args: []string{"configure", "--mode", "oidc", "--public-url", "https://thothii.example.org", "--issuer", "https://authentik.example.org/application/o/thothii/", "--client-id", "thothii", "--authentik-base-url", "https://authentik.example.org", "--user-group", "same", "--admin-group", "same"},
|
|
},
|
|
} {
|
|
t.Run(name, func(t *testing.T) {
|
|
directory := newAuthDirectory(t)
|
|
var stdout, stderr bytes.Buffer
|
|
code := Run(context.Background(), authInstallation(directory), test.args, strings.NewReader(""), &stdout, &stderr)
|
|
if test.wantMode == "" {
|
|
if code == 0 || strings.Contains(stdout.String()+stderr.String(), "same") && strings.Contains(stdout.String()+stderr.String(), "secret") {
|
|
t.Fatalf("ambiguous groups accepted or exposed unsafe detail: code=%d stdout=%q stderr=%q", code, stdout.String(), stderr.String())
|
|
}
|
|
return
|
|
}
|
|
if code != 0 {
|
|
t.Fatalf("OIDC configure = %d, stdout=%q stderr=%q", code, stdout.String(), stderr.String())
|
|
}
|
|
config, _, err := Load(directory)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if config.Mode != test.wantMode || config.Authorization.GroupRoles["TOT Users"][0] != RoleUser || config.Authorization.GroupRoles["TOT Admin"][0] != RoleAdmin {
|
|
t.Fatalf("OIDC config = %#v", config)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestRunMutatesLocalUsersAndPreservesLastAdministrator(t *testing.T) {
|
|
directory := newAuthDirectory(t)
|
|
installation := authInstallation(directory)
|
|
adminPassword := writePasswordFile(t, "initial administrator password\n")
|
|
userPassword := writePasswordFile(t, "ordinary user password one\n")
|
|
if code := Run(context.Background(), installation, []string{"configure", "--mode", "local", "--public-url", "http://127.0.0.1:8080", "--admin-user", "admin", "--password-file", adminPassword}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code != 0 {
|
|
t.Fatalf("configure = %d", code)
|
|
}
|
|
for _, args := range [][]string{
|
|
{"user", "add", "operator", "--role", "user", "--display-name", "Operator", "--password-file", userPassword},
|
|
{"user", "set-password", "operator", "--password-file", adminPassword},
|
|
{"user", "grant", "operator", "--role", "admin"},
|
|
{"user", "revoke", "operator", "--role", "admin"},
|
|
{"user", "disable", "operator"},
|
|
{"user", "enable", "operator"},
|
|
} {
|
|
var stdout, stderr bytes.Buffer
|
|
if code := Run(context.Background(), installation, args, strings.NewReader(""), &stdout, &stderr); code != 0 {
|
|
t.Fatalf("%v = %d stdout=%q stderr=%q", args, code, stdout.String(), stderr.String())
|
|
}
|
|
if strings.Contains(stdout.String()+stderr.String(), "initial administrator password") || strings.Contains(stdout.String()+stderr.String(), "$argon2id$") {
|
|
t.Fatalf("%v exposed password material", args)
|
|
}
|
|
}
|
|
var stdout, stderr bytes.Buffer
|
|
if code := Run(context.Background(), installation, []string{"user", "disable", "admin"}, strings.NewReader(""), &stdout, &stderr); code == 0 {
|
|
t.Fatal("last administrator disable succeeded")
|
|
}
|
|
if code := Run(context.Background(), installation, []string{"user", "revoke", "admin", "--role", "admin"}, strings.NewReader(""), &stdout, &stderr); code == 0 {
|
|
t.Fatal("last administrator revoke succeeded")
|
|
}
|
|
}
|
|
|
|
func TestRunLogoutAllIncrementsRevisionAndUserCommandsRefuseOIDC(t *testing.T) {
|
|
directory := newAuthDirectory(t)
|
|
installation := authInstallation(directory)
|
|
passwordFile := writePasswordFile(t, "initial administrator password\n")
|
|
if code := Run(context.Background(), installation, []string{"configure", "--mode", "local", "--public-url", "http://127.0.0.1:8080", "--admin-user", "admin", "--password-file", passwordFile}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code != 0 {
|
|
t.Fatalf("configure = %d", code)
|
|
}
|
|
if code := Run(context.Background(), installation, []string{"user", "logout-all", "admin", "--yes"}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code != 0 {
|
|
t.Fatalf("logout all = %d", code)
|
|
}
|
|
_, registry, err := Load(directory)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if registry.Users[0].AuthRevision != 2 {
|
|
t.Fatalf("logout-all revision = %d, want 2", registry.Users[0].AuthRevision)
|
|
}
|
|
|
|
oidcDirectory := newAuthDirectory(t)
|
|
if code := Run(context.Background(), authInstallation(oidcDirectory), []string{"configure", "--mode", "oidc", "--public-url", "https://thothii.example.org", "--issuer", "https://authentik.example.org/application/o/thothii/", "--client-id", "thothii", "--authentik-base-url", "https://authentik.example.org", "--user-group", "TOT Users", "--admin-group", "TOT Admin"}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code != 0 {
|
|
t.Fatalf("OIDC configure = %d", code)
|
|
}
|
|
if code := Run(context.Background(), authInstallation(oidcDirectory), []string{"user", "list", "--json"}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code == 0 {
|
|
t.Fatal("OIDC user command succeeded")
|
|
}
|
|
}
|
|
|
|
func TestRunRefusesNonTTYPasswordsWithoutPasswordFile(t *testing.T) {
|
|
directory := newAuthDirectory(t)
|
|
var stdout, stderr bytes.Buffer
|
|
code := Run(context.Background(), authInstallation(directory), []string{"configure", "--mode", "local", "--public-url", "http://127.0.0.1:8080", "--admin-user", "admin"}, strings.NewReader("not a password source"), &stdout, &stderr)
|
|
if code == 0 || !strings.Contains(stderr.String(), "--password-file") {
|
|
t.Fatalf("non-TTY password source was accepted: code=%d stdout=%q stderr=%q", code, stdout.String(), stderr.String())
|
|
}
|
|
}
|
|
|
|
func TestRunBumpsRevisionExactlyOnceForEverySecurityMutation(t *testing.T) {
|
|
directory := newAuthDirectory(t)
|
|
installation := authInstallation(directory)
|
|
adminPassword := writePasswordFile(t, "initial administrator password\n")
|
|
userPassword := writePasswordFile(t, "ordinary user password one\n")
|
|
if code := Run(context.Background(), installation, []string{"configure", "--mode", "local", "--public-url", "http://127.0.0.1:8080", "--admin-user", "admin", "--password-file", adminPassword}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code != 0 {
|
|
t.Fatalf("configure = %d", code)
|
|
}
|
|
if code := Run(context.Background(), installation, []string{"user", "add", "operator", "--role", "user", "--password-file", userPassword}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code != 0 {
|
|
t.Fatalf("add = %d", code)
|
|
}
|
|
for _, test := range []struct {
|
|
args []string
|
|
wantRevision uint64
|
|
wantCode int
|
|
}{
|
|
{[]string{"user", "set-password", "operator", "--password-file", adminPassword}, 2, 0},
|
|
{[]string{"user", "disable", "operator"}, 3, 0},
|
|
{[]string{"user", "disable", "operator"}, 3, 0}, // intentional idempotent no-op
|
|
{[]string{"user", "enable", "operator"}, 4, 0},
|
|
{[]string{"user", "enable", "operator"}, 4, 0}, // intentional idempotent no-op
|
|
{[]string{"user", "grant", "operator", "--role", "admin"}, 5, 0},
|
|
{[]string{"user", "grant", "operator", "--role", "admin"}, 5, 2}, // rejected duplicate
|
|
{[]string{"user", "revoke", "operator", "--role", "admin"}, 6, 0},
|
|
{[]string{"user", "revoke", "operator", "--role", "admin"}, 6, 2}, // rejected duplicate
|
|
{[]string{"user", "logout-all", "operator", "--yes"}, 7, 0},
|
|
} {
|
|
code := Run(context.Background(), installation, test.args, strings.NewReader(""), ioDiscard{}, ioDiscard{})
|
|
if code != test.wantCode {
|
|
t.Fatalf("%v = %d, want %d", test.args, code, test.wantCode)
|
|
}
|
|
if got := authRevisionFor(t, directory, "operator"); got != test.wantRevision {
|
|
t.Fatalf("%v revision = %d, want %d", test.args, got, test.wantRevision)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestRunUserListJSONRedactsPasswordHash(t *testing.T) {
|
|
directory := newAuthDirectory(t)
|
|
installation := authInstallation(directory)
|
|
passwordFile := writePasswordFile(t, "this is a local test password\n")
|
|
if code := Run(context.Background(), installation, []string{"configure", "--mode", "local", "--public-url", "http://127.0.0.1:8080", "--admin-user", "admin", "--password-file", passwordFile}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code != 0 {
|
|
t.Fatalf("configure = %d", code)
|
|
}
|
|
var stdout, stderr bytes.Buffer
|
|
if code := Run(context.Background(), installation, []string{"user", "list", "--json"}, strings.NewReader(""), &stdout, &stderr); code != 0 {
|
|
t.Fatalf("list = %d, stderr=%q", code, stderr.String())
|
|
}
|
|
var listed struct {
|
|
Users []User `json:"users"`
|
|
}
|
|
if err := json.Unmarshal(stdout.Bytes(), &listed); err != nil || len(listed.Users) != 1 {
|
|
t.Fatalf("list JSON = %q, err=%v", stdout.String(), err)
|
|
}
|
|
if strings.Contains(stdout.String()+stderr.String(), "this is a local test password") || strings.Contains(stdout.String()+stderr.String(), "$argon2id$") || strings.Contains(stdout.String(), "passwordHash") {
|
|
t.Fatalf("list JSON exposed password material: stdout=%q stderr=%q", stdout.String(), stderr.String())
|
|
}
|
|
}
|
|
|
|
func TestStrictOptionParsersRejectEmptyDuplicateMissingAndWrongModeFlags(t *testing.T) {
|
|
for _, args := range [][]string{
|
|
{"--mode", "local", "--public-url", "http://127.0.0.1:8080", "--admin-display-name", "", "--admin-display-name", "Admin"},
|
|
{"--mode", "local", "--public-url", "http://127.0.0.1:8080", "--issuer", "https://auth.example.org/"},
|
|
{"--mode", "oidc", "--public-url", "https://thothii.example.org", "--issuer", "https://auth.example.org/", "--client-id", "client", "--authentik-base-url", "https://auth.example.org", "--user-group", "users", "--admin-group", "admins", "--password-file", "password-file"},
|
|
{"--mode", "local", "--public-url"},
|
|
} {
|
|
if _, err := parseConfigure(args); err == nil {
|
|
t.Fatalf("parseConfigure(%q) accepted unsafe options", args)
|
|
}
|
|
}
|
|
for _, args := range [][]string{
|
|
{"operator", "--role", "user", "--display-name", "", "--display-name", "Operator"},
|
|
{"operator", "--role", "user", "--password-file", ""},
|
|
{"operator", "--role"},
|
|
} {
|
|
if _, _, err := parseUserRolePassword(args); err == nil {
|
|
t.Fatalf("parseUserRolePassword(%q) accepted unsafe options", args)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestConfigureRecoversSafeOrphanUsersFileAfterInterruptedBootstrap(t *testing.T) {
|
|
directory := writeAuthFiles(t, defaultAuthYAML, registryYAML(adminUserYAML("abandoned", "Abandoned", true, "admin")))
|
|
if err := safeio.RemoveCanonicalPrivateRegular(filepath.Join(directory, authFileName)); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
passwordFile := writePasswordFile(t, "this is a local test password\n")
|
|
if code := Run(context.Background(), authInstallation(directory), []string{"configure", "--mode", "local", "--public-url", "http://127.0.0.1:8080", "--admin-user", "admin", "--password-file", passwordFile}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code != 0 {
|
|
t.Fatalf("recovered configure = %d", code)
|
|
}
|
|
if got := authRevisionFor(t, directory, "admin"); got != 1 {
|
|
t.Fatalf("recovered initial administrator revision = %d, want 1", got)
|
|
}
|
|
}
|
|
|
|
func TestConfigureRollsBackPublishFailureAndRetrySucceeds(t *testing.T) {
|
|
for _, failAt := range []int{1, 2} {
|
|
t.Run("publish failure", func(t *testing.T) {
|
|
directory := newAuthDirectory(t)
|
|
passwordFile := writePasswordFile(t, "this is a local test password\n")
|
|
previous := writeNewAuthFile
|
|
calls := 0
|
|
writeNewAuthFile = func(path string, contents []byte, mode os.FileMode) error {
|
|
calls++
|
|
if calls == failAt {
|
|
return errors.New("injected publish failure")
|
|
}
|
|
return previous(path, contents, mode)
|
|
}
|
|
t.Cleanup(func() { writeNewAuthFile = previous })
|
|
if code := Run(context.Background(), authInstallation(directory), []string{"configure", "--mode", "local", "--public-url", "http://127.0.0.1:8080", "--admin-user", "admin", "--password-file", passwordFile}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code == 0 {
|
|
t.Fatal("configure succeeded despite injected publish failure")
|
|
}
|
|
for _, name := range []string{authFileName, usersFileName} {
|
|
if _, err := os.Lstat(filepath.Join(directory, name)); !errors.Is(err, os.ErrNotExist) {
|
|
t.Fatalf("%s remains after failed bootstrap: %v", name, err)
|
|
}
|
|
}
|
|
writeNewAuthFile = previous
|
|
if code := Run(context.Background(), authInstallation(directory), []string{"configure", "--mode", "local", "--public-url", "http://127.0.0.1:8080", "--admin-user", "admin", "--password-file", passwordFile}, strings.NewReader(""), ioDiscard{}, ioDiscard{}); code != 0 {
|
|
t.Fatalf("retry = %d", code)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func authRevisionFor(t *testing.T, directory, username string) uint64 {
|
|
t.Helper()
|
|
_, registry, err := Load(directory)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
user := registry.FindByUsername(username)
|
|
if user == nil {
|
|
t.Fatalf("missing user %q", username)
|
|
}
|
|
return user.AuthRevision
|
|
}
|
|
|
|
func writePasswordFile(t *testing.T, password string) string {
|
|
t.Helper()
|
|
path := filepath.Join(newAuthDirectory(t), "password")
|
|
if err := os.Mkdir(filepath.Dir(path), 0o700); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := os.WriteFile(path, []byte(password), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return path
|
|
}
|
|
|
|
func authInstallation(directory string) config.Installation {
|
|
installation := config.Installation{}
|
|
installation.Authentication.ConfigDirectory = directory
|
|
return installation
|
|
}
|
|
|
|
func newAuthDirectory(t *testing.T) string {
|
|
t.Helper()
|
|
root, err := filepath.EvalSymlinks(t.TempDir())
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return filepath.Join(root, "auth")
|
|
}
|
|
|
|
type ioDiscard struct{}
|
|
|
|
func (ioDiscard) Write(contents []byte) (int, error) { return len(contents), nil }
|