Carlos Alcaide Corvo
b64f1876dc
* Add await for all authenticateSession within /tests/acceptance * Add await for all authenticateSession within /tests/unit
488 lines
17 KiB
JavaScript
488 lines
17 KiB
JavaScript
/**
|
|
* Copyright (c) HashiCorp, Inc.
|
|
* SPDX-License-Identifier: BUSL-1.1
|
|
*/
|
|
|
|
import { module, test } from 'qunit';
|
|
import { visit, currentURL, click, fillIn, select } from '@ember/test-helpers';
|
|
import { setupApplicationTest } from 'admin/tests/helpers';
|
|
import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
|
|
import { setupIndexedDb } from 'api/test-support/helpers/indexed-db';
|
|
import { Response } from 'miragejs';
|
|
import { authenticateSession } from 'ember-simple-auth/test-support';
|
|
|
|
module('Acceptance | auth-methods | create', function (hooks) {
|
|
setupApplicationTest(hooks);
|
|
setupMirage(hooks);
|
|
setupIndexedDb(hooks);
|
|
|
|
const DROPDOWN_SELECTOR_ICON =
|
|
'tbody .hds-table__tr:nth-child(1) .hds-table__td:last-child .hds-dropdown-toggle-icon';
|
|
const DROPDOWN_SELECTOR_OPTION =
|
|
'.hds-dropdown__content .hds-dropdown-list-item [type=button]';
|
|
const NEW_DROPDOWN_SELECTOR =
|
|
'[data-test-new-dropdown] .hds-dropdown-toggle-button';
|
|
const SAVE_BTN_SELECTOR = '.rose-form-actions [type="submit"]';
|
|
const CANCEL_BTN_SELECTOR = '.rose-form-actions [type="button"]';
|
|
const NAME_INPUT_SELECTOR = '[name="name"]';
|
|
const URLS_INPUT_SELECTOR = '[name="urls"]';
|
|
const DESC_INPUT_SELECTOR = '[name="description"]';
|
|
const ERROR_MSG_SELECTOR =
|
|
'[data-test-toast-notification] .hds-alert__description';
|
|
const FIELD_ERROR_TEXT_SELECTOR = '.hds-form-error__message';
|
|
|
|
const CERTIFICATES_BTN_SELECTOR = '[name="certificates"] button';
|
|
const CERTIFICATES_INPUT_SELECTOR = '[name="certificates"] textarea';
|
|
const IDP_CERTS_INPUT_SELECTOR = '[name="idp_ca_certs"] textarea';
|
|
const IDP_CERTS_BTN_SELECTOR = '[name="idp_ca_certs"] button';
|
|
|
|
const ALLOWED_AUDIENCES_BTN_SELECTOR = '[name="allowed_audiences"] button';
|
|
const ALLOWED_AUDIENCES_INPUT_SELECTOR = '[name="allowed_audiences"] input';
|
|
|
|
const CLAIMS_SCOPES_BTN_SELECTOR = '[name="claims_scopes"] button';
|
|
const CLAIMS_SCOPES_INPUT_SELECTOR = '[name="claims_scopes"] input';
|
|
const TOGGLE_SELECTOR = '[name="prompts"]';
|
|
|
|
const MANAGE_DROPDOWN_SELECTOR =
|
|
'[data-test-manage-auth-method] button:first-child';
|
|
const MAKE_PRIMARY_SELECTOR =
|
|
'[data-test-manage-auth-method] ul li:first-child button';
|
|
|
|
let getAuthMethodsCount;
|
|
let featuresService;
|
|
|
|
const instances = {
|
|
scopes: {
|
|
global: null,
|
|
org: null,
|
|
project: null,
|
|
},
|
|
authMethod: null,
|
|
orgScope: null,
|
|
};
|
|
|
|
const urls = {
|
|
orgScope: null,
|
|
authMethods: null,
|
|
newAuthMethod: null,
|
|
newLdapAuthMethod: null,
|
|
authMethod: null,
|
|
};
|
|
|
|
hooks.beforeEach(async function () {
|
|
await authenticateSession({});
|
|
instances.orgScope = this.server.create(
|
|
'scope',
|
|
{
|
|
type: 'org',
|
|
scope: { id: 'global', type: 'global' },
|
|
},
|
|
'withChildren',
|
|
);
|
|
|
|
instances.scopes.project = this.server.create('scope', {
|
|
type: 'project',
|
|
scope: { id: instances.orgScope.id, type: instances.orgScope.type },
|
|
});
|
|
|
|
instances.authMethod = this.server.create('auth-method', {
|
|
scope: instances.orgScope,
|
|
});
|
|
|
|
// Generate route URLs for resources
|
|
urls.orgScope = `/scopes/${instances.orgScope.id}`;
|
|
urls.authMethods = `${urls.orgScope}/auth-methods`;
|
|
urls.newAuthMethod = `${urls.authMethods}/new?type=password`;
|
|
urls.newLdapAuthMethod = `${urls.authMethods}/new?type=ldap`;
|
|
urls.authMethod = `${urls.authMethods}/${instances.authMethod.id}`;
|
|
getAuthMethodsCount = () =>
|
|
this.server.schema.authMethods.all().models.length;
|
|
|
|
featuresService = this.owner.lookup('service:features');
|
|
});
|
|
|
|
test('Users can create new auth method', async function (assert) {
|
|
const count = getAuthMethodsCount();
|
|
|
|
await visit(urls.newAuthMethod);
|
|
await fillIn(NAME_INPUT_SELECTOR, 'AuthMethod name');
|
|
await fillIn(DESC_INPUT_SELECTOR, 'description');
|
|
await click(SAVE_BTN_SELECTOR);
|
|
assert.strictEqual(getAuthMethodsCount(), count + 1);
|
|
});
|
|
|
|
test('Users can create new oidc auth method', async function (assert) {
|
|
const count = getAuthMethodsCount();
|
|
|
|
await visit(`${urls.authMethods}/new?type=oidc`);
|
|
const name = 'oidc name';
|
|
await fillIn(NAME_INPUT_SELECTOR, name);
|
|
await fillIn(DESC_INPUT_SELECTOR, 'description');
|
|
await fillIn('[name="issuer"]', 'issuer');
|
|
await fillIn('[name="client_id"]', 'client_id');
|
|
await fillIn('[name="client_secret"]', 'client_secret');
|
|
await select('form fieldset:nth-of-type(1) select', 'RS384');
|
|
await click('[data-test-add-option-button]');
|
|
await fillIn(ALLOWED_AUDIENCES_INPUT_SELECTOR, 'allowed_audiences');
|
|
await click(ALLOWED_AUDIENCES_BTN_SELECTOR, 'allowed_audiences');
|
|
await fillIn(CLAIMS_SCOPES_INPUT_SELECTOR, 'claims_scopes');
|
|
await click(CLAIMS_SCOPES_BTN_SELECTOR, 'claims_scopes');
|
|
|
|
await fillIn(
|
|
'[name="account_claim_maps"] tbody td:nth-of-type(1) input',
|
|
'from_claim',
|
|
);
|
|
await select(
|
|
'[name="account_claim_maps"] tbody td:nth-of-type(2) select',
|
|
'email',
|
|
);
|
|
|
|
await click('[name="account_claim_maps"] button');
|
|
|
|
await fillIn(IDP_CERTS_INPUT_SELECTOR, 'certificates');
|
|
await click(IDP_CERTS_BTN_SELECTOR);
|
|
await fillIn('[name="max_age"]', '5');
|
|
await fillIn('[name="api_url_prefix"]', 'api_url_prefix');
|
|
await click('[id="consent"]', 'consent');
|
|
|
|
//If skip prompts toggle is clicked, then we hide the rest of the prompt options
|
|
await click(TOGGLE_SELECTOR);
|
|
assert.dom('[id="select_account"]').isNotVisible();
|
|
await click(SAVE_BTN_SELECTOR);
|
|
|
|
assert.strictEqual(getAuthMethodsCount(), count + 1);
|
|
const authMethod = this.server.schema.authMethods.findBy({ name });
|
|
assert.strictEqual(authMethod.name, name);
|
|
assert.strictEqual(authMethod.description, 'description');
|
|
assert.strictEqual(authMethod.attributes.issuer, 'issuer');
|
|
assert.strictEqual(authMethod.attributes.client_id, 'client_id');
|
|
assert.deepEqual(authMethod.attributes.signing_algorithms, ['RS384']);
|
|
assert.deepEqual(authMethod.attributes.allowed_audiences, [
|
|
'allowed_audiences',
|
|
]);
|
|
assert.deepEqual(authMethod.attributes.claims_scopes, ['claims_scopes']);
|
|
assert.deepEqual(authMethod.attributes.account_claim_maps, [
|
|
'from_claim=email',
|
|
]);
|
|
assert.deepEqual(authMethod.attributes.idp_ca_certs, ['certificates']);
|
|
assert.strictEqual(authMethod.attributes.max_age, 5);
|
|
assert.strictEqual(authMethod.attributes.api_url_prefix, 'api_url_prefix');
|
|
assert.deepEqual(authMethod.attributes.prompts, ['none']);
|
|
});
|
|
|
|
test('Users can create a new ldap auth method', async function (assert) {
|
|
featuresService.enable('ldap-auth-methods');
|
|
const authMethodsCount = getAuthMethodsCount();
|
|
const name = 'ldap auth method';
|
|
await visit(urls.authMethods);
|
|
|
|
await click(NEW_DROPDOWN_SELECTOR);
|
|
await click(`[href="${urls.newLdapAuthMethod}"]`);
|
|
await fillIn(NAME_INPUT_SELECTOR, name);
|
|
await fillIn(DESC_INPUT_SELECTOR, 'description');
|
|
await fillIn('[name="urls"]', 'url1,url2');
|
|
await fillIn(CERTIFICATES_INPUT_SELECTOR, 'certificate');
|
|
await click(CERTIFICATES_BTN_SELECTOR);
|
|
await fillIn('[name="client_certificate"]', 'client cert');
|
|
await fillIn('[name="client_certificate_key"]', 'client cert key');
|
|
await click('[name="start_tls"]');
|
|
await click('[name="insecure_tls"]');
|
|
await fillIn('[name="bind_dn"]', 'bind dn');
|
|
await fillIn('[name="bind_password"]', 'password');
|
|
await fillIn('[name="upn_domain"]', 'upn domain');
|
|
await click('[name="discover_dn"]');
|
|
await click('[name="anon_group_search"]');
|
|
await fillIn('[name="user_dn"]', 'user dn');
|
|
await fillIn('[name="user_attr"]', 'user attr');
|
|
await fillIn('[name="user_filter"]', 'user filter');
|
|
await fillIn('[name="account_attribute_maps"] input', 'attribute');
|
|
await select('[name="account_attribute_maps"] select', 'email');
|
|
await click('[name="account_attribute_maps"] button');
|
|
await fillIn('[name="group_dn"]', 'group dn');
|
|
await fillIn('[name="group_attr"]', 'group attr');
|
|
await fillIn('[name="group_filter"]', 'group filter');
|
|
await click('[name="enable_groups"]');
|
|
await click('[name="use_token_groups"]');
|
|
await click(SAVE_BTN_SELECTOR);
|
|
|
|
assert.strictEqual(getAuthMethodsCount(), authMethodsCount + 1);
|
|
const ldapAuthMethod = this.server.schema.authMethods.findBy({ name });
|
|
assert.strictEqual(ldapAuthMethod.name, name);
|
|
assert.strictEqual(ldapAuthMethod.description, 'description');
|
|
assert.deepEqual(ldapAuthMethod.attributes.urls, ['url1', 'url2']);
|
|
assert.deepEqual(ldapAuthMethod.attributes.certificates, ['certificate']);
|
|
assert.strictEqual(
|
|
ldapAuthMethod.attributes.client_certificate,
|
|
'client cert',
|
|
);
|
|
assert.notOk(ldapAuthMethod.attributes.client_certificate_key);
|
|
assert.true(ldapAuthMethod.attributes.start_tls);
|
|
assert.true(ldapAuthMethod.attributes.insecure_tls);
|
|
assert.strictEqual(ldapAuthMethod.attributes.bind_dn, 'bind dn');
|
|
assert.notOk(ldapAuthMethod.attributes.bind_password);
|
|
assert.strictEqual(ldapAuthMethod.attributes.upn_domain, 'upn domain');
|
|
assert.true(ldapAuthMethod.attributes.discover_dn);
|
|
assert.true(ldapAuthMethod.attributes.anon_group_search);
|
|
assert.strictEqual(ldapAuthMethod.attributes.user_dn, 'user dn');
|
|
assert.strictEqual(ldapAuthMethod.attributes.user_attr, 'user attr');
|
|
assert.strictEqual(ldapAuthMethod.attributes.user_filter, 'user filter');
|
|
assert.deepEqual(ldapAuthMethod.attributes.account_attribute_maps, [
|
|
'attribute=email',
|
|
]);
|
|
assert.strictEqual(ldapAuthMethod.attributes.group_dn, 'group dn');
|
|
assert.strictEqual(ldapAuthMethod.attributes.group_attr, 'group attr');
|
|
assert.strictEqual(ldapAuthMethod.attributes.group_filter, 'group filter');
|
|
assert.true(ldapAuthMethod.attributes.enable_groups);
|
|
assert.true(ldapAuthMethod.attributes.use_token_groups);
|
|
});
|
|
|
|
test('Users can navigate to new auth-methods route with proper authorization', async function (assert) {
|
|
instances.orgScope.authorized_collection_actions['auth-methods'] = [
|
|
'create',
|
|
'list',
|
|
];
|
|
|
|
await visit(urls.orgScope);
|
|
await click(`[href="${urls.authMethods}"]`);
|
|
|
|
assert.true(
|
|
instances.orgScope.authorized_collection_actions['auth-methods'].includes(
|
|
'create',
|
|
),
|
|
);
|
|
|
|
await click(NEW_DROPDOWN_SELECTOR);
|
|
|
|
assert.dom(`[href="${urls.newAuthMethod}"]`).exists();
|
|
});
|
|
|
|
test('Users cannot navigate to new auth-methods route without proper authorization', async function (assert) {
|
|
instances.orgScope.authorized_collection_actions['auth-methods'] = ['list'];
|
|
|
|
await visit(urls.orgScope);
|
|
await click(`[href="${urls.authMethods}"]`);
|
|
|
|
assert.false(
|
|
instances.orgScope.authorized_collection_actions['auth-methods'].includes(
|
|
'create',
|
|
),
|
|
);
|
|
assert.dom(NEW_DROPDOWN_SELECTOR).doesNotExist();
|
|
});
|
|
|
|
test('Users can navigate to new ldap auth-method route with proper authorization and feature flag enabled', async function (assert) {
|
|
instances.orgScope.authorized_collection_actions['auth-methods'] = [
|
|
'create',
|
|
'list',
|
|
];
|
|
featuresService.enable('ldap-auth-methods');
|
|
|
|
await visit(urls.orgScope);
|
|
await click(`[href="${urls.authMethods}"]`);
|
|
|
|
assert.true(
|
|
instances.orgScope.authorized_collection_actions['auth-methods'].includes(
|
|
'create',
|
|
),
|
|
);
|
|
|
|
await click(NEW_DROPDOWN_SELECTOR);
|
|
|
|
assert.dom(`[href="${urls.newLdapAuthMethod}"]`).exists();
|
|
});
|
|
|
|
test('Users cannot navigate to new ldap auth-method route when feature flag disabled', async function (assert) {
|
|
instances.orgScope.authorized_collection_actions['auth-methods'] = [
|
|
'create',
|
|
'list',
|
|
];
|
|
|
|
await visit(urls.orgScope);
|
|
await click(`[href="${urls.authMethods}"]`);
|
|
|
|
assert.true(
|
|
instances.orgScope.authorized_collection_actions['auth-methods'].includes(
|
|
'create',
|
|
),
|
|
);
|
|
|
|
await click(NEW_DROPDOWN_SELECTOR);
|
|
|
|
assert.dom(`[href="${urls.newLdapAuthMethod}"]`).doesNotExist();
|
|
});
|
|
|
|
test('can cancel new auth method creation', async function (assert) {
|
|
const count = getAuthMethodsCount();
|
|
await visit(urls.authMethods);
|
|
|
|
await click(NEW_DROPDOWN_SELECTOR);
|
|
await click(`[href="${urls.newAuthMethod}"]`);
|
|
await fillIn(NAME_INPUT_SELECTOR, 'AuthMethod name');
|
|
await fillIn(DESC_INPUT_SELECTOR, 'description');
|
|
await click(CANCEL_BTN_SELECTOR);
|
|
|
|
assert.strictEqual(getAuthMethodsCount(), count);
|
|
assert.strictEqual(currentURL(), urls.authMethods);
|
|
});
|
|
|
|
test('user can make primary an auth method', async function (assert) {
|
|
assert.notOk(
|
|
instances.orgScope.primaryAuthMethodId,
|
|
'Primary auth method is not yet set.',
|
|
);
|
|
await visit(urls.authMethods);
|
|
|
|
await click(`[href="${urls.authMethod}"]`);
|
|
await click(MANAGE_DROPDOWN_SELECTOR);
|
|
await click(MAKE_PRIMARY_SELECTOR);
|
|
|
|
const scope = this.server.schema.scopes.find(instances.orgScope.id);
|
|
assert.strictEqual(
|
|
scope.primaryAuthMethodId,
|
|
instances.authMethod.id,
|
|
'Primary auth method is set.',
|
|
);
|
|
});
|
|
|
|
test('user is notified of error on make primary an auth method', async function (assert) {
|
|
this.server.patch('/scopes/:id', () => {
|
|
return new Response(
|
|
400,
|
|
{},
|
|
{
|
|
status: 400,
|
|
code: 'fail',
|
|
message: 'Sorry!',
|
|
},
|
|
);
|
|
});
|
|
assert.notOk(
|
|
instances.orgScope.primaryAuthMethodId,
|
|
'Primary auth method is not yet set.',
|
|
);
|
|
await visit(urls.authMethod);
|
|
await click(MANAGE_DROPDOWN_SELECTOR);
|
|
await click(MAKE_PRIMARY_SELECTOR);
|
|
assert.dom(ERROR_MSG_SELECTOR).exists();
|
|
});
|
|
|
|
test('user can remove as primary an auth method', async function (assert) {
|
|
instances.orgScope.update({
|
|
primaryAuthMethodId: instances.authMethod.id,
|
|
});
|
|
assert.ok(
|
|
instances.orgScope.primaryAuthMethodId,
|
|
'Primary auth method is set.',
|
|
);
|
|
await visit(urls.authMethods);
|
|
|
|
await click(`[href="${urls.authMethod}"]`);
|
|
await click(MANAGE_DROPDOWN_SELECTOR);
|
|
await click(MAKE_PRIMARY_SELECTOR);
|
|
const scope = this.server.schema.scopes.find(instances.orgScope.id);
|
|
assert.notOk(scope.primaryAuthMethodId, 'Primary auth method is unset.');
|
|
});
|
|
|
|
test('user is notified of error on remove as primary an auth method', async function (assert) {
|
|
this.server.patch('/scopes/:id', () => {
|
|
return new Response(
|
|
400,
|
|
{},
|
|
{
|
|
status: 400,
|
|
code: 'fail',
|
|
message: 'Sorry!',
|
|
},
|
|
);
|
|
});
|
|
instances.orgScope.update({
|
|
primaryAuthMethodId: instances.authMethod.id,
|
|
});
|
|
|
|
assert.strictEqual(
|
|
instances.orgScope.primaryAuthMethodId,
|
|
instances.authMethod.id,
|
|
);
|
|
await visit(urls.authMethods);
|
|
|
|
await click(`[href="${urls.authMethod}"]`);
|
|
await click(MANAGE_DROPDOWN_SELECTOR);
|
|
await click(MAKE_PRIMARY_SELECTOR);
|
|
|
|
assert.dom(ERROR_MSG_SELECTOR).hasText('Sorry!');
|
|
});
|
|
|
|
test('user can make and remove primary auth methods from index', async function (assert) {
|
|
assert.notOk(
|
|
instances.orgScope.primaryAuthMethodId,
|
|
'Primary auth method is not yet set.',
|
|
);
|
|
await visit(urls.authMethods);
|
|
|
|
await click(DROPDOWN_SELECTOR_ICON);
|
|
assert.dom(DROPDOWN_SELECTOR_OPTION).exists();
|
|
await click(DROPDOWN_SELECTOR_OPTION);
|
|
|
|
let scope = this.server.schema.scopes.find(instances.orgScope.id);
|
|
|
|
assert.strictEqual(
|
|
scope.primaryAuthMethodId,
|
|
instances.authMethod.id,
|
|
'Primary auth method is set.',
|
|
);
|
|
await click(DROPDOWN_SELECTOR_ICON);
|
|
|
|
await click(DROPDOWN_SELECTOR_OPTION);
|
|
|
|
scope = this.server.schema.scopes.find(instances.orgScope.id);
|
|
assert.notOk(scope.primaryAuthMethodId, 'Primary auth method is unset.');
|
|
});
|
|
|
|
test('saving a new ldap auth method with invalid fields displays error messages', async function (assert) {
|
|
featuresService.enable('ldap-auth-methods');
|
|
this.server.post('/auth-methods', () => {
|
|
return new Response(
|
|
400,
|
|
{},
|
|
{
|
|
status: 400,
|
|
code: 'invalid_argument',
|
|
message: 'The request was invalid.',
|
|
details: {
|
|
request_fields: [
|
|
{
|
|
name: 'urls',
|
|
description: 'At least one URL is required.',
|
|
},
|
|
],
|
|
},
|
|
},
|
|
);
|
|
});
|
|
await visit(urls.authMethods);
|
|
|
|
await click(NEW_DROPDOWN_SELECTOR);
|
|
await click(`[href="${urls.newLdapAuthMethod}"]`);
|
|
await fillIn(URLS_INPUT_SELECTOR, '');
|
|
await click(SAVE_BTN_SELECTOR);
|
|
|
|
assert.dom(ERROR_MSG_SELECTOR).hasText('The request was invalid.');
|
|
assert
|
|
.dom(FIELD_ERROR_TEXT_SELECTOR)
|
|
.hasText('At least one URL is required.');
|
|
});
|
|
|
|
test('users cannot directly navigate to new auth method route without proper authorization', async function (assert) {
|
|
instances.orgScope.authorized_collection_actions['auth-methods'] = ['list'];
|
|
|
|
await visit(urls.newAuthMethod);
|
|
|
|
assert.false(
|
|
instances.orgScope.authorized_collection_actions['auth-methods'].includes(
|
|
'create',
|
|
),
|
|
);
|
|
assert.strictEqual(currentURL(), urls.authMethods);
|
|
});
|
|
});
|