mirror of
https://github.com/Rain-kl/OpenFlare.git
synced 2026-09-30 14:26:36 +08:00
ryan
1010 lines
31 KiB
Go
1010 lines
31 KiB
Go
/*
|
|
Copyright 2025 linux.do
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package oauth
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"crypto/rand"
|
|
"crypto/rsa"
|
|
"encoding/json"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"net/url"
|
|
"strconv"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/coreos/go-oidc/v3/oidc"
|
|
"github.com/gin-contrib/sessions"
|
|
"github.com/gin-contrib/sessions/cookie"
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/go-jose/go-jose/v4"
|
|
"github.com/google/uuid"
|
|
"github.com/redis/go-redis/v9"
|
|
"golang.org/x/oauth2"
|
|
"gorm.io/driver/sqlite"
|
|
"gorm.io/gorm"
|
|
|
|
"github.com/linux-do/credit/internal/config"
|
|
"github.com/linux-do/credit/internal/db"
|
|
"github.com/linux-do/credit/internal/model"
|
|
"github.com/linux-do/credit/internal/util"
|
|
)
|
|
|
|
// -----------------------------------------------------------------------------
|
|
// Mocks Setup
|
|
// -----------------------------------------------------------------------------
|
|
|
|
type mockRedisClient struct {
|
|
redis.UniversalClient
|
|
store map[string]string
|
|
}
|
|
|
|
func newMockRedisClient() *mockRedisClient {
|
|
return &mockRedisClient{
|
|
store: make(map[string]string),
|
|
}
|
|
}
|
|
|
|
func (m *mockRedisClient) Set(ctx context.Context, key string, value interface{}, expiration time.Duration) *redis.StatusCmd {
|
|
cmd := redis.NewStatusCmd(ctx)
|
|
var val string
|
|
switch v := value.(type) {
|
|
case []byte:
|
|
val = string(v)
|
|
case string:
|
|
val = v
|
|
default:
|
|
val = fmt.Sprintf("%v", v)
|
|
}
|
|
m.store[key] = val
|
|
cmd.SetVal("OK")
|
|
return cmd
|
|
}
|
|
|
|
func (m *mockRedisClient) Get(ctx context.Context, key string) *redis.StringCmd {
|
|
cmd := redis.NewStringCmd(ctx)
|
|
val, ok := m.store[key]
|
|
if !ok {
|
|
cmd.SetErr(redis.Nil)
|
|
} else {
|
|
cmd.SetVal(val)
|
|
}
|
|
return cmd
|
|
}
|
|
|
|
func (m *mockRedisClient) Del(ctx context.Context, keys ...string) *redis.IntCmd {
|
|
cmd := redis.NewIntCmd(ctx)
|
|
var count int64
|
|
for _, key := range keys {
|
|
if _, ok := m.store[key]; ok {
|
|
delete(m.store, key)
|
|
count++
|
|
}
|
|
}
|
|
cmd.SetVal(count)
|
|
return cmd
|
|
}
|
|
|
|
func (m *mockRedisClient) HSet(ctx context.Context, key string, values ...interface{}) *redis.IntCmd {
|
|
cmd := redis.NewIntCmd(ctx)
|
|
if len(values) >= 2 {
|
|
field := fmt.Sprintf("%v", values[0])
|
|
var val string
|
|
switch v := values[1].(type) {
|
|
case []byte:
|
|
val = string(v)
|
|
case string:
|
|
val = v
|
|
default:
|
|
val = fmt.Sprintf("%v", v)
|
|
}
|
|
compositeKey := key + ":" + field
|
|
m.store[compositeKey] = val
|
|
cmd.SetVal(1)
|
|
} else {
|
|
cmd.SetVal(0)
|
|
}
|
|
return cmd
|
|
}
|
|
|
|
func (m *mockRedisClient) HGet(ctx context.Context, key string, field string) *redis.StringCmd {
|
|
cmd := redis.NewStringCmd(ctx)
|
|
compositeKey := key + ":" + field
|
|
val, ok := m.store[compositeKey]
|
|
if !ok {
|
|
cmd.SetErr(redis.Nil)
|
|
} else {
|
|
cmd.SetVal(val)
|
|
}
|
|
return cmd
|
|
}
|
|
|
|
type mockRoundTripper struct {
|
|
roundTripFunc func(req *http.Request) (*http.Response, error)
|
|
}
|
|
|
|
func (m *mockRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
|
|
return m.roundTripFunc(req)
|
|
}
|
|
|
|
// Global cryptographic tools for custom OIDC mocking
|
|
var (
|
|
testRSAPrivateKey *rsa.PrivateKey
|
|
testJWKS jose.JSONWebKeySet
|
|
)
|
|
|
|
const (
|
|
testIssuerURL = "https://connect.linux.do"
|
|
testAuthURL = "https://connect.linux.do/oauth2/authorize"
|
|
testTokenURL = "https://connect.linux.do/oauth2/token"
|
|
testJWKSURL = "https://connect.linux.do/oauth2/keys"
|
|
testClientID = "test_client_id"
|
|
testClientSecret = "test_client_secret"
|
|
testSourceName = "linuxdo"
|
|
testSourceDisplay = "LINUX DO"
|
|
)
|
|
|
|
func init() {
|
|
var err error
|
|
testRSAPrivateKey, err = rsa.GenerateKey(rand.Reader, 2048)
|
|
if err != nil {
|
|
panic(fmt.Sprintf("failed to generate RSA key: %v", err))
|
|
}
|
|
jwk := jose.JSONWebKey{
|
|
Key: &testRSAPrivateKey.PublicKey,
|
|
KeyID: "test-key-id",
|
|
Algorithm: string(jose.RS256),
|
|
Use: "sig",
|
|
}
|
|
testJWKS = jose.JSONWebKeySet{
|
|
Keys: []jose.JSONWebKey{jwk},
|
|
}
|
|
}
|
|
|
|
func seedTestAuthSource(t *testing.T, dbConn *gorm.DB) {
|
|
t.Helper()
|
|
if err := dbConn.Create(&model.AuthSource{
|
|
ID: 100,
|
|
Name: testSourceName,
|
|
Type: model.AuthSourceTypeOIDC,
|
|
DisplayName: testSourceDisplay,
|
|
IsActive: true,
|
|
ClientID: testClientID,
|
|
ClientSecret: testClientSecret,
|
|
OpenIDDiscoveryURL: testIssuerURL,
|
|
}).Error; err != nil {
|
|
t.Fatalf("failed to seed auth source: %v", err)
|
|
}
|
|
}
|
|
|
|
func oidcDiscoveryResponse() *http.Response {
|
|
body := fmt.Sprintf(`{
|
|
"issuer": %q,
|
|
"authorization_endpoint": %q,
|
|
"token_endpoint": %q,
|
|
"jwks_uri": %q,
|
|
"response_types_supported": ["code"],
|
|
"subject_types_supported": ["public"],
|
|
"id_token_signing_alg_values_supported": ["RS256"]
|
|
}`, testIssuerURL, testAuthURL, testTokenURL, testJWKSURL)
|
|
return &http.Response{
|
|
StatusCode: http.StatusOK,
|
|
Body: io.NopCloser(strings.NewReader(body)),
|
|
Header: make(http.Header),
|
|
}
|
|
}
|
|
|
|
func jwksResponse() *http.Response {
|
|
jwksJSON, _ := json.Marshal(testJWKS)
|
|
return &http.Response{
|
|
StatusCode: http.StatusOK,
|
|
Body: io.NopCloser(bytes.NewReader(jwksJSON)),
|
|
Header: make(http.Header),
|
|
}
|
|
}
|
|
|
|
type mockClaims struct {
|
|
ID uint64 `json:"id"`
|
|
Issuer string `json:"iss"`
|
|
Subject string `json:"sub"`
|
|
Audience string `json:"aud"`
|
|
Expiry int64 `json:"exp"`
|
|
IssuedAt int64 `json:"iat"`
|
|
Nonce string `json:"nonce"`
|
|
Username string `json:"preferred_username"`
|
|
Email string `json:"email"`
|
|
Name string `json:"name"`
|
|
Active bool `json:"active"`
|
|
}
|
|
|
|
func generateMockIDToken(issuer, sub, aud, nonce, username, email, name string) string {
|
|
signer, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.RS256, Key: testRSAPrivateKey}, (&jose.SignerOptions{}).WithType("JWT"))
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
id, _ := strconv.ParseUint(sub, 10, 64)
|
|
claims := mockClaims{
|
|
ID: id,
|
|
Issuer: issuer,
|
|
Subject: sub,
|
|
Audience: aud,
|
|
Expiry: time.Now().Add(time.Hour).Unix(),
|
|
IssuedAt: time.Now().Unix(),
|
|
Nonce: nonce,
|
|
Username: username,
|
|
Email: email,
|
|
Name: name,
|
|
Active: true,
|
|
}
|
|
payload, _ := json.Marshal(claims)
|
|
object, err := signer.Sign(payload)
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
tokenStr, _ := object.CompactSerialize()
|
|
return tokenStr
|
|
}
|
|
|
|
// -----------------------------------------------------------------------------
|
|
// Test Helpers
|
|
// -----------------------------------------------------------------------------
|
|
|
|
func setupTestDB(t *testing.T) *gorm.DB {
|
|
dbConn, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
|
|
if err != nil {
|
|
t.Fatalf("failed to open sqlite in memory: %v", err)
|
|
}
|
|
err = dbConn.AutoMigrate(
|
|
&model.User{},
|
|
&model.AuthSource{},
|
|
&model.ExternalAccount{},
|
|
&model.SystemConfig{},
|
|
)
|
|
if err != nil {
|
|
t.Fatalf("failed to migrate schema: %v", err)
|
|
}
|
|
|
|
// 注入测试所需的服务器地址配置
|
|
if err := dbConn.Create(&model.SystemConfig{
|
|
Key: model.ConfigKeyServerAddress,
|
|
Value: "http://localhost:3000",
|
|
}).Error; err != nil {
|
|
t.Fatalf("failed to seed server_address config: %v", err)
|
|
}
|
|
|
|
return dbConn
|
|
}
|
|
|
|
func mockContextMiddleware(mockClient *http.Client) gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
ctx := c.Request.Context()
|
|
ctx = context.WithValue(ctx, oauth2.HTTPClient, mockClient)
|
|
ctx = oidc.ClientContext(ctx, mockClient)
|
|
c.Request = c.Request.WithContext(ctx)
|
|
c.Next()
|
|
}
|
|
}
|
|
|
|
func setupTestRouter(dbConn *gorm.DB, mockRedis *mockRedisClient, mockClient *http.Client) *gin.Engine {
|
|
gin.SetMode(gin.TestMode)
|
|
r := gin.New()
|
|
r.Use(gin.Recovery())
|
|
|
|
// Inject context mock middleware
|
|
r.Use(mockContextMiddleware(mockClient))
|
|
|
|
store := cookie.NewStore([]byte(config.Config.App.SessionSecret))
|
|
store.Options(util.GetSessionOptions(3600))
|
|
r.Use(sessions.Sessions(config.Config.App.SessionCookieName, store))
|
|
|
|
db.SetDB(dbConn)
|
|
db.Redis = mockRedis
|
|
|
|
api := r.Group("/api/v1")
|
|
{
|
|
api.GET("/oauth/sources", GetLoginSources)
|
|
api.GET("/oauth/login", GetLoginURL)
|
|
api.GET("/oauth/:source/authorize", Authorize)
|
|
api.GET("/oauth/logout", Logout)
|
|
api.POST("/oauth/callback", Callback)
|
|
api.GET("/oauth/user-info", LoginRequired(), UserInfo)
|
|
api.GET("/oauth/external-accounts", LoginRequired(), ListExternalAccounts)
|
|
api.POST("/oauth/external-accounts/:id/delete", LoginRequired(), DeleteExternalAccount)
|
|
}
|
|
|
|
return r
|
|
}
|
|
|
|
func performRequest(r http.Handler, method, path string, body []byte, headers map[string]string, cookies []*http.Cookie) *httptest.ResponseRecorder {
|
|
var bodyReader io.Reader
|
|
if body != nil {
|
|
bodyReader = bytes.NewReader(body)
|
|
}
|
|
req, _ := http.NewRequest(method, path, bodyReader)
|
|
for k, v := range headers {
|
|
req.Header.Set(k, v)
|
|
}
|
|
for _, cookie := range cookies {
|
|
if cookie != nil {
|
|
req.AddCookie(cookie)
|
|
}
|
|
}
|
|
w := httptest.NewRecorder()
|
|
r.ServeHTTP(w, req)
|
|
return w
|
|
}
|
|
|
|
func initializeTestConfig() {
|
|
config.Config.App.Env = "testing"
|
|
config.Config.App.SessionCookieName = "test_session_id"
|
|
config.Config.App.SessionSecret = "test_session_secret"
|
|
config.Config.App.APIPrefix = "/api"
|
|
}
|
|
|
|
// -----------------------------------------------------------------------------
|
|
// Tests
|
|
// -----------------------------------------------------------------------------
|
|
|
|
func TestGetLoginSources(t *testing.T) {
|
|
initializeTestConfig()
|
|
dbConn := setupTestDB(t)
|
|
mockRedis := newMockRedisClient()
|
|
|
|
// Setup empty HTTP Mock
|
|
httpMock := &http.Client{
|
|
Transport: &mockRoundTripper{
|
|
roundTripFunc: func(req *http.Request) (*http.Response, error) {
|
|
return nil, fmt.Errorf("unexpected request")
|
|
},
|
|
},
|
|
}
|
|
util.SetHTTPClient(httpMock)
|
|
router := setupTestRouter(dbConn, mockRedis, httpMock)
|
|
|
|
// Inject OIDC login enabled config
|
|
dbConn.Create(&model.SystemConfig{
|
|
Key: model.ConfigKeyOIDCLoginEnabled,
|
|
Value: "true",
|
|
})
|
|
|
|
// Inject active DB auth source
|
|
dbConn.Create(&model.AuthSource{
|
|
ID: 101,
|
|
Name: "github",
|
|
Type: model.AuthSourceTypeOIDC,
|
|
DisplayName: "GitHub OAuth",
|
|
IsActive: true,
|
|
ClientID: "gh_client",
|
|
ClientSecret: "gh_secret",
|
|
OpenIDDiscoveryURL: "https://github.com",
|
|
})
|
|
|
|
// Perform GET request
|
|
w := performRequest(router, http.MethodGet, "/api/v1/oauth/sources", nil, nil, nil)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("expected status 200, got %d", w.Code)
|
|
}
|
|
|
|
var resp struct {
|
|
Data []AuthSourceView `json:"data"`
|
|
}
|
|
err := json.Unmarshal(w.Body.Bytes(), &resp)
|
|
if err != nil {
|
|
t.Fatalf("failed to unmarshal response: %v", err)
|
|
}
|
|
|
|
if len(resp.Data) != 1 {
|
|
t.Fatalf("expected 1 active source, got %d", len(resp.Data))
|
|
}
|
|
|
|
if resp.Data[0].Name != "github" {
|
|
t.Errorf("expected github source, got %s", resp.Data[0].Name)
|
|
}
|
|
|
|
// Test disabling OIDC
|
|
dbConn.Model(&model.SystemConfig{}).Where("key = ?", model.ConfigKeyOIDCLoginEnabled).Update("value", "false")
|
|
mockRedis.store = make(map[string]string)
|
|
|
|
w2 := performRequest(router, http.MethodGet, "/api/v1/oauth/sources", nil, nil, nil)
|
|
var resp2 struct {
|
|
Data []AuthSourceView `json:"data"`
|
|
}
|
|
_ = json.Unmarshal(w2.Body.Bytes(), &resp2)
|
|
if len(resp2.Data) != 0 {
|
|
t.Errorf("expected 0 sources when OIDC is disabled, got %d", len(resp2.Data))
|
|
}
|
|
}
|
|
|
|
func TestGetLoginURL(t *testing.T) {
|
|
initializeTestConfig()
|
|
dbConn := setupTestDB(t)
|
|
mockRedis := newMockRedisClient()
|
|
seedTestAuthSource(t, dbConn)
|
|
|
|
httpMock := &http.Client{
|
|
Transport: &mockRoundTripper{
|
|
roundTripFunc: func(req *http.Request) (*http.Response, error) {
|
|
if req.Method == http.MethodGet && strings.Contains(req.URL.String(), "/.well-known/openid-configuration") {
|
|
return oidcDiscoveryResponse(), nil
|
|
}
|
|
return nil, fmt.Errorf("unexpected request")
|
|
},
|
|
},
|
|
}
|
|
util.SetHTTPClient(httpMock)
|
|
router := setupTestRouter(dbConn, mockRedis, httpMock)
|
|
|
|
// Case 1: Default Login URL
|
|
w := performRequest(router, http.MethodGet, "/api/v1/oauth/login", nil, nil, nil)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("expected 200, got %d", w.Code)
|
|
}
|
|
|
|
var resp struct {
|
|
Data OAuthAuthorizeResponse `json:"data"`
|
|
}
|
|
err := json.Unmarshal(w.Body.Bytes(), &resp)
|
|
if err != nil {
|
|
t.Fatalf("failed to unmarshal response: %v", err)
|
|
}
|
|
|
|
if !strings.Contains(resp.Data.AuthorizeURL, testAuthURL) {
|
|
t.Errorf("invalid authorize URL: %s", resp.Data.AuthorizeURL)
|
|
}
|
|
|
|
parsedURL, _ := url.Parse(resp.Data.AuthorizeURL)
|
|
state := parsedURL.Query().Get("state")
|
|
if state == "" {
|
|
t.Error("missing state in URL")
|
|
}
|
|
|
|
redisKey := db.PrefixedKey(fmt.Sprintf(OAuthStateCacheKeyFormat, state))
|
|
stateVal, err := mockRedis.Get(context.Background(), redisKey).Result()
|
|
if err != nil {
|
|
t.Fatalf("state not found in redis: %v", err)
|
|
}
|
|
|
|
payload, err := decodeOAuthStatePayload(stateVal)
|
|
if err != nil {
|
|
t.Fatalf("failed to decode state payload: %v", err)
|
|
}
|
|
if payload.SourceName != testSourceName || payload.Purpose != OAuthPurposeLogin {
|
|
t.Errorf("unexpected payload: %+v", payload)
|
|
}
|
|
|
|
// Case 2: Unknown Source Login URL
|
|
w2 := performRequest(router, http.MethodGet, "/api/v1/oauth/login?source=nonexistent", nil, nil, nil)
|
|
if w2.Code != http.StatusBadRequest {
|
|
t.Errorf("expected 400 for unknown source, got %d", w2.Code)
|
|
}
|
|
}
|
|
|
|
func TestAuthorize(t *testing.T) {
|
|
initializeTestConfig()
|
|
dbConn := setupTestDB(t)
|
|
mockRedis := newMockRedisClient()
|
|
|
|
// Setup GitHub active source
|
|
dbConn.Create(&model.AuthSource{
|
|
ID: 101,
|
|
Name: "github",
|
|
Type: model.AuthSourceTypeOIDC,
|
|
DisplayName: "GitHub OAuth",
|
|
IsActive: true,
|
|
ClientID: "gh_client",
|
|
ClientSecret: "gh_secret",
|
|
OpenIDDiscoveryURL: "https://github.com",
|
|
})
|
|
|
|
// Mock OIDC Discovery request
|
|
httpMock := &http.Client{
|
|
Transport: &mockRoundTripper{
|
|
roundTripFunc: func(req *http.Request) (*http.Response, error) {
|
|
if req.Method == http.MethodGet && strings.Contains(req.URL.String(), "/.well-known/openid-configuration") {
|
|
body := `{
|
|
"issuer": "https://github.com",
|
|
"authorization_endpoint": "https://github.com/login/oauth/authorize",
|
|
"token_endpoint": "https://github.com/login/oauth/access_token",
|
|
"jwks_uri": "https://github.com/oauth/keys",
|
|
"response_types_supported": ["code"],
|
|
"subject_types_supported": ["public"],
|
|
"id_token_signing_alg_values_supported": ["RS256"]
|
|
}`
|
|
return &http.Response{
|
|
StatusCode: http.StatusOK,
|
|
Body: io.NopCloser(strings.NewReader(body)),
|
|
Header: make(http.Header),
|
|
}, nil
|
|
}
|
|
return nil, fmt.Errorf("unexpected request: %s", req.URL)
|
|
},
|
|
},
|
|
}
|
|
util.SetHTTPClient(httpMock)
|
|
router := setupTestRouter(dbConn, mockRedis, httpMock)
|
|
|
|
// Case 1: Active Source Authorize with purpose=bind
|
|
w := performRequest(router, http.MethodGet, "/api/v1/oauth/github/authorize?purpose=bind", nil, nil, nil)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("expected 200, got %d, body: %s", w.Code, w.Body.String())
|
|
}
|
|
|
|
var resp struct {
|
|
Data OAuthAuthorizeResponse `json:"data"`
|
|
}
|
|
_ = json.Unmarshal(w.Body.Bytes(), &resp)
|
|
|
|
parsedURL, _ := url.Parse(resp.Data.AuthorizeURL)
|
|
state := parsedURL.Query().Get("state")
|
|
redisKey := db.PrefixedKey(fmt.Sprintf(OAuthStateCacheKeyFormat, state))
|
|
stateVal, _ := mockRedis.Get(context.Background(), redisKey).Result()
|
|
payload, _ := decodeOAuthStatePayload(stateVal)
|
|
|
|
if payload.SourceName != "github" || payload.Purpose != OAuthPurposeBind {
|
|
t.Errorf("expected source github with purpose bind, got %+v", payload)
|
|
}
|
|
|
|
// Case 2: Inactive Source Authorize
|
|
dbConn.Model(&model.AuthSource{}).Where("id = ?", 101).Update("is_active", false)
|
|
w2 := performRequest(router, http.MethodGet, "/api/v1/oauth/github/authorize", nil, nil, nil)
|
|
if w2.Code != http.StatusBadRequest {
|
|
t.Errorf("expected 400 for inactive source, got %d", w2.Code)
|
|
}
|
|
}
|
|
|
|
func TestLogout(t *testing.T) {
|
|
initializeTestConfig()
|
|
dbConn := setupTestDB(t)
|
|
mockRedis := newMockRedisClient()
|
|
httpMock := &http.Client{}
|
|
router := setupTestRouter(dbConn, mockRedis, httpMock)
|
|
|
|
w := performRequest(router, http.MethodGet, "/api/v1/oauth/logout", nil, nil, nil)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("expected 200, got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestCallbackLoginAndUserInfo(t *testing.T) {
|
|
initializeTestConfig()
|
|
dbConn := setupTestDB(t)
|
|
mockRedis := newMockRedisClient()
|
|
seedTestAuthSource(t, dbConn)
|
|
state := uuid.NewString()
|
|
|
|
// 1. Mock the outgoing HTTP client for token exchange and user info fetching
|
|
httpMock := &http.Client{
|
|
Transport: &mockRoundTripper{
|
|
roundTripFunc: func(req *http.Request) (*http.Response, error) {
|
|
if req.Method == http.MethodGet && strings.Contains(req.URL.String(), "/.well-known/openid-configuration") {
|
|
return oidcDiscoveryResponse(), nil
|
|
}
|
|
if req.Method == http.MethodGet && req.URL.String() == testJWKSURL {
|
|
return jwksResponse(), nil
|
|
}
|
|
// Handle Token Exchange
|
|
if req.Method == http.MethodPost && req.URL.String() == testTokenURL {
|
|
idToken := generateMockIDToken(testIssuerURL, "88888", testClientID, state, "test_oauth_user", "oauth@linux.do", "Oauth Test User")
|
|
body := fmt.Sprintf(`{"access_token":"mock_access_token","token_type":"Bearer","expires_in":3600,"id_token":"%s"}`, idToken)
|
|
return &http.Response{
|
|
StatusCode: http.StatusOK,
|
|
Body: io.NopCloser(strings.NewReader(body)),
|
|
Header: make(http.Header),
|
|
}, nil
|
|
}
|
|
return nil, fmt.Errorf("unexpected outgoing request: %s %s", req.Method, req.URL)
|
|
},
|
|
},
|
|
}
|
|
util.SetHTTPClient(httpMock)
|
|
router := setupTestRouter(dbConn, mockRedis, httpMock)
|
|
|
|
// 2. Setup state in Redis
|
|
payloadValue, _ := encodeOAuthStatePayload(oauthStatePayload{
|
|
SourceName: testSourceName,
|
|
Purpose: OAuthPurposeLogin,
|
|
})
|
|
mockRedis.Set(context.Background(), db.PrefixedKey(fmt.Sprintf(OAuthStateCacheKeyFormat, state)), payloadValue, OAuthStateCacheKeyExpiration)
|
|
|
|
// 3. Trigger Callback (Login flow - new user)
|
|
reqBody := fmt.Sprintf(`{"state":"%s","code":"test_auth_code"}`, state)
|
|
w := performRequest(router, http.MethodPost, "/api/v1/oauth/callback", []byte(reqBody), map[string]string{
|
|
"Content-Type": "application/json",
|
|
}, nil)
|
|
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("callback failed with status %d, body: %s", w.Code, w.Body.String())
|
|
}
|
|
|
|
var callbackResp struct {
|
|
Data OAuthCallbackResult `json:"data"`
|
|
}
|
|
_ = json.Unmarshal(w.Body.Bytes(), &callbackResp)
|
|
|
|
if callbackResp.Data.Status != "logged_in" {
|
|
t.Errorf("expected logged_in status, got %s", callbackResp.Data.Status)
|
|
}
|
|
|
|
if callbackResp.Data.User.Username != "test_oauth_user" || callbackResp.Data.User.ID != 88888 {
|
|
t.Errorf("unexpected user returned: %+v", callbackResp.Data.User)
|
|
}
|
|
|
|
// Verify user is created in database
|
|
var user model.User
|
|
if err := dbConn.First(&user, "id = ?", 88888).Error; err != nil {
|
|
t.Fatalf("user was not created in DB: %v", err)
|
|
}
|
|
|
|
// Extract session cookie
|
|
cookies := w.Result().Cookies()
|
|
var sessionCookie *http.Cookie
|
|
for _, cookie := range cookies {
|
|
if cookie.Name == config.Config.App.SessionCookieName {
|
|
sessionCookie = cookie
|
|
break
|
|
}
|
|
}
|
|
if sessionCookie == nil {
|
|
t.Fatal("session cookie not found in response")
|
|
}
|
|
|
|
// 4. Test GET user-info
|
|
w2 := performRequest(router, http.MethodGet, "/api/v1/oauth/user-info", nil, nil, []*http.Cookie{sessionCookie})
|
|
if w2.Code != http.StatusOK {
|
|
t.Fatalf("failed to fetch user info, status %d", w2.Code)
|
|
}
|
|
|
|
// 5. Test Callback (Login flow - existing user, username collision check)
|
|
state2 := uuid.NewString()
|
|
mockRedis.Set(context.Background(), db.PrefixedKey(fmt.Sprintf(OAuthStateCacheKeyFormat, state2)), payloadValue, OAuthStateCacheKeyExpiration)
|
|
|
|
// Callback with same username but different external ID (99999)
|
|
httpMock2 := &http.Client{
|
|
Transport: &mockRoundTripper{
|
|
roundTripFunc: func(req *http.Request) (*http.Response, error) {
|
|
if req.Method == http.MethodGet && strings.Contains(req.URL.String(), "/.well-known/openid-configuration") {
|
|
return oidcDiscoveryResponse(), nil
|
|
}
|
|
if req.Method == http.MethodGet && req.URL.String() == testJWKSURL {
|
|
return jwksResponse(), nil
|
|
}
|
|
if req.Method == http.MethodPost && req.URL.String() == testTokenURL {
|
|
idToken := generateMockIDToken(testIssuerURL, "99999", testClientID, state2, "test_oauth_user", "another@linux.do", "Another User")
|
|
body := fmt.Sprintf(`{"access_token":"mock_access_token","token_type":"Bearer","expires_in":3600,"id_token":"%s"}`, idToken)
|
|
return &http.Response{
|
|
StatusCode: http.StatusOK,
|
|
Body: io.NopCloser(strings.NewReader(body)),
|
|
}, nil
|
|
}
|
|
return nil, fmt.Errorf("unexpected outgoing request")
|
|
},
|
|
},
|
|
}
|
|
util.SetHTTPClient(httpMock2)
|
|
|
|
// Create another router for this mock client
|
|
router2 := setupTestRouter(dbConn, mockRedis, httpMock2)
|
|
|
|
reqBody2 := fmt.Sprintf(`{"state":"%s","code":"test_auth_code"}`, state2)
|
|
w3 := performRequest(router2, http.MethodPost, "/api/v1/oauth/callback", []byte(reqBody2), map[string]string{
|
|
"Content-Type": "application/json",
|
|
}, nil)
|
|
|
|
if w3.Code != http.StatusOK {
|
|
t.Fatalf("callback for collision failed: %d, body: %s", w3.Code, w3.Body.String())
|
|
}
|
|
|
|
var collisionResp struct {
|
|
Data OAuthCallbackResult `json:"data"`
|
|
}
|
|
_ = json.Unmarshal(w3.Body.Bytes(), &collisionResp)
|
|
|
|
if collisionResp.Data.User.Username != "test_oauth_user-1" {
|
|
t.Errorf("expected collision renamed username, got %s", collisionResp.Data.User.Username)
|
|
}
|
|
}
|
|
|
|
func TestCallbackBind(t *testing.T) {
|
|
initializeTestConfig()
|
|
dbConn := setupTestDB(t)
|
|
mockRedis := newMockRedisClient()
|
|
|
|
// Create user
|
|
user := model.User{
|
|
ID: 777,
|
|
Username: "existing_member",
|
|
Nickname: "Existing Member",
|
|
IsActive: true,
|
|
LastLoginAt: time.Now(),
|
|
}
|
|
dbConn.Create(&user)
|
|
|
|
// Create auth source "github"
|
|
dbConn.Create(&model.AuthSource{
|
|
ID: 2,
|
|
Name: "github",
|
|
Type: model.AuthSourceTypeOIDC,
|
|
DisplayName: "GitHub",
|
|
IsActive: true,
|
|
ClientID: "gh_client",
|
|
ClientSecret: "gh_secret",
|
|
OpenIDDiscoveryURL: "https://github.com",
|
|
})
|
|
|
|
// Inject state in Redis with purpose=bind
|
|
state := uuid.NewString()
|
|
payloadValue, _ := encodeOAuthStatePayload(oauthStatePayload{
|
|
SourceName: "github",
|
|
Purpose: OAuthPurposeBind,
|
|
})
|
|
mockRedis.Set(context.Background(), db.PrefixedKey(fmt.Sprintf(OAuthStateCacheKeyFormat, state)), payloadValue, OAuthStateCacheKeyExpiration)
|
|
|
|
// Mock OIDC discovery, JWKS, and Token exchange for custom source (GitHub)
|
|
httpMock := &http.Client{
|
|
Transport: &mockRoundTripper{
|
|
roundTripFunc: func(req *http.Request) (*http.Response, error) {
|
|
// Handle OIDC Discovery Document
|
|
if req.Method == http.MethodGet && strings.Contains(req.URL.String(), "/.well-known/openid-configuration") {
|
|
body := `{
|
|
"issuer": "https://github.com",
|
|
"authorization_endpoint": "https://github.com/login/oauth/authorize",
|
|
"token_endpoint": "https://github.com/login/oauth/access_token",
|
|
"jwks_uri": "https://github.com/oauth/keys",
|
|
"response_types_supported": ["code"],
|
|
"subject_types_supported": ["public"],
|
|
"id_token_signing_alg_values_supported": ["RS256"]
|
|
}`
|
|
return &http.Response{
|
|
StatusCode: http.StatusOK,
|
|
Body: io.NopCloser(strings.NewReader(body)),
|
|
}, nil
|
|
}
|
|
// Handle JWKS Key Set Fetch
|
|
if req.Method == http.MethodGet && strings.Contains(req.URL.String(), "/oauth/keys") {
|
|
jwksJSON, _ := json.Marshal(testJWKS)
|
|
return &http.Response{
|
|
StatusCode: http.StatusOK,
|
|
Body: io.NopCloser(bytes.NewReader(jwksJSON)),
|
|
}, nil
|
|
}
|
|
// Handle Token Exchange
|
|
if req.Method == http.MethodPost && strings.Contains(req.URL.String(), "/login/oauth/access_token") {
|
|
// Generate signed RS256 token matching issuer and aud
|
|
idToken := generateMockIDToken("https://github.com", "github_user_123", "gh_client", state, "github_tester", "tester@github.com", "GitHub Tester")
|
|
body := fmt.Sprintf(`{"access_token":"mock_access_token","token_type":"Bearer","id_token":"%s"}`, idToken)
|
|
return &http.Response{
|
|
StatusCode: http.StatusOK,
|
|
Body: io.NopCloser(strings.NewReader(body)),
|
|
}, nil
|
|
}
|
|
return nil, fmt.Errorf("unexpected request: %s", req.URL)
|
|
},
|
|
},
|
|
}
|
|
util.SetHTTPClient(httpMock)
|
|
router := setupTestRouter(dbConn, mockRedis, httpMock)
|
|
|
|
// Case 1: Bind attempt without session -> 401
|
|
reqBody := fmt.Sprintf(`{"state":"%s","code":"test_code"}`, state)
|
|
w1 := performRequest(router, http.MethodPost, "/api/v1/oauth/callback", []byte(reqBody), map[string]string{
|
|
"Content-Type": "application/json",
|
|
}, nil)
|
|
|
|
if w1.Code != http.StatusUnauthorized {
|
|
t.Errorf("expected 401 for unauthenticated bind, got %d, body: %s", w1.Code, w1.Body.String())
|
|
}
|
|
|
|
// Case 2: Bind success (authenticated)
|
|
router.GET("/test-helper/login-777", func(c *gin.Context) {
|
|
session := sessions.Default(c)
|
|
session.Set(UserIDKey, uint64(777))
|
|
session.Save()
|
|
c.String(200, "ok")
|
|
})
|
|
|
|
wLogin := performRequest(router, http.MethodGet, "/test-helper/login-777", nil, nil, nil)
|
|
var activeCookie *http.Cookie
|
|
for _, cookie := range wLogin.Result().Cookies() {
|
|
if cookie.Name == config.Config.App.SessionCookieName {
|
|
activeCookie = cookie
|
|
break
|
|
}
|
|
}
|
|
|
|
// Restore state key in redis
|
|
mockRedis.Set(context.Background(), db.PrefixedKey(fmt.Sprintf(OAuthStateCacheKeyFormat, state)), payloadValue, OAuthStateCacheKeyExpiration)
|
|
|
|
w2 := performRequest(router, http.MethodPost, "/api/v1/oauth/callback", []byte(reqBody), map[string]string{
|
|
"Content-Type": "application/json",
|
|
}, []*http.Cookie{activeCookie})
|
|
|
|
if w2.Code != http.StatusOK {
|
|
t.Fatalf("expected 200 for bind callback, got %d, body: %s", w2.Code, w2.Body.String())
|
|
}
|
|
|
|
var bindResult struct {
|
|
Data OAuthCallbackResult `json:"data"`
|
|
}
|
|
_ = json.Unmarshal(w2.Body.Bytes(), &bindResult)
|
|
if bindResult.Data.Status != "bound" {
|
|
t.Errorf("expected status bound, got %s", bindResult.Data.Status)
|
|
}
|
|
|
|
// Verify DB binding
|
|
var binding model.ExternalAccount
|
|
if err := dbConn.First(&binding, "user_id = ? AND external_id = ?", 777, "github_user_123").Error; err != nil {
|
|
t.Fatalf("DB binding record not found: %v", err)
|
|
}
|
|
|
|
// Case 3: Bind already bound account to another user
|
|
// Create another user
|
|
user2 := model.User{
|
|
ID: 888,
|
|
Username: "another_member",
|
|
Nickname: "Another Member",
|
|
IsActive: true,
|
|
LastLoginAt: time.Now(),
|
|
}
|
|
dbConn.Create(&user2)
|
|
|
|
router.GET("/test-helper/login-888", func(c *gin.Context) {
|
|
session := sessions.Default(c)
|
|
session.Set(UserIDKey, uint64(888))
|
|
session.Save()
|
|
c.String(200, "ok")
|
|
})
|
|
|
|
wLogin2 := performRequest(router, http.MethodGet, "/test-helper/login-888", nil, nil, nil)
|
|
var activeCookie2 *http.Cookie
|
|
for _, cookie := range wLogin2.Result().Cookies() {
|
|
if cookie.Name == config.Config.App.SessionCookieName {
|
|
activeCookie2 = cookie
|
|
break
|
|
}
|
|
}
|
|
|
|
state3 := uuid.NewString()
|
|
mockRedis.Set(context.Background(), db.PrefixedKey(fmt.Sprintf(OAuthStateCacheKeyFormat, state3)), payloadValue, OAuthStateCacheKeyExpiration)
|
|
|
|
// Re-sign token for new state (since state serves as OIDC Nonce)
|
|
httpMock3 := &http.Client{
|
|
Transport: &mockRoundTripper{
|
|
roundTripFunc: func(req *http.Request) (*http.Response, error) {
|
|
if req.Method == http.MethodGet && strings.Contains(req.URL.String(), "/.well-known/openid-configuration") {
|
|
body := `{
|
|
"issuer": "https://github.com",
|
|
"authorization_endpoint": "https://github.com/login/oauth/authorize",
|
|
"token_endpoint": "https://github.com/login/oauth/access_token",
|
|
"jwks_uri": "https://github.com/oauth/keys",
|
|
"response_types_supported": ["code"],
|
|
"subject_types_supported": ["public"],
|
|
"id_token_signing_alg_values_supported": ["RS256"]
|
|
}`
|
|
return &http.Response{
|
|
StatusCode: http.StatusOK,
|
|
Body: io.NopCloser(strings.NewReader(body)),
|
|
}, nil
|
|
}
|
|
if req.Method == http.MethodGet && strings.Contains(req.URL.String(), "/oauth/keys") {
|
|
jwksJSON, _ := json.Marshal(testJWKS)
|
|
return &http.Response{
|
|
StatusCode: http.StatusOK,
|
|
Body: io.NopCloser(bytes.NewReader(jwksJSON)),
|
|
}, nil
|
|
}
|
|
if req.Method == http.MethodPost && strings.Contains(req.URL.String(), "/login/oauth/access_token") {
|
|
idToken := generateMockIDToken("https://github.com", "github_user_123", "gh_client", state3, "github_tester", "tester@github.com", "GitHub Tester")
|
|
body := fmt.Sprintf(`{"access_token":"mock_access_token","token_type":"Bearer","id_token":"%s"}`, idToken)
|
|
return &http.Response{
|
|
StatusCode: http.StatusOK,
|
|
Body: io.NopCloser(strings.NewReader(body)),
|
|
}, nil
|
|
}
|
|
return nil, fmt.Errorf("unexpected request")
|
|
},
|
|
},
|
|
}
|
|
util.SetHTTPClient(httpMock3)
|
|
router3 := setupTestRouter(dbConn, mockRedis, httpMock3)
|
|
|
|
reqBody3 := fmt.Sprintf(`{"state":"%s","code":"test_code"}`, state3)
|
|
w3 := performRequest(router3, http.MethodPost, "/api/v1/oauth/callback", []byte(reqBody3), map[string]string{
|
|
"Content-Type": "application/json",
|
|
}, []*http.Cookie{activeCookie2})
|
|
|
|
if w3.Code != http.StatusBadRequest {
|
|
t.Errorf("expected 400 for already bound account, got %d, body: %s", w3.Code, w3.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestExternalAccountsListAndDelete(t *testing.T) {
|
|
initializeTestConfig()
|
|
dbConn := setupTestDB(t)
|
|
mockRedis := newMockRedisClient()
|
|
httpMock := &http.Client{}
|
|
router := setupTestRouter(dbConn, mockRedis, httpMock)
|
|
|
|
// Create user and external accounts
|
|
dbConn.Create(&model.User{
|
|
ID: 555,
|
|
Username: "account_holder",
|
|
IsActive: true,
|
|
})
|
|
|
|
dbConn.Create(&model.AuthSource{
|
|
ID: 10,
|
|
Name: "gitlab",
|
|
Type: model.AuthSourceTypeOIDC,
|
|
IsActive: true,
|
|
})
|
|
|
|
dbConn.Create(&model.ExternalAccount{
|
|
ID: 2001,
|
|
AuthSourceID: 10,
|
|
UserID: 555,
|
|
ExternalID: "gitlab_123",
|
|
ExternalUsername: "gitlab_user",
|
|
})
|
|
|
|
router.GET("/test-helper/login-555", func(c *gin.Context) {
|
|
session := sessions.Default(c)
|
|
session.Set(UserIDKey, uint64(555))
|
|
session.Save()
|
|
c.String(200, "ok")
|
|
})
|
|
|
|
wLogin := performRequest(router, http.MethodGet, "/test-helper/login-555", nil, nil, nil)
|
|
var activeCookie *http.Cookie
|
|
for _, cookie := range wLogin.Result().Cookies() {
|
|
if cookie.Name == config.Config.App.SessionCookieName {
|
|
activeCookie = cookie
|
|
break
|
|
}
|
|
}
|
|
|
|
// 1. List accounts
|
|
wList := performRequest(router, http.MethodGet, "/api/v1/oauth/external-accounts", nil, nil, []*http.Cookie{activeCookie})
|
|
if wList.Code != http.StatusOK {
|
|
t.Fatalf("failed to list external accounts: %d", wList.Code)
|
|
}
|
|
|
|
var listResp struct {
|
|
Data []model.ExternalAccountView `json:"data"`
|
|
}
|
|
_ = json.Unmarshal(wList.Body.Bytes(), &listResp)
|
|
if len(listResp.Data) != 1 || listResp.Data[0].ExternalUsername != "gitlab_user" {
|
|
t.Errorf("unexpected list response: %+v", listResp.Data)
|
|
}
|
|
|
|
// 2. Delete/Unbind account
|
|
wDelete := performRequest(router, http.MethodPost, "/api/v1/oauth/external-accounts/2001/delete", nil, nil, []*http.Cookie{activeCookie})
|
|
if wDelete.Code != http.StatusOK {
|
|
t.Fatalf("failed to delete external account binding: %d, body: %s", wDelete.Code, wDelete.Body.String())
|
|
}
|
|
|
|
var count int64
|
|
dbConn.Model(&model.ExternalAccount{}).Where("id = ?", 2001).Count(&count)
|
|
if count != 0 {
|
|
t.Error("binding record was not deleted from DB")
|
|
}
|
|
}
|