shadowdaoandClaude Sonnet 5.5
962d708fdd
Rename root, api and sdk module paths (imports, go.mod, go_package, ldflags, build scripts, buf configs) and regenerate protobuf/gateway code with the project's pinned toolchain. Wire identifiers unchanged. api gets a local replace for sdk; root/api/sdk require v0.1.0. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
68 lines
2.8 KiB
Go
68 lines
2.8 KiB
Go
// Copyright IBM Corp. 2020, 2026
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
package auth
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"repo.anhonesthost.net/CyberCoveLLC/threshold/globals"
|
|
"repo.anhonesthost.net/CyberCoveLLC/threshold/internal/authtoken"
|
|
"repo.anhonesthost.net/CyberCoveLLC/threshold/internal/daemon/controller/common"
|
|
"repo.anhonesthost.net/CyberCoveLLC/threshold/internal/db"
|
|
authpb "repo.anhonesthost.net/CyberCoveLLC/threshold/internal/gen/controller/auth"
|
|
"repo.anhonesthost.net/CyberCoveLLC/threshold/internal/iam"
|
|
"repo.anhonesthost.net/CyberCoveLLC/threshold/internal/kms"
|
|
"repo.anhonesthost.net/CyberCoveLLC/threshold/internal/requests"
|
|
"repo.anhonesthost.net/CyberCoveLLC/threshold/internal/server"
|
|
wrapping "github.com/hashicorp/go-kms-wrapping/v2"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// DisabledAuthTestContext is meant for testing, and uses a context that has
|
|
// auth checking entirely disabled. Supported options: WithScopeId an WithUserId
|
|
// are used directly; WithKms is passed through into the verifier context.
|
|
func DisabledAuthTestContext(iamRepoFn common.IamRepoFactory, scopeId string, opt ...Option) context.Context {
|
|
reqInfo := authpb.RequestInfo{DisableAuthEntirely: true}
|
|
opts := getOpts(opt...)
|
|
reqInfo.ScopeIdOverride = opts.withScopeId
|
|
if reqInfo.ScopeIdOverride == "" {
|
|
reqInfo.ScopeIdOverride = scopeId
|
|
}
|
|
reqInfo.UserIdOverride = opts.withUserId
|
|
if reqInfo.UserIdOverride == "" {
|
|
reqInfo.UserIdOverride = globals.AnyAuthenticatedUserId
|
|
}
|
|
reqInfo.Actions = opts.withActions
|
|
requestContext := context.WithValue(context.Background(), requests.ContextRequestInformationKey, &requests.RequestContext{})
|
|
return NewVerifierContext(requestContext, iamRepoFn, nil, nil, opts.withKms, &reqInfo)
|
|
}
|
|
|
|
// TestAuthContextFromToken creates an auth context with provided token
|
|
// This is used in conjunction with TestAuthTokenWithRoles which creates a test token
|
|
func TestAuthContextFromToken(t *testing.T, conn *db.DB, wrap wrapping.Wrapper, token *authtoken.AuthToken, iamRepo *iam.Repository) context.Context {
|
|
t.Helper()
|
|
ctx := context.Background()
|
|
rw := db.New(conn)
|
|
kmsCache := kms.TestKms(t, conn, wrap)
|
|
atRepo, err := authtoken.NewRepository(ctx, rw, rw, kmsCache)
|
|
require.NoError(t, err)
|
|
serversRepoFn := func() (*server.Repository, error) {
|
|
return server.NewRepository(ctx, rw, rw, kmsCache)
|
|
}
|
|
iamRepoFn := func() (*iam.Repository, error) {
|
|
return iamRepo, nil
|
|
}
|
|
atRepoFn := func() (*authtoken.Repository, error) {
|
|
return atRepo, nil
|
|
}
|
|
fullGrantAuthCtx := NewVerifierContext(requests.NewRequestContext(ctx, requests.WithUserId(token.GetIamUserId())),
|
|
iamRepoFn, atRepoFn, serversRepoFn, kmsCache, &authpb.RequestInfo{
|
|
PublicId: token.PublicId,
|
|
Token: token.GetToken(),
|
|
TokenFormat: uint32(AuthTokenTypeBearer),
|
|
})
|
|
return fullGrantAuthCtx
|
|
}
|