Jim
8d6dee09a9
* refact: Changes required for gorm v2 * refact: Add db.DB wrapper and refact all test fixtures to use it Stop leaking the gorm abstraction within our unit tests. * refact: Migrate direct calls to pq to pgx driver The refactor will remove the remaining direct dependencies on the pq driver which has been deprecated in favor of the pgx driver. It includes the addition of common.SqlOpen which is a wrapper around sql.Open, which is needed to deal with the driver name changing from "postgres" to "pgx" but in our code base the dialect and driver are synonyms.
1459 lines
46 KiB
Go
1459 lines
46 KiB
Go
package iam_test
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"sort"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/google/go-cmp/cmp"
|
|
"github.com/hashicorp/boundary/internal/auth/oidc"
|
|
"github.com/hashicorp/boundary/internal/auth/password"
|
|
"github.com/hashicorp/boundary/internal/auth/store"
|
|
"github.com/hashicorp/boundary/internal/db"
|
|
dbassert "github.com/hashicorp/boundary/internal/db/assert"
|
|
"github.com/hashicorp/boundary/internal/errors"
|
|
"github.com/hashicorp/boundary/internal/iam"
|
|
"github.com/hashicorp/boundary/internal/kms"
|
|
"github.com/hashicorp/boundary/internal/oplog"
|
|
"github.com/hashicorp/go-secure-stdlib/strutil"
|
|
"github.com/hashicorp/go-uuid"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"google.golang.org/protobuf/proto"
|
|
"google.golang.org/protobuf/testing/protocmp"
|
|
)
|
|
|
|
func TestRepository_CreateUser(t *testing.T) {
|
|
t.Parallel()
|
|
conn, _ := db.TestSetup(t, "postgres")
|
|
rw := db.New(conn)
|
|
wrapper := db.TestWrapper(t)
|
|
repo := iam.TestRepo(t, conn, wrapper)
|
|
id := testId(t)
|
|
org, _ := iam.TestScopes(t, repo)
|
|
|
|
type args struct {
|
|
user *iam.User
|
|
opt []iam.Option
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
args args
|
|
wantDup bool
|
|
wantErr bool
|
|
wantErrMsg string
|
|
}{
|
|
{
|
|
name: "valid",
|
|
args: args{
|
|
user: func() *iam.User {
|
|
u, err := iam.NewUser(org.PublicId, iam.WithName("valid"+id), iam.WithDescription(id))
|
|
assert.NoError(t, err)
|
|
return u
|
|
}(),
|
|
},
|
|
wantErr: false,
|
|
},
|
|
{
|
|
name: "bad-scope-id",
|
|
args: args{
|
|
user: func() *iam.User {
|
|
u, err := iam.NewUser(id)
|
|
assert.NoError(t, err)
|
|
return u
|
|
}(),
|
|
},
|
|
wantErr: true,
|
|
wantErrMsg: "iam.(Repository).create: error getting metadata: iam.(Repository).stdMetadata: unable to get scope: iam.LookupScope: db.LookupWhere: record not found",
|
|
},
|
|
{
|
|
name: "dup-name",
|
|
args: args{
|
|
user: func() *iam.User {
|
|
u, err := iam.NewUser(org.PublicId, iam.WithName("dup-name"+id))
|
|
assert.NoError(t, err)
|
|
return u
|
|
}(),
|
|
},
|
|
wantDup: true,
|
|
wantErr: true,
|
|
wantErrMsg: "iam.(Repository).CreateUser: user %s already exists in org %s: integrity violation: error #1002",
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
assert, require := assert.New(t), require.New(t)
|
|
if tt.wantDup {
|
|
dup, err := repo.CreateUser(context.Background(), tt.args.user, tt.args.opt...)
|
|
require.NoError(err)
|
|
require.NotNil(dup)
|
|
}
|
|
u, err := repo.CreateUser(context.Background(), tt.args.user, tt.args.opt...)
|
|
if tt.wantErr {
|
|
require.Error(err)
|
|
assert.Nil(u)
|
|
switch tt.name {
|
|
case "dup-name":
|
|
assert.Contains(err.Error(), fmt.Sprintf(tt.wantErrMsg, "dup-name"+id, org.PublicId))
|
|
default:
|
|
assert.Contains(err.Error(), tt.wantErrMsg)
|
|
}
|
|
return
|
|
}
|
|
require.NoError(err)
|
|
assert.NotNil(u.CreateTime)
|
|
assert.NotNil(u.UpdateTime)
|
|
|
|
foundUser, _, err := repo.LookupUser(context.Background(), u.PublicId)
|
|
require.NoError(err)
|
|
assert.True(proto.Equal(foundUser, u))
|
|
|
|
err = db.TestVerifyOplog(t, rw, u.PublicId, db.WithOperation(oplog.OpType_OP_TYPE_CREATE), db.WithCreateNotBefore(10*time.Second))
|
|
assert.NoError(err)
|
|
})
|
|
}
|
|
}
|
|
|
|
// TestRepository_LookupUser_WithDifferentPrimaryAuthMethods ensures that the
|
|
// when different auth method types are primary, the correct primary account
|
|
// info is returned from Repository.LookupUser(...)
|
|
func TestRepository_LookupUser_WithDifferentPrimaryAuthMethods(t *testing.T) {
|
|
t.Parallel()
|
|
ctx := context.Background()
|
|
conn, _ := db.TestSetup(t, "postgres")
|
|
wrapper := db.TestWrapper(t)
|
|
kmsCache := kms.TestKms(t, conn, wrapper)
|
|
repo := iam.TestRepo(t, conn, wrapper)
|
|
org, _ := iam.TestScopes(t, repo)
|
|
databaseWrapper, err := kmsCache.GetWrapper(context.Background(), org.PublicId, kms.KeyPurposeDatabase)
|
|
require.NoError(t, err)
|
|
|
|
var accountIds []string
|
|
oidcAm := oidc.TestAuthMethod(t, conn, databaseWrapper, org.PublicId, oidc.ActivePrivateState, "alice-rp", "fido",
|
|
oidc.WithIssuer(oidc.TestConvertToUrls(t, "https://alice.com")[0]),
|
|
oidc.WithSigningAlgs(oidc.RS256),
|
|
oidc.WithApiUrl(oidc.TestConvertToUrls(t, "http://localhost")[0]))
|
|
aa := oidc.TestAccount(t, conn, oidcAm, "alice", oidc.WithFullName("alice eve smith"), oidc.WithEmail("alice@example.com"))
|
|
accountIds = append(accountIds, aa.PublicId)
|
|
|
|
pwAms := password.TestAuthMethods(t, conn, org.PublicId, 1)
|
|
require.Equal(t, 1, len(pwAms))
|
|
pwAcct := password.TestAccount(t, conn, pwAms[0].PublicId, "want-login-name")
|
|
accountIds = append(accountIds, pwAcct.PublicId)
|
|
|
|
u := iam.TestUser(t, repo, org.PublicId)
|
|
newAccts, err := repo.AddUserAccounts(context.Background(), u.PublicId, u.Version, accountIds)
|
|
require.NoError(t, err)
|
|
sort.Strings(newAccts)
|
|
require.Equal(t, accountIds, newAccts)
|
|
|
|
tests := []struct {
|
|
name string
|
|
primaryAuthMethodId string
|
|
wantLoginName string
|
|
wantPrimaryAcctId string
|
|
wantFullName string
|
|
wantEmail string
|
|
}{
|
|
{
|
|
name: "oidc",
|
|
primaryAuthMethodId: oidcAm.PublicId,
|
|
wantLoginName: "alice",
|
|
wantPrimaryAcctId: aa.PublicId,
|
|
wantFullName: "alice eve smith",
|
|
wantEmail: "alice@example.com",
|
|
},
|
|
{
|
|
name: "password",
|
|
primaryAuthMethodId: pwAms[0].PublicId,
|
|
wantLoginName: "want-login-name",
|
|
wantPrimaryAcctId: pwAcct.PublicId,
|
|
wantFullName: "",
|
|
wantEmail: "",
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
assert, require := assert.New(t), require.New(t)
|
|
|
|
s, err := repo.LookupScope(context.Background(), org.PublicId)
|
|
require.NoError(err)
|
|
iam.TestSetPrimaryAuthMethod(t, repo, s, tt.primaryAuthMethodId)
|
|
|
|
got, gotAccts, err := repo.LookupUser(ctx, u.PublicId)
|
|
require.NoError(err)
|
|
|
|
sort.Strings(gotAccts)
|
|
assert.Equal(accountIds, gotAccts)
|
|
|
|
assert.Equal(tt.wantLoginName, got.LoginName)
|
|
assert.Equal(tt.wantPrimaryAcctId, got.PrimaryAccountId)
|
|
assert.Equal(tt.wantFullName, got.FullName)
|
|
assert.Equal(tt.wantEmail, got.Email)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestRepository_UpdateUser(t *testing.T) {
|
|
t.Parallel()
|
|
ctx := context.Background()
|
|
conn, _ := db.TestSetup(t, "postgres")
|
|
rw := db.New(conn)
|
|
wrapper := db.TestWrapper(t)
|
|
kmsCache := kms.TestKms(t, conn, wrapper)
|
|
repo := iam.TestRepo(t, conn, wrapper)
|
|
id := testId(t)
|
|
org, proj := iam.TestScopes(t, repo)
|
|
databaseWrapper, err := kmsCache.GetWrapper(context.Background(), org.PublicId, kms.KeyPurposeDatabase)
|
|
require.NoError(t, err)
|
|
|
|
pubId := func(s string) *string { return &s }
|
|
|
|
type args struct {
|
|
name string
|
|
description string
|
|
fieldMaskPaths []string
|
|
opt []iam.Option
|
|
ScopeId string
|
|
PublicId *string
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
newUserOpts []iam.Option
|
|
args args
|
|
wantRowsUpdate int
|
|
wantErr bool
|
|
wantErrMsg string
|
|
wantIsErr errors.Code
|
|
wantDup bool
|
|
}{
|
|
{
|
|
name: "valid",
|
|
args: args{
|
|
name: "valid" + id,
|
|
fieldMaskPaths: []string{"Name"},
|
|
ScopeId: org.PublicId,
|
|
},
|
|
wantErr: false,
|
|
wantRowsUpdate: 1,
|
|
},
|
|
{
|
|
name: "valid-no-op",
|
|
args: args{
|
|
name: "valid-no-op" + id,
|
|
fieldMaskPaths: []string{"Name"},
|
|
ScopeId: org.PublicId,
|
|
},
|
|
newUserOpts: []iam.Option{iam.WithName("valid-no-op" + id)},
|
|
wantErr: false,
|
|
wantRowsUpdate: 1,
|
|
},
|
|
{
|
|
name: "not-found",
|
|
args: args{
|
|
name: "not-found" + id,
|
|
fieldMaskPaths: []string{"Name"},
|
|
ScopeId: org.PublicId,
|
|
PublicId: func() *string { s := "1"; return &s }(),
|
|
},
|
|
wantErr: true,
|
|
wantRowsUpdate: 0,
|
|
wantErrMsg: "iam.(Repository).UpdateUser: db.Update: db.lookupAfterWrite: db.LookupById: record not found, search issue: error #1100",
|
|
wantIsErr: errors.RecordNotFound,
|
|
},
|
|
{
|
|
name: "null-name",
|
|
args: args{
|
|
name: "",
|
|
fieldMaskPaths: []string{"Name"},
|
|
ScopeId: org.PublicId,
|
|
},
|
|
newUserOpts: []iam.Option{iam.WithName("null-name" + id)},
|
|
wantErr: false,
|
|
wantRowsUpdate: 1,
|
|
},
|
|
{
|
|
name: "null-description",
|
|
args: args{
|
|
name: "",
|
|
fieldMaskPaths: []string{"Description"},
|
|
ScopeId: org.PublicId,
|
|
},
|
|
newUserOpts: []iam.Option{iam.WithDescription("null-description" + id)},
|
|
wantErr: false,
|
|
wantRowsUpdate: 1,
|
|
},
|
|
{
|
|
name: "empty-field-mask",
|
|
args: args{
|
|
name: "valid" + id,
|
|
fieldMaskPaths: []string{},
|
|
ScopeId: org.PublicId,
|
|
},
|
|
wantErr: true,
|
|
wantRowsUpdate: 0,
|
|
wantErrMsg: "iam.(Repository).UpdateUser: empty field mask, parameter violation: error #104",
|
|
},
|
|
{
|
|
name: "nil-fieldmask",
|
|
args: args{
|
|
name: "valid" + id,
|
|
fieldMaskPaths: nil,
|
|
ScopeId: org.PublicId,
|
|
},
|
|
wantErr: true,
|
|
wantRowsUpdate: 0,
|
|
wantErrMsg: "iam.(Repository).UpdateUser: empty field mask, parameter violation: error #104",
|
|
},
|
|
{
|
|
name: "read-only-fields",
|
|
args: args{
|
|
name: "valid" + id,
|
|
fieldMaskPaths: []string{"CreateTime"},
|
|
ScopeId: org.PublicId,
|
|
},
|
|
wantErr: true,
|
|
wantRowsUpdate: 0,
|
|
wantErrMsg: "iam.(Repository).UpdateUser: invalid field mask: CreateTime: parameter violation: error #103",
|
|
},
|
|
{
|
|
name: "unknown-fields",
|
|
args: args{
|
|
name: "valid" + id,
|
|
fieldMaskPaths: []string{"Alice"},
|
|
ScopeId: org.PublicId,
|
|
},
|
|
wantErr: true,
|
|
wantRowsUpdate: 0,
|
|
wantErrMsg: "iam.(Repository).UpdateUser: invalid field mask: Alice: parameter violation: error #103",
|
|
},
|
|
{
|
|
name: "no-public-id",
|
|
args: args{
|
|
name: "valid" + id,
|
|
fieldMaskPaths: []string{"Name"},
|
|
ScopeId: org.PublicId,
|
|
PublicId: pubId(""),
|
|
},
|
|
wantErr: true,
|
|
wantErrMsg: "iam.(Repository).UpdateUser: missing public id: parameter violation: error #100",
|
|
wantRowsUpdate: 0,
|
|
},
|
|
{
|
|
name: "proj-scope-id",
|
|
args: args{
|
|
name: "proj-scope-id" + id,
|
|
fieldMaskPaths: []string{"ScopeId"},
|
|
ScopeId: proj.PublicId,
|
|
},
|
|
wantErr: true,
|
|
wantErrMsg: "iam.(Repository).UpdateUser: invalid field mask: ScopeId: parameter violation: error #103",
|
|
},
|
|
{
|
|
name: "empty-scope-id-with-name-mask",
|
|
args: args{
|
|
name: "empty-scope-id" + id,
|
|
fieldMaskPaths: []string{"Name"},
|
|
ScopeId: "",
|
|
},
|
|
wantErr: false,
|
|
wantRowsUpdate: 1,
|
|
},
|
|
{
|
|
name: "dup-name",
|
|
args: args{
|
|
name: "dup-name" + id,
|
|
fieldMaskPaths: []string{"Name"},
|
|
ScopeId: org.PublicId,
|
|
},
|
|
wantErr: true,
|
|
wantDup: true,
|
|
wantErrMsg: `iam.(Repository).UpdateUser: user %s already exists in org %s: integrity violation: error #1002`,
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
assert, require := assert.New(t), require.New(t)
|
|
// we need to clean out any auth methods
|
|
_, err = rw.Exec(context.Background(), "delete from auth_method", nil)
|
|
require.NoError(err)
|
|
|
|
if tt.wantDup {
|
|
u := iam.TestUser(t, repo, org.PublicId, tt.newUserOpts...)
|
|
u.Name = tt.args.name
|
|
_, _, _, err := repo.UpdateUser(context.Background(), u, 1, tt.args.fieldMaskPaths, tt.args.opt...)
|
|
require.NoError(err)
|
|
}
|
|
|
|
u := iam.TestUser(t, repo, org.PublicId, tt.newUserOpts...)
|
|
acctCount := 10
|
|
accountIds := make([]string, 0, acctCount)
|
|
var wantEmail, wantFullName, wantPrimaryAccountId string
|
|
var authMethod *oidc.AuthMethod
|
|
for i := 0; i < acctCount; i++ {
|
|
switch i % 2 {
|
|
case 0:
|
|
authMethod = oidc.TestAuthMethod(t, conn, databaseWrapper, org.PublicId, oidc.ActivePrivateState, fmt.Sprintf("alice-rp-%d", i), "fido",
|
|
oidc.WithIssuer(oidc.TestConvertToUrls(t, "https://alice.com")[0]),
|
|
oidc.WithSigningAlgs(oidc.RS256),
|
|
oidc.WithApiUrl(oidc.TestConvertToUrls(t, "http://localhost")[0]))
|
|
wantEmail, wantFullName = fmt.Sprintf("%s-%d@example.com", tt.name, i), fmt.Sprintf("%s-%d", tt.name, i)
|
|
aa := oidc.TestAccount(t, conn, authMethod, fmt.Sprintf(tt.name, i), oidc.WithFullName(wantFullName), oidc.WithEmail(wantEmail))
|
|
wantPrimaryAccountId = aa.PublicId
|
|
accountIds = append(accountIds, aa.PublicId)
|
|
default:
|
|
pwAms := password.TestAuthMethods(t, conn, org.PublicId, 1)
|
|
require.Equal(1, len(pwAms))
|
|
pwAcct := password.TestAccount(t, conn, pwAms[0].PublicId, "name1")
|
|
accountIds = append(accountIds, pwAcct.PublicId)
|
|
}
|
|
}
|
|
require.Equal(acctCount, len(accountIds))
|
|
var s *iam.Scope
|
|
s, err = repo.LookupScope(context.Background(), org.PublicId)
|
|
require.NoError(err)
|
|
// we need a primary auth method, so let's just pick the last oidc
|
|
// one created.
|
|
iam.TestSetPrimaryAuthMethod(t, repo, s, authMethod.PublicId)
|
|
|
|
sort.Strings(accountIds)
|
|
if len(accountIds) > 0 {
|
|
newAccts, err := repo.AddUserAccounts(context.Background(), u.PublicId, u.Version, accountIds)
|
|
require.NoError(err)
|
|
sort.Strings(newAccts)
|
|
require.Equal(accountIds, newAccts)
|
|
u.Version++
|
|
}
|
|
// we need to clean out any oplog entries added because we
|
|
// associated accounts to the test user
|
|
_, err = rw.Exec(context.Background(), "delete from oplog_entry", nil)
|
|
require.NoError(err)
|
|
|
|
updateUser := iam.AllocUser()
|
|
updateUser.PublicId = u.PublicId
|
|
if tt.args.PublicId != nil {
|
|
updateUser.PublicId = *tt.args.PublicId
|
|
}
|
|
updateUser.ScopeId = tt.args.ScopeId
|
|
updateUser.Name = tt.args.name
|
|
updateUser.Description = tt.args.description
|
|
|
|
var userAfterUpdate *iam.User
|
|
var acctIdsAfterUpdate []string
|
|
var updatedRows int
|
|
var err error
|
|
userAfterUpdate, acctIdsAfterUpdate, updatedRows, err = repo.UpdateUser(context.Background(), &updateUser, u.Version, tt.args.fieldMaskPaths, tt.args.opt...)
|
|
|
|
if tt.wantErr {
|
|
require.Error(err)
|
|
assert.True(errors.Match(errors.T(tt.wantIsErr), err))
|
|
assert.Nil(userAfterUpdate)
|
|
assert.Equal(0, updatedRows)
|
|
switch tt.name {
|
|
case "dup-name":
|
|
assert.Equal(fmt.Sprintf(tt.wantErrMsg, "dup-name"+id, org.PublicId), err.Error())
|
|
default:
|
|
assert.Containsf(err.Error(), tt.wantErrMsg, "unexpected error: %s", err.Error())
|
|
}
|
|
err = db.TestVerifyOplog(t, rw, u.PublicId, db.WithOperation(oplog.OpType_OP_TYPE_UPDATE), db.WithCreateNotBefore(1*time.Second))
|
|
require.Error(err)
|
|
assert.Contains(err.Error(), "record not found")
|
|
return
|
|
}
|
|
require.NoError(err)
|
|
assert.Equal(tt.wantRowsUpdate, updatedRows)
|
|
assert.NotEqual(u.UpdateTime, userAfterUpdate.UpdateTime)
|
|
sort.Strings(acctIdsAfterUpdate)
|
|
assert.Equal(accountIds, acctIdsAfterUpdate)
|
|
assert.Equal(wantFullName, userAfterUpdate.FullName)
|
|
assert.Equal(wantEmail, userAfterUpdate.Email)
|
|
assert.Equal(wantPrimaryAccountId, userAfterUpdate.PrimaryAccountId)
|
|
|
|
foundUser, foundAccountIds, err := repo.LookupUser(context.Background(), u.PublicId)
|
|
require.NoError(err)
|
|
assert.True(proto.Equal(userAfterUpdate, foundUser))
|
|
sort.Strings(foundAccountIds)
|
|
assert.Equal(accountIds, foundAccountIds)
|
|
underlyingDB, err := conn.SqlDB(ctx)
|
|
require.NoError(err)
|
|
dbassert := dbassert.New(t, underlyingDB)
|
|
if tt.args.name == "" {
|
|
dbassert.IsNull(foundUser, "name")
|
|
}
|
|
if tt.args.description == "" {
|
|
dbassert.IsNull(foundUser, "description")
|
|
}
|
|
|
|
err = db.TestVerifyOplog(t, rw, u.PublicId, db.WithOperation(oplog.OpType_OP_TYPE_UPDATE), db.WithCreateNotBefore(10*time.Second))
|
|
assert.NoError(err)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestRepository_DeleteUser(t *testing.T) {
|
|
t.Parallel()
|
|
conn, _ := db.TestSetup(t, "postgres")
|
|
rw := db.New(conn)
|
|
wrapper := db.TestWrapper(t)
|
|
repo := iam.TestRepo(t, conn, wrapper)
|
|
org, _ := iam.TestScopes(t, repo)
|
|
|
|
type args struct {
|
|
user *iam.User
|
|
opt []iam.Option
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
args args
|
|
wantRowsDeleted int
|
|
wantErr bool
|
|
wantErrMsg string
|
|
}{
|
|
{
|
|
name: "valid",
|
|
args: args{
|
|
user: iam.TestUser(t, repo, org.PublicId),
|
|
},
|
|
wantRowsDeleted: 1,
|
|
wantErr: false,
|
|
},
|
|
{
|
|
name: "no-public-id",
|
|
args: args{
|
|
user: func() *iam.User {
|
|
u := iam.AllocUser()
|
|
return &u
|
|
}(),
|
|
},
|
|
wantRowsDeleted: 0,
|
|
wantErr: true,
|
|
wantErrMsg: "iam.(Repository).DeleteUser: missing public id: parameter violation: error #100",
|
|
},
|
|
{
|
|
name: "not-found",
|
|
args: args{
|
|
user: func() *iam.User {
|
|
u, err := iam.NewUser(org.PublicId)
|
|
require.NoError(t, err)
|
|
id, err := db.NewPublicId(iam.UserPrefix)
|
|
require.NoError(t, err)
|
|
u.PublicId = id
|
|
return u
|
|
}(),
|
|
},
|
|
wantRowsDeleted: 1,
|
|
wantErr: true,
|
|
wantErrMsg: "db.LookupById: record not found, search issue: error #1100",
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
assert, require := assert.New(t), require.New(t)
|
|
deletedRows, err := repo.DeleteUser(context.Background(), tt.args.user.PublicId, tt.args.opt...)
|
|
if tt.wantErr {
|
|
require.Error(err)
|
|
assert.Equal(0, deletedRows)
|
|
assert.Contains(err.Error(), tt.wantErrMsg)
|
|
err = db.TestVerifyOplog(t, rw, tt.args.user.PublicId, db.WithOperation(oplog.OpType_OP_TYPE_DELETE), db.WithCreateNotBefore(10*time.Second))
|
|
require.Error(err)
|
|
assert.Contains(err.Error(), "record not found")
|
|
return
|
|
}
|
|
require.NoError(err)
|
|
assert.Equal(tt.wantRowsDeleted, deletedRows)
|
|
foundUser, _, err := repo.LookupUser(context.Background(), tt.args.user.PublicId)
|
|
require.NoError(err)
|
|
assert.Nil(foundUser)
|
|
|
|
err = db.TestVerifyOplog(t, rw, tt.args.user.PublicId, db.WithOperation(oplog.OpType_OP_TYPE_DELETE), db.WithCreateNotBefore(10*time.Second))
|
|
require.NoError(err)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestRepository_ListUsers(t *testing.T) {
|
|
t.Parallel()
|
|
conn, _ := db.TestSetup(t, "postgres")
|
|
const testLimit = 10
|
|
wrapper := db.TestWrapper(t)
|
|
kmsCache := kms.TestKms(t, conn, wrapper)
|
|
repo := iam.TestRepo(t, conn, wrapper, iam.WithLimit(testLimit))
|
|
org, _ := iam.TestScopes(t, repo)
|
|
databaseWrapper, err := kmsCache.GetWrapper(context.Background(), org.PublicId, kms.KeyPurposeDatabase)
|
|
require.NoError(t, err)
|
|
authMethod := oidc.TestAuthMethod(t, conn, databaseWrapper, org.PublicId, oidc.ActivePrivateState, "alice-rp", "fido",
|
|
oidc.WithIssuer(oidc.TestConvertToUrls(t, "https://alice.com")[0]),
|
|
oidc.WithSigningAlgs(oidc.RS256),
|
|
oidc.WithApiUrl(oidc.TestConvertToUrls(t, "http://localhost")[0]))
|
|
|
|
iam.TestSetPrimaryAuthMethod(t, repo, org, authMethod.PublicId)
|
|
|
|
type args struct {
|
|
withOrgId string
|
|
opt []iam.Option
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
createCnt int
|
|
args args
|
|
wantCnt int
|
|
wantErr bool
|
|
}{
|
|
{
|
|
name: "no-limit",
|
|
createCnt: testLimit + 1,
|
|
args: args{
|
|
withOrgId: org.PublicId,
|
|
opt: []iam.Option{iam.WithLimit(-1)},
|
|
},
|
|
wantCnt: testLimit + 1,
|
|
wantErr: false,
|
|
},
|
|
{
|
|
name: "default-limit",
|
|
createCnt: testLimit + 1,
|
|
args: args{
|
|
withOrgId: org.PublicId,
|
|
},
|
|
wantCnt: testLimit,
|
|
wantErr: false,
|
|
},
|
|
{
|
|
name: "custom-limit",
|
|
createCnt: testLimit + 1,
|
|
args: args{
|
|
withOrgId: org.PublicId,
|
|
opt: []iam.Option{iam.WithLimit(3)},
|
|
},
|
|
wantCnt: 3,
|
|
wantErr: false,
|
|
},
|
|
{
|
|
name: "bad-org",
|
|
createCnt: 1,
|
|
args: args{
|
|
withOrgId: "bad-id",
|
|
},
|
|
wantCnt: 0,
|
|
wantErr: false,
|
|
},
|
|
}
|
|
type userInfo struct {
|
|
email string
|
|
fullName string
|
|
primaryAcctId string
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
assert, require := assert.New(t), require.New(t)
|
|
require.NoError(conn.Where("public_id != 'u_anon' and public_id != 'u_auth' and public_id != 'u_recovery'").Delete(iam.AllocUser()).Error)
|
|
testUsers := []*iam.User{}
|
|
wantUserInfo := map[string]userInfo{}
|
|
for i := 0; i < tt.createCnt; i++ {
|
|
u := iam.TestUser(t, repo, org.PublicId)
|
|
testUsers = append(testUsers, u)
|
|
wantEmail, wantFullName := fmt.Sprintf("%s-%d@example.com", tt.name, i), fmt.Sprintf("%s-%d", tt.name, i)
|
|
a := oidc.TestAccount(t, conn, authMethod, fmt.Sprintf(tt.name, i), oidc.WithFullName(wantFullName), oidc.WithEmail(wantEmail))
|
|
wantUserInfo[u.PublicId] = userInfo{email: wantEmail, fullName: wantFullName, primaryAcctId: a.PublicId}
|
|
_, err := repo.AddUserAccounts(context.Background(), u.PublicId, u.Version, []string{a.PublicId})
|
|
require.NoError(err)
|
|
|
|
pwAms := password.TestAuthMethods(t, conn, org.PublicId, 1)
|
|
require.Equal(1, len(pwAms))
|
|
pwAcct := password.TestAccount(t, conn, pwAms[0].PublicId, "name1")
|
|
_, err = repo.AddUserAccounts(context.Background(), u.PublicId, u.Version+1, []string{pwAcct.PublicId})
|
|
require.NoError(err)
|
|
|
|
}
|
|
assert.Equal(tt.createCnt, len(testUsers))
|
|
got, err := repo.ListUsers(context.Background(), []string{tt.args.withOrgId}, tt.args.opt...)
|
|
if tt.wantErr {
|
|
require.Error(err)
|
|
return
|
|
}
|
|
require.NoError(err)
|
|
assert.Equal(tt.wantCnt, len(got))
|
|
for _, u := range got {
|
|
assert.Equal(wantUserInfo[u.PublicId], userInfo{
|
|
email: u.Email,
|
|
fullName: u.FullName,
|
|
primaryAcctId: u.PrimaryAccountId,
|
|
})
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestRepository_ListUsers_Multiple_Scopes(t *testing.T) {
|
|
t.Parallel()
|
|
conn, _ := db.TestSetup(t, "postgres")
|
|
wrapper := db.TestWrapper(t)
|
|
repo := iam.TestRepo(t, conn, wrapper)
|
|
org, _ := iam.TestScopes(t, repo)
|
|
|
|
require.NoError(t, conn.Where("public_id != 'u_anon' and public_id != 'u_auth' and public_id != 'u_recovery'").Delete(iam.AllocUser()).Error)
|
|
|
|
const numPerScope = 10
|
|
var total int = 3 // anon, auth, recovery
|
|
for i := 0; i < numPerScope; i++ {
|
|
iam.TestUser(t, repo, "global")
|
|
total++
|
|
iam.TestUser(t, repo, org.GetPublicId())
|
|
total++
|
|
}
|
|
|
|
got, err := repo.ListUsers(context.Background(), []string{"global", org.GetPublicId()})
|
|
require.NoError(t, err)
|
|
assert.Equal(t, total, len(got))
|
|
}
|
|
|
|
func TestRepository_LookupUserWithLogin(t *testing.T) {
|
|
t.Parallel()
|
|
ctx := context.Background()
|
|
conn, _ := db.TestSetup(t, "postgres")
|
|
rw := db.New(conn)
|
|
wrapper := db.TestWrapper(t)
|
|
kmsCache := kms.TestKms(t, conn, wrapper)
|
|
repo := iam.TestRepo(t, conn, wrapper)
|
|
|
|
id := testId(t)
|
|
org, _ := iam.TestScopes(t, repo)
|
|
databaseWrapper, err := kmsCache.GetWrapper(context.Background(), org.PublicId, kms.KeyPurposeDatabase)
|
|
require.NoError(t, err)
|
|
authMethod := oidc.TestAuthMethod(t, conn, databaseWrapper, org.PublicId, oidc.ActivePrivateState, "alice-rp", "fido",
|
|
oidc.WithIssuer(oidc.TestConvertToUrls(t, "https://alice.com")[0]),
|
|
oidc.WithSigningAlgs(oidc.RS256),
|
|
oidc.WithApiUrl(oidc.TestConvertToUrls(t, "http://localhost")[0]))
|
|
|
|
iam.TestSetPrimaryAuthMethod(t, repo, org, authMethod.PublicId)
|
|
|
|
// an account with no assoc user to test auto-vivify for the primary auth method.
|
|
newAuthAcct := oidc.TestAccount(t, conn, authMethod, "acct-1", oidc.WithFullName("acct-1"), oidc.WithEmail("acct-1@example.com"))
|
|
|
|
// a 2nd auth method which will NOT be the primary auth method
|
|
authMethod2 := oidc.TestAuthMethod(t, conn, databaseWrapper, org.PublicId, oidc.ActivePrivateState, "alice-rp-2", "fido",
|
|
oidc.WithIssuer(oidc.TestConvertToUrls(t, "https://alice.com")[0]),
|
|
oidc.WithSigningAlgs(oidc.RS256),
|
|
oidc.WithApiUrl(oidc.TestConvertToUrls(t, "http://localhost")[0]))
|
|
|
|
// an account with no assoc user to test non-primary auth methods do not auto-vivify
|
|
newAuthAcctWithoutVivify := oidc.TestAccount(t, conn, authMethod2, "acct-2", oidc.WithFullName("acct-2"), oidc.WithEmail("acct-2@example.com"))
|
|
|
|
user := iam.TestUser(t, repo, org.PublicId, iam.WithName("existing-"+id))
|
|
existingUserWithAcctWithVivify := oidc.TestAccount(t, conn, authMethod, "acct-3", oidc.WithFullName("acct-3"), oidc.WithEmail("acct-3@example.com"))
|
|
added, err := repo.AddUserAccounts(context.Background(), user.PublicId, user.Version, []string{existingUserWithAcctWithVivify.PublicId})
|
|
require.NoError(t, err)
|
|
require.Equal(t, 1, len(added))
|
|
foundAcct := allocAuthAccount()
|
|
foundAcct.PublicId = existingUserWithAcctWithVivify.PublicId
|
|
require.NoError(t, rw.LookupById(context.Background(), &foundAcct))
|
|
require.Equal(t, user.PublicId, foundAcct.IamUserId)
|
|
|
|
// we need to set these primary acct values on the user, so the test
|
|
// comparisons will work properly.
|
|
user.LoginName = "acct-3"
|
|
user.FullName = "acct-3"
|
|
user.Email = "acct-3@example.com"
|
|
|
|
existingUserWithAcctNoVivify := oidc.TestAccount(t, conn, authMethod2, "acct-4", oidc.WithFullName("acct-4"), oidc.WithEmail("acct-4@example.com"))
|
|
user, _, err = repo.LookupUser(context.Background(), user.PublicId)
|
|
require.NoError(t, err)
|
|
added, err = repo.AddUserAccounts(context.Background(), user.PublicId, user.Version, []string{existingUserWithAcctNoVivify.PublicId})
|
|
require.NoError(t, err)
|
|
require.Equal(t, 2, len(added))
|
|
foundAcct.PublicId = existingUserWithAcctNoVivify.PublicId
|
|
require.NoError(t, rw.LookupById(context.Background(), &foundAcct, db.WithWhere("iam_user_id = ?", user.PublicId)))
|
|
require.Equal(t, user.PublicId, foundAcct.IamUserId)
|
|
|
|
type args struct {
|
|
withAccountId string
|
|
opt []iam.Option
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
args args
|
|
wantName string
|
|
wantDescription string
|
|
wantErr bool
|
|
wantErrIs errors.Code
|
|
wantUser *iam.User
|
|
}{
|
|
{
|
|
name: "valid",
|
|
args: args{
|
|
withAccountId: newAuthAcct.PublicId,
|
|
opt: []iam.Option{
|
|
iam.WithName("valid-" + id),
|
|
iam.WithDescription("valid-" + id),
|
|
},
|
|
},
|
|
wantName: "valid-" + id,
|
|
wantDescription: "valid-" + id,
|
|
wantErr: false,
|
|
},
|
|
{
|
|
name: "new-acct-without-vivify",
|
|
args: args{
|
|
withAccountId: newAuthAcctWithoutVivify.PublicId,
|
|
},
|
|
wantErr: true,
|
|
wantErrIs: errors.RecordNotFound,
|
|
},
|
|
{
|
|
name: "missing auth acct id",
|
|
args: args{
|
|
withAccountId: "",
|
|
},
|
|
wantErr: true,
|
|
wantErrIs: errors.InvalidParameter,
|
|
},
|
|
{
|
|
name: "existing-user-with-account-with-vivify",
|
|
args: args{
|
|
withAccountId: existingUserWithAcctWithVivify.PublicId,
|
|
},
|
|
wantErr: false,
|
|
wantName: "existing-" + id,
|
|
wantUser: user,
|
|
},
|
|
{
|
|
name: "existing-user-with-account-no-vivify",
|
|
args: args{
|
|
withAccountId: existingUserWithAcctNoVivify.PublicId,
|
|
opt: []iam.Option{},
|
|
},
|
|
wantErr: false,
|
|
wantName: "existing-" + id,
|
|
wantUser: user,
|
|
},
|
|
{
|
|
name: "bad-auth-account-id",
|
|
args: args{
|
|
withAccountId: id,
|
|
},
|
|
wantErr: true,
|
|
wantErrIs: errors.RecordNotFound,
|
|
},
|
|
{
|
|
name: "bad-auth-account-id-with-vivify",
|
|
args: args{
|
|
withAccountId: id,
|
|
opt: []iam.Option{},
|
|
},
|
|
wantErr: true,
|
|
wantErrIs: errors.RecordNotFound,
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
assert, require := assert.New(t), require.New(t)
|
|
underlyingDB, err := conn.SqlDB(ctx)
|
|
require.NoError(err)
|
|
dbassert := dbassert.New(t, underlyingDB)
|
|
got, err := repo.LookupUserWithLogin(context.Background(), tt.args.withAccountId, tt.args.opt...)
|
|
if tt.wantErr {
|
|
require.Error(err)
|
|
assert.Nil(got)
|
|
assert.Truef(errors.Match(errors.T(tt.wantErrIs), err), "unexpected error %s", err.Error())
|
|
if tt.args.withAccountId != "" && tt.args.withAccountId != id {
|
|
// need to assert that userid in auth_account is still null
|
|
acct := allocAuthAccount()
|
|
acct.PublicId = tt.args.withAccountId
|
|
dbassert.IsNull(&acct, "IamUserId")
|
|
}
|
|
return
|
|
}
|
|
require.NoError(err)
|
|
if tt.wantName != "" {
|
|
assert.Equal(tt.wantName, got.Name)
|
|
}
|
|
if tt.wantDescription != "" {
|
|
assert.Equal(tt.wantDescription, got.Description)
|
|
}
|
|
require.NotEmpty(got.PublicId)
|
|
if tt.wantUser != nil {
|
|
tt.wantUser.Version = got.User.Version
|
|
tt.wantUser.CreateTime = got.User.CreateTime
|
|
tt.wantUser.UpdateTime = got.User.UpdateTime
|
|
assert.Empty(cmp.Diff(got.User, tt.wantUser.User, protocmp.Transform()), "got %q, wanted %q", got.User, tt.wantUser.User)
|
|
}
|
|
acct := allocAuthAccount()
|
|
acct.PublicId = tt.args.withAccountId
|
|
err = rw.LookupByPublicId(context.Background(), &acct)
|
|
require.NoError(err)
|
|
assert.Equal(got.PublicId, acct.IamUserId)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestRepository_AssociateAccounts(t *testing.T) {
|
|
t.Parallel()
|
|
conn, _ := db.TestSetup(t, "postgres")
|
|
rw := db.New(conn)
|
|
wrapper := db.TestWrapper(t)
|
|
kmsCache := kms.TestKms(t, conn, wrapper)
|
|
repo := iam.TestRepo(t, conn, wrapper)
|
|
org, _ := iam.TestScopes(t, repo)
|
|
databaseWrapper, err := kmsCache.GetWrapper(context.Background(), org.PublicId, kms.KeyPurposeDatabase)
|
|
require.NoError(t, err)
|
|
|
|
user := iam.TestUser(t, repo, org.PublicId)
|
|
|
|
createAccountsFn := func(prefix string) []string {
|
|
require.NoError(t, conn.Where("iam_user_id = ?", user.PublicId).Delete(allocAuthAccount()).Error)
|
|
results := []string{}
|
|
for i := 0; i < 5; i++ {
|
|
authMethod := oidc.TestAuthMethod(t, conn, databaseWrapper, org.PublicId, oidc.ActivePrivateState, fmt.Sprintf("%s-alice-rp-%d", prefix, i), "fido",
|
|
oidc.WithIssuer(oidc.TestConvertToUrls(t, "https://alice.com")[0]),
|
|
oidc.WithSigningAlgs(oidc.RS256),
|
|
oidc.WithApiUrl(oidc.TestConvertToUrls(t, "http://localhost")[0]))
|
|
|
|
a := oidc.TestAccount(t, conn, authMethod, fmt.Sprintf("acct-%d", i))
|
|
results = append(results, a.PublicId)
|
|
}
|
|
return results
|
|
}
|
|
type args struct {
|
|
accountIdsFn func() []string
|
|
userId string
|
|
userVersionOverride *uint32
|
|
opt []iam.Option
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
args args
|
|
wantErr bool
|
|
wantErrCode errors.Code
|
|
}{
|
|
{
|
|
name: "valid",
|
|
args: args{
|
|
userId: user.PublicId,
|
|
accountIdsFn: func() []string { return createAccountsFn("valid") },
|
|
},
|
|
wantErr: false,
|
|
},
|
|
{
|
|
name: "already-associated",
|
|
args: args{
|
|
userId: user.PublicId,
|
|
accountIdsFn: func() []string {
|
|
ids := createAccountsFn("already-associated")
|
|
authMethod := oidc.TestAuthMethod(t, conn, databaseWrapper, org.PublicId, oidc.ActivePrivateState, "already-associated-alice-rp", "fido",
|
|
oidc.WithIssuer(oidc.TestConvertToUrls(t, "https://alice.com")[0]),
|
|
oidc.WithSigningAlgs(oidc.RS256),
|
|
oidc.WithApiUrl(oidc.TestConvertToUrls(t, "http://localhost")[0]))
|
|
a := oidc.TestAccount(t, conn, authMethod, "already-associated")
|
|
user, _, err := repo.LookupUser(context.Background(), user.PublicId)
|
|
require.NoError(t, err)
|
|
added, err := repo.AddUserAccounts(context.Background(), user.PublicId, user.Version, []string{a.PublicId})
|
|
require.NoError(t, err)
|
|
require.Contains(t, added, a.PublicId)
|
|
ids = append(ids, a.PublicId)
|
|
return ids
|
|
},
|
|
},
|
|
wantErr: false,
|
|
},
|
|
{
|
|
name: "associated-with-diff-user",
|
|
args: args{
|
|
userId: user.PublicId,
|
|
accountIdsFn: func() []string {
|
|
ids := createAccountsFn("associated-with-diff-user")
|
|
authMethod := oidc.TestAuthMethod(t, conn, databaseWrapper, org.PublicId, oidc.ActivePrivateState, "associated-with-diff-user-alice-rp", "fido",
|
|
oidc.WithIssuer(oidc.TestConvertToUrls(t, "https://alice.com")[0]),
|
|
oidc.WithSigningAlgs(oidc.RS256),
|
|
oidc.WithApiUrl(oidc.TestConvertToUrls(t, "http://localhost")[0]))
|
|
u := iam.TestUser(t, repo, org.PublicId)
|
|
a := oidc.TestAccount(t, conn, authMethod, "already-associated")
|
|
added, err := repo.AddUserAccounts(context.Background(), u.PublicId, u.Version, []string{a.PublicId})
|
|
require.NoError(t, err)
|
|
require.Contains(t, added, a.PublicId)
|
|
ids = append(ids, a.PublicId)
|
|
return ids
|
|
},
|
|
},
|
|
wantErr: true,
|
|
wantErrCode: errors.AccountAlreadyAssociated,
|
|
},
|
|
{
|
|
name: "bad-version",
|
|
args: args{
|
|
userVersionOverride: func() *uint32 {
|
|
i := uint32(22)
|
|
return &i
|
|
}(),
|
|
userId: user.PublicId,
|
|
accountIdsFn: func() []string { return createAccountsFn("bad-version") },
|
|
},
|
|
wantErr: true,
|
|
wantErrCode: errors.MultipleRecords,
|
|
},
|
|
{
|
|
name: "zero-version",
|
|
args: args{
|
|
userVersionOverride: func() *uint32 {
|
|
i := uint32(0)
|
|
return &i
|
|
}(),
|
|
userId: user.PublicId,
|
|
accountIdsFn: func() []string { return createAccountsFn("zero-version") },
|
|
},
|
|
wantErr: true,
|
|
wantErrCode: errors.InvalidParameter,
|
|
},
|
|
{
|
|
name: "no-accounts",
|
|
args: args{
|
|
userId: user.PublicId,
|
|
accountIdsFn: func() []string { return nil },
|
|
},
|
|
wantErr: true,
|
|
wantErrCode: errors.InvalidParameter,
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
assert, require := assert.New(t), require.New(t)
|
|
accountIds := tt.args.accountIdsFn()
|
|
sort.Strings(accountIds)
|
|
|
|
origUser, _, err := repo.LookupUser(context.Background(), user.PublicId)
|
|
require.NoError(err)
|
|
|
|
version := origUser.Version
|
|
if tt.args.userVersionOverride != nil {
|
|
version = *tt.args.userVersionOverride
|
|
}
|
|
|
|
got, err := repo.AddUserAccounts(context.Background(), tt.args.userId, version, accountIds, tt.args.opt...)
|
|
if tt.wantErr {
|
|
require.Error(err)
|
|
assert.Truef(errors.Match(errors.T(tt.wantErrCode), err), "unexpected error %s", err)
|
|
return
|
|
}
|
|
require.NoError(err)
|
|
err = db.TestVerifyOplog(t, rw, tt.args.userId, db.WithOperation(oplog.OpType_OP_TYPE_UPDATE), db.WithCreateNotBefore(10*time.Second))
|
|
assert.NoError(err)
|
|
for _, id := range got {
|
|
err = db.TestVerifyOplog(t, rw, id, db.WithOperation(oplog.OpType_OP_TYPE_UPDATE), db.WithCreateNotBefore(10*time.Second))
|
|
assert.NoError(err)
|
|
}
|
|
|
|
sort.Strings(got)
|
|
assert.Equal(accountIds, got)
|
|
|
|
foundIds, err := repo.ListUserAccounts(context.Background(), tt.args.userId)
|
|
require.NoError(err)
|
|
sort.Strings(foundIds)
|
|
assert.Equal(accountIds, foundIds)
|
|
|
|
u, _, err := repo.LookupUser(context.Background(), tt.args.userId)
|
|
require.NoError(err)
|
|
assert.Equal(version+1, u.Version)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestRepository_DisassociateAccounts(t *testing.T) {
|
|
t.Parallel()
|
|
conn, _ := db.TestSetup(t, "postgres")
|
|
rw := db.New(conn)
|
|
wrapper := db.TestWrapper(t)
|
|
kmsCache := kms.TestKms(t, conn, wrapper)
|
|
repo := iam.TestRepo(t, conn, wrapper)
|
|
org, _ := iam.TestScopes(t, repo)
|
|
databaseWrapper, err := kmsCache.GetWrapper(context.Background(), org.PublicId, kms.KeyPurposeDatabase)
|
|
require.NoError(t, err)
|
|
|
|
user := iam.TestUser(t, repo, org.PublicId)
|
|
|
|
createAccountsFn := func(prefix string) []string {
|
|
require.NoError(t, conn.Where("iam_user_id = ?", user.PublicId).Delete(allocAuthAccount()).Error)
|
|
results := []string{}
|
|
for i := 0; i < 1; i++ {
|
|
authMethod := oidc.TestAuthMethod(t, conn, databaseWrapper, org.PublicId, oidc.ActivePrivateState, fmt.Sprintf("%s-alice-rp-%d", prefix, i), "fido",
|
|
oidc.WithIssuer(oidc.TestConvertToUrls(t, "https://alice.com")[0]),
|
|
oidc.WithSigningAlgs(oidc.RS256),
|
|
oidc.WithApiUrl(oidc.TestConvertToUrls(t, "http://localhost")[0]))
|
|
a := oidc.TestAccount(t, conn, authMethod, fmt.Sprintf("acct-%d", i))
|
|
user, _, err := repo.LookupUser(context.Background(), user.PublicId)
|
|
require.NoError(t, err)
|
|
added, err := repo.AddUserAccounts(context.Background(), user.PublicId, user.Version, []string{a.PublicId})
|
|
require.NoError(t, err)
|
|
require.Contains(t, added, a.PublicId)
|
|
results = append(results, a.PublicId)
|
|
}
|
|
return results
|
|
}
|
|
type args struct {
|
|
accountIdsFn func() []string
|
|
userId string
|
|
userVersionOverride *uint32
|
|
opt []iam.Option
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
args args
|
|
wantErr bool
|
|
wantErrCode errors.Code
|
|
}{
|
|
{
|
|
name: "valid",
|
|
args: args{
|
|
userId: user.PublicId,
|
|
accountIdsFn: func() []string { return createAccountsFn("valid") },
|
|
},
|
|
wantErr: false,
|
|
},
|
|
{
|
|
name: "associated-with-diff-user",
|
|
args: args{
|
|
userId: user.PublicId,
|
|
accountIdsFn: func() []string {
|
|
ids := createAccountsFn("associated-with-diff-user")
|
|
authMethod := oidc.TestAuthMethod(t, conn, databaseWrapper, org.PublicId, oidc.ActivePrivateState, "associated-with-diff-user-alice-rp", "fido",
|
|
oidc.WithIssuer(oidc.TestConvertToUrls(t, "https://alice.com")[0]),
|
|
oidc.WithSigningAlgs(oidc.RS256),
|
|
oidc.WithApiUrl(oidc.TestConvertToUrls(t, "http://localhost")[0]))
|
|
u := iam.TestUser(t, repo, org.PublicId)
|
|
a := oidc.TestAccount(t, conn, authMethod, "already-associated")
|
|
added, err := repo.AddUserAccounts(context.Background(), u.PublicId, u.Version, []string{a.PublicId})
|
|
require.NoError(t, err)
|
|
require.Contains(t, added, a.PublicId)
|
|
ids = append(ids, a.PublicId)
|
|
return ids
|
|
},
|
|
},
|
|
wantErr: true,
|
|
wantErrCode: errors.AccountAlreadyAssociated,
|
|
},
|
|
{
|
|
name: "bad-version",
|
|
args: args{
|
|
userVersionOverride: func() *uint32 {
|
|
i := uint32(22)
|
|
return &i
|
|
}(),
|
|
userId: user.PublicId,
|
|
accountIdsFn: func() []string { return createAccountsFn("bad-version") },
|
|
},
|
|
wantErr: true,
|
|
wantErrCode: errors.MultipleRecords,
|
|
},
|
|
{
|
|
name: "zero-version",
|
|
args: args{
|
|
userVersionOverride: func() *uint32 {
|
|
i := uint32(0)
|
|
return &i
|
|
}(),
|
|
userId: user.PublicId,
|
|
accountIdsFn: func() []string { return createAccountsFn("zero-version") },
|
|
},
|
|
wantErr: true,
|
|
wantErrCode: errors.InvalidParameter,
|
|
},
|
|
{
|
|
name: "no-accounts",
|
|
args: args{
|
|
userId: user.PublicId,
|
|
accountIdsFn: func() []string { return nil },
|
|
},
|
|
wantErr: true,
|
|
wantErrCode: errors.InvalidParameter,
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
assert, require := assert.New(t), require.New(t)
|
|
accountIds := tt.args.accountIdsFn()
|
|
|
|
origUser, _, err := repo.LookupUser(context.Background(), user.PublicId)
|
|
require.NoError(err)
|
|
|
|
version := origUser.Version
|
|
if tt.args.userVersionOverride != nil {
|
|
version = *tt.args.userVersionOverride
|
|
}
|
|
|
|
got, err := repo.DeleteUserAccounts(context.Background(), tt.args.userId, version, accountIds, tt.args.opt...)
|
|
if tt.wantErr {
|
|
require.Error(err)
|
|
assert.Truef(errors.Match(errors.T(tt.wantErrCode), err), "unexpected error %s", err)
|
|
return
|
|
}
|
|
require.NoError(err)
|
|
err = db.TestVerifyOplog(t, rw, tt.args.userId, db.WithOperation(oplog.OpType_OP_TYPE_UPDATE), db.WithCreateNotBefore(10*time.Second))
|
|
assert.NoError(err)
|
|
for _, id := range got {
|
|
err = db.TestVerifyOplog(t, rw, id, db.WithOperation(oplog.OpType_OP_TYPE_UPDATE), db.WithCreateNotBefore(10*time.Second))
|
|
assert.NoError(err)
|
|
}
|
|
foundIds, err := repo.ListUserAccounts(context.Background(), tt.args.userId)
|
|
require.NoError(err)
|
|
for _, id := range accountIds {
|
|
assert.True(!strutil.StrListContains(foundIds, id))
|
|
}
|
|
|
|
u, _, err := repo.LookupUser(context.Background(), tt.args.userId)
|
|
require.NoError(err)
|
|
assert.Equal(version+1, u.Version)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestRepository_SetAssociatedAccounts(t *testing.T) {
|
|
t.Parallel()
|
|
conn, _ := db.TestSetup(t, "postgres")
|
|
rw := db.New(conn)
|
|
wrapper := db.TestWrapper(t)
|
|
kmsCache := kms.TestKms(t, conn, wrapper)
|
|
repo := iam.TestRepo(t, conn, wrapper)
|
|
org, _ := iam.TestScopes(t, repo)
|
|
databaseWrapper, err := kmsCache.GetWrapper(context.Background(), org.PublicId, kms.KeyPurposeDatabase)
|
|
require.NoError(t, err)
|
|
|
|
user := iam.TestUser(t, repo, org.PublicId)
|
|
|
|
createAccountsFn := func(prefix string) []string {
|
|
require.NoError(t, conn.Where("iam_user_id = ?", user.PublicId).Delete(allocAuthAccount()).Error)
|
|
results := []string{}
|
|
for i := 0; i < 1; i++ {
|
|
authMethod := oidc.TestAuthMethod(t, conn, databaseWrapper, org.PublicId, oidc.ActivePrivateState, fmt.Sprintf("%s-alice-rp-%d", prefix, i), "fido",
|
|
oidc.WithIssuer(oidc.TestConvertToUrls(t, "https://alice.com")[0]),
|
|
oidc.WithSigningAlgs(oidc.RS256),
|
|
oidc.WithApiUrl(oidc.TestConvertToUrls(t, "http://localhost")[0]))
|
|
a := oidc.TestAccount(t, conn, authMethod, fmt.Sprintf("acct-%d", i))
|
|
results = append(results, a.PublicId)
|
|
}
|
|
return results
|
|
}
|
|
type args struct {
|
|
accountIdsFn func() ([]string, []string)
|
|
userId string
|
|
userVersionOverride *uint32
|
|
opt []iam.Option
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
args args
|
|
wantErr bool
|
|
wantErrCode errors.Code
|
|
}{
|
|
{
|
|
name: "valid",
|
|
args: args{
|
|
userId: user.PublicId,
|
|
accountIdsFn: func() ([]string, []string) {
|
|
ids := createAccountsFn("valid")
|
|
return ids, ids
|
|
},
|
|
},
|
|
wantErr: false,
|
|
},
|
|
{
|
|
name: "one-already-associated",
|
|
args: args{
|
|
userId: user.PublicId,
|
|
accountIdsFn: func() ([]string, []string) {
|
|
ids := createAccountsFn("one-already-associated")
|
|
changes := append([]string{}, ids...)
|
|
authMethod := oidc.TestAuthMethod(t, conn, databaseWrapper, org.PublicId, oidc.ActivePrivateState, "one-already-associated-alice-rp", "fido",
|
|
oidc.WithIssuer(oidc.TestConvertToUrls(t, "https://alice.com")[0]),
|
|
oidc.WithSigningAlgs(oidc.RS256),
|
|
oidc.WithApiUrl(oidc.TestConvertToUrls(t, "http://localhost")[0]))
|
|
a := oidc.TestAccount(t, conn, authMethod, "acct-one-already-associated")
|
|
user, _, err := repo.LookupUser(context.Background(), user.PublicId)
|
|
require.NoError(t, err)
|
|
added, err := repo.AddUserAccounts(context.Background(), user.PublicId, user.Version, []string{a.PublicId})
|
|
require.NoError(t, err)
|
|
require.Contains(t, added, a.PublicId)
|
|
ids = append(ids, a.PublicId)
|
|
return ids, changes
|
|
},
|
|
},
|
|
wantErr: false,
|
|
},
|
|
{
|
|
name: "no-change",
|
|
args: args{
|
|
userId: user.PublicId,
|
|
accountIdsFn: func() ([]string, []string) {
|
|
ids := createAccountsFn("no-change")
|
|
user, _, err := repo.LookupUser(context.Background(), user.PublicId)
|
|
require.NoError(t, err)
|
|
added, err := repo.AddUserAccounts(context.Background(), user.PublicId, user.Version, ids)
|
|
require.NoError(t, err)
|
|
require.Equal(t, len(ids), len(added))
|
|
|
|
// ids := []string{}
|
|
// for i := 0; i < 10; i++ {
|
|
// a := testAccount(t, conn, org.PublicId, authMethodId, user.PublicId)
|
|
// ids = append(ids, a.PublicId)
|
|
// }
|
|
return ids, nil
|
|
},
|
|
},
|
|
wantErr: false,
|
|
},
|
|
{
|
|
name: "remove-all",
|
|
args: args{
|
|
userId: user.PublicId,
|
|
accountIdsFn: func() ([]string, []string) {
|
|
ids := createAccountsFn("remove-all")
|
|
user, _, err := repo.LookupUser(context.Background(), user.PublicId)
|
|
require.NoError(t, err)
|
|
added, err := repo.AddUserAccounts(context.Background(), user.PublicId, user.Version, ids)
|
|
require.NoError(t, err)
|
|
require.Equal(t, len(ids), len(added))
|
|
return nil, ids
|
|
},
|
|
},
|
|
wantErr: false,
|
|
},
|
|
{
|
|
name: "associated-with-diff-user",
|
|
args: args{
|
|
userId: user.PublicId,
|
|
accountIdsFn: func() ([]string, []string) {
|
|
ids := createAccountsFn("associated-with-diff-user")
|
|
authMethod := oidc.TestAuthMethod(t, conn, databaseWrapper, org.PublicId, oidc.ActivePrivateState, "associated-with-diff-user-alice-rp", "fido",
|
|
oidc.WithIssuer(oidc.TestConvertToUrls(t, "https://alice.com")[0]),
|
|
oidc.WithSigningAlgs(oidc.RS256),
|
|
oidc.WithApiUrl(oidc.TestConvertToUrls(t, "http://localhost")[0]))
|
|
u := iam.TestUser(t, repo, org.PublicId)
|
|
a := oidc.TestAccount(t, conn, authMethod, "already-associated")
|
|
added, err := repo.AddUserAccounts(context.Background(), u.PublicId, u.Version, []string{a.PublicId})
|
|
require.NoError(t, err)
|
|
require.Contains(t, added, a.PublicId)
|
|
ids = append(ids, a.PublicId)
|
|
return ids, ids
|
|
},
|
|
},
|
|
wantErr: true,
|
|
wantErrCode: errors.AccountAlreadyAssociated,
|
|
},
|
|
{
|
|
name: "bad-version",
|
|
args: args{
|
|
userVersionOverride: func() *uint32 {
|
|
i := uint32(22)
|
|
return &i
|
|
}(),
|
|
userId: user.PublicId,
|
|
accountIdsFn: func() ([]string, []string) {
|
|
ids := createAccountsFn("bad-version")
|
|
return ids, ids
|
|
},
|
|
},
|
|
wantErr: true,
|
|
wantErrCode: errors.MultipleRecords,
|
|
},
|
|
{
|
|
name: "zero-version",
|
|
args: args{
|
|
userVersionOverride: func() *uint32 {
|
|
i := uint32(0)
|
|
return &i
|
|
}(),
|
|
userId: user.PublicId,
|
|
accountIdsFn: func() ([]string, []string) {
|
|
ids := createAccountsFn("zero-version")
|
|
return ids, ids
|
|
},
|
|
},
|
|
wantErr: true,
|
|
wantErrCode: errors.InvalidParameter,
|
|
},
|
|
{
|
|
name: "no-accounts-no-changes",
|
|
args: args{
|
|
userId: user.PublicId,
|
|
accountIdsFn: func() ([]string, []string) { return nil, nil },
|
|
},
|
|
wantErr: false,
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
assert, require := assert.New(t), require.New(t)
|
|
require.NoError(conn.Where("iam_user_id = ?", user.PublicId).Delete(allocAuthAccount()).Error)
|
|
|
|
accountIds, changes := tt.args.accountIdsFn()
|
|
sort.Strings(accountIds)
|
|
|
|
origUser, _, err := repo.LookupUser(context.Background(), user.PublicId)
|
|
require.NoError(err)
|
|
|
|
version := origUser.Version
|
|
if tt.args.userVersionOverride != nil {
|
|
version = *tt.args.userVersionOverride
|
|
}
|
|
|
|
got, err := repo.SetUserAccounts(context.Background(), tt.args.userId, version, accountIds, tt.args.opt...)
|
|
if tt.wantErr {
|
|
require.Error(err)
|
|
assert.Truef(errors.Match(errors.T(tt.wantErrCode), err), "unexpected error %s", err)
|
|
return
|
|
}
|
|
require.NoError(err)
|
|
if len(changes) != 0 {
|
|
err = db.TestVerifyOplog(t, rw, tt.args.userId, db.WithOperation(oplog.OpType_OP_TYPE_UPDATE), db.WithCreateNotBefore(10*time.Second))
|
|
assert.NoError(err)
|
|
for _, id := range changes {
|
|
err = db.TestVerifyOplog(t, rw, id, db.WithOperation(oplog.OpType_OP_TYPE_UPDATE), db.WithCreateNotBefore(10*time.Second))
|
|
assert.NoErrorf(err, "%s missing oplog entry", id)
|
|
}
|
|
}
|
|
|
|
sort.Strings(got)
|
|
assert.Equal(accountIds, got)
|
|
|
|
foundIds, err := repo.ListUserAccounts(context.Background(), tt.args.userId)
|
|
require.NoError(err)
|
|
sort.Strings(foundIds)
|
|
assert.Equal(accountIds, foundIds)
|
|
|
|
u, _, err := repo.LookupUser(context.Background(), tt.args.userId)
|
|
require.NoError(err)
|
|
switch tt.name {
|
|
case "no-accounts-no-changes", "no-change":
|
|
assert.Equalf(version, u.Version, "expected version %d and got: %d", version, u.Version)
|
|
default:
|
|
assert.Equalf(version+1, u.Version, "expected version %d and got: %d", version+1, u.Version)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func testId(t *testing.T) string {
|
|
t.Helper()
|
|
id, err := uuid.GenerateUUID()
|
|
require.NoError(t, err)
|
|
return id
|
|
}
|
|
|
|
type testAuthAccount struct {
|
|
*store.Account
|
|
tableName string `gorm:"-"`
|
|
}
|
|
|
|
func allocAuthAccount() testAuthAccount {
|
|
return testAuthAccount{
|
|
Account: &store.Account{},
|
|
}
|
|
}
|
|
|
|
// TableName returns the tablename to override the default gorm table name.
|
|
func (a *testAuthAccount) TableName() string {
|
|
if a.tableName != "" {
|
|
return a.tableName
|
|
}
|
|
return "auth_account"
|
|
}
|