http: GET /auth/oidc/callback — JIT-provision, refresh, deny paths

2026-05-05 13:30:00 +01:00
parent f56844b5c6
commit c55a75355a
3 changed files with 287 additions and 1 deletions
@@ -3,7 +3,9 @@ package http
 import (
 	"context"
 	stdhttp "net/http"
+	"net/http/cookiejar"
 	"net/http/httptest"
+	"net/url"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -84,3 +86,117 @@ func TestOIDCLoginRedirectsToIdP(t *testing.T) {
 	}
 	_ = srv
 }
+
+// runCallback drives the auth code flow against the stub: kicks off
+// /auth/oidc/login (capturing the state), mints a code at the stub
+// with the given claims, then GETs /auth/oidc/callback. Returns the
+// final response.
+func runCallback(t *testing.T, ts *httptest.Server, stub *oidctest.StubIdP, claims map[string]any) *stdhttp.Response {
+	t.Helper()
+	jar, _ := cookiejar.New(nil)
+	c := &stdhttp.Client{Jar: jar, CheckRedirect: func(*stdhttp.Request, []*stdhttp.Request) error {
+		return stdhttp.ErrUseLastResponse
+	}}
+	res, err := c.Get(ts.URL + "/auth/oidc/login")
+	if err != nil {
+		t.Fatalf("login: %v", err)
+	}
+	res.Body.Close()
+	authURL, _ := url.Parse(res.Header.Get("Location"))
+	state := authURL.Query().Get("state")
+
+	code := stub.MintCode(claims)
+	res, err = c.Get(ts.URL + "/auth/oidc/callback?code=" + code + "&state=" + state)
+	if err != nil {
+		t.Fatalf("callback: %v", err)
+	}
+	return res
+}
+
+func TestOIDCCallbackHappyPathAdmin(t *testing.T) {
+	t.Parallel()
+	srv, ts, stub := newTestServerWithOIDC(t)
+	res := runCallback(t, ts, stub, map[string]any{
+		"sub":                "admin-sub",
+		"preferred_username": "alice",
+		"email":              "alice@example.com",
+		"groups":             []string{"rm-admins"},
+		"aud":                "test-client",
+	})
+	defer res.Body.Close()
+	if res.StatusCode != stdhttp.StatusSeeOther || res.Header.Get("Location") != "/" {
+		t.Errorf("status: %d Location: %q", res.StatusCode, res.Header.Get("Location"))
+	}
+	u, err := srv.deps.Store.GetUserByOIDCSubject(t.Context(), "admin-sub")
+	if err != nil || u.AuthSource != "oidc" || u.Role != "admin" || u.Username != "alice" {
+		t.Errorf("user: %+v err: %v", u, err)
+	}
+}
+
+func TestOIDCCallbackNoRoleMatchDeny(t *testing.T) {
+	t.Parallel()
+	_, ts, stub := newTestServerWithOIDC(t)
+	res := runCallback(t, ts, stub, map[string]any{
+		"sub":                "other-sub",
+		"preferred_username": "bob",
+		"groups":             []string{"something-else"},
+		"aud":                "test-client",
+	})
+	defer res.Body.Close()
+	if res.StatusCode != stdhttp.StatusSeeOther {
+		t.Errorf("status: got %d want 303", res.StatusCode)
+	}
+	loc := res.Header.Get("Location")
+	if !strings.Contains(loc, "oidc_error=no_role_match") {
+		t.Errorf("location: %q", loc)
+	}
+}
+
+func TestOIDCCallbackUsernameCollision(t *testing.T) {
+	t.Parallel()
+	srv, ts, stub := newTestServerWithOIDC(t)
+	if err := srv.deps.Store.CreateUser(t.Context(), store.User{
+		ID: "local-alice", Username: "alice", PasswordHash: "x",
+		Role: store.RoleViewer, CreatedAt: time.Now().UTC(),
+	}); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+
+	res := runCallback(t, ts, stub, map[string]any{
+		"sub":                "remote-sub",
+		"preferred_username": "alice",
+		"groups":             []string{"rm-admins"},
+		"aud":                "test-client",
+	})
+	defer res.Body.Close()
+	loc := res.Header.Get("Location")
+	if !strings.Contains(loc, "oidc_error=username_taken") {
+		t.Errorf("location: %q", loc)
+	}
+	if _, err := srv.deps.Store.GetUserByOIDCSubject(t.Context(), "remote-sub"); err == nil {
+		t.Error("collision should not have provisioned a user")
+	}
+}
+
+func TestOIDCCallbackReturningUserRefreshesRole(t *testing.T) {
+	t.Parallel()
+	srv, ts, stub := newTestServerWithOIDC(t)
+	res := runCallback(t, ts, stub, map[string]any{
+		"sub":                "carol-sub",
+		"preferred_username": "carol",
+		"groups":             []string{"rm-operators"},
+		"aud":                "test-client",
+	})
+	res.Body.Close()
+	res = runCallback(t, ts, stub, map[string]any{
+		"sub":                "carol-sub",
+		"preferred_username": "carol",
+		"groups":             []string{"rm-admins"},
+		"aud":                "test-client",
+	})
+	res.Body.Close()
+	u, _ := srv.deps.Store.GetUserByOIDCSubject(t.Context(), "carol-sub")
+	if u.Role != "admin" {
+		t.Errorf("role refresh: got %q want admin", u.Role)
+	}
+}