615 lines
13 KiB
Go
615 lines
13 KiB
Go
|
package oidcauth
|
||
|
|
|
||
|
|
import (
|
||
|
|
"encoding/json"
|
||
|
|
"fmt"
|
||
|
|
"testing"
|
||
|
|
|
||
|
|
"github.com/stretchr/testify/assert"
|
||
|
|
"github.com/stretchr/testify/require"
|
||
|
|
)
|
||
|
|
|
||
|
|
func TestExtractStringMetadata(t *testing.T) {
|
||
|
|
emptyMap := make(map[string]string)
|
||
|
|
|
||
|
|
tests := map[string]struct {
|
||
|
|
allClaims map[string]interface{}
|
||
|
|
claimMappings map[string]string
|
||
|
|
expected map[string]string
|
||
|
|
errExpected bool
|
||
|
|
}{
|
||
|
|
"empty": {nil, nil, emptyMap, false},
|
||
|
|
"all": {
|
||
|
|
map[string]interface{}{
|
||
|
|
"data1": "foo",
|
||
|
|
"data2": "bar",
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"data1": "val1",
|
||
|
|
"data2": "val2",
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"val1": "foo",
|
||
|
|
"val2": "bar",
|
||
|
|
},
|
||
|
|
false,
|
||
|
|
},
|
||
|
|
"some": {
|
||
|
|
map[string]interface{}{
|
||
|
|
"data1": "foo",
|
||
|
|
"data2": "bar",
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"data1": "val1",
|
||
|
|
"data3": "val2",
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"val1": "foo",
|
||
|
|
},
|
||
|
|
false,
|
||
|
|
},
|
||
|
|
"none": {
|
||
|
|
map[string]interface{}{
|
||
|
|
"data1": "foo",
|
||
|
|
"data2": "bar",
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"data8": "val1",
|
||
|
|
"data9": "val2",
|
||
|
|
},
|
||
|
|
emptyMap,
|
||
|
|
false,
|
||
|
|
},
|
||
|
|
|
||
|
|
"nested data": {
|
||
|
|
map[string]interface{}{
|
||
|
|
"data1": "foo",
|
||
|
|
"data2": map[string]interface{}{
|
||
|
|
"child": "bar",
|
||
|
|
},
|
||
|
|
"data3": true,
|
||
|
|
"data4": false,
|
||
|
|
"data5": float64(7.9),
|
||
|
|
"data6": json.Number("-12345"),
|
||
|
|
"data7": int(42),
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"data1": "val1",
|
||
|
|
"/data2/child": "val2",
|
||
|
|
"data3": "val3",
|
||
|
|
"data4": "val4",
|
||
|
|
"data5": "val5",
|
||
|
|
"data6": "val6",
|
||
|
|
"data7": "val7",
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"val1": "foo",
|
||
|
|
"val2": "bar",
|
||
|
|
"val3": "true",
|
||
|
|
"val4": "false",
|
||
|
|
"val5": "7",
|
||
|
|
"val6": "-12345",
|
||
|
|
"val7": "42",
|
||
|
|
},
|
||
|
|
false,
|
||
|
|
},
|
||
|
|
|
||
|
|
"error: a struct isn't stringifiable": {
|
||
|
|
map[string]interface{}{
|
||
|
|
"data1": map[string]interface{}{
|
||
|
|
"child": "bar",
|
||
|
|
},
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"data1": "val1",
|
||
|
|
},
|
||
|
|
nil,
|
||
|
|
true,
|
||
|
|
},
|
||
|
|
"error: a slice isn't stringifiable": {
|
||
|
|
map[string]interface{}{
|
||
|
|
"data1": []interface{}{
|
||
|
|
"child", "bar",
|
||
|
|
},
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"data1": "val1",
|
||
|
|
},
|
||
|
|
nil,
|
||
|
|
true,
|
||
|
|
},
|
||
|
|
}
|
||
|
|
|
||
|
|
for name, test := range tests {
|
||
|
|
test := test
|
||
|
|
t.Run(name, func(t *testing.T) {
|
||
|
|
actual, err := extractStringMetadata(nil, test.allClaims, test.claimMappings)
|
||
|
|
if test.errExpected {
|
||
|
|
require.Error(t, err)
|
||
|
|
} else {
|
||
|
|
require.NoError(t, err)
|
||
|
|
require.Equal(t, test.expected, actual)
|
||
|
|
}
|
||
|
|
})
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestExtractListMetadata(t *testing.T) {
|
||
|
|
emptyMap := make(map[string][]string)
|
||
|
|
|
||
|
|
tests := map[string]struct {
|
||
|
|
allClaims map[string]interface{}
|
||
|
|
claimMappings map[string]string
|
||
|
|
expected map[string][]string
|
||
|
|
errExpected bool
|
||
|
|
}{
|
||
|
|
"empty": {nil, nil, emptyMap, false},
|
||
|
|
"all - singular": {
|
||
|
|
map[string]interface{}{
|
||
|
|
"data1": "foo",
|
||
|
|
"data2": "bar",
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"data1": "val1",
|
||
|
|
"data2": "val2",
|
||
|
|
},
|
||
|
|
map[string][]string{
|
||
|
|
"val1": []string{"foo"},
|
||
|
|
"val2": []string{"bar"},
|
||
|
|
},
|
||
|
|
false,
|
||
|
|
},
|
||
|
|
"some - singular": {
|
||
|
|
map[string]interface{}{
|
||
|
|
"data1": "foo",
|
||
|
|
"data2": "bar",
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"data1": "val1",
|
||
|
|
"data3": "val2",
|
||
|
|
},
|
||
|
|
map[string][]string{
|
||
|
|
"val1": []string{"foo"},
|
||
|
|
},
|
||
|
|
false,
|
||
|
|
},
|
||
|
|
"none - singular": {
|
||
|
|
map[string]interface{}{
|
||
|
|
"data1": "foo",
|
||
|
|
"data2": "bar",
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"data8": "val1",
|
||
|
|
"data9": "val2",
|
||
|
|
},
|
||
|
|
emptyMap,
|
||
|
|
false,
|
||
|
|
},
|
||
|
|
|
||
|
|
"nested data - singular": {
|
||
|
|
map[string]interface{}{
|
||
|
|
"data1": "foo",
|
||
|
|
"data2": map[string]interface{}{
|
||
|
|
"child": "bar",
|
||
|
|
},
|
||
|
|
"data3": true,
|
||
|
|
"data4": false,
|
||
|
|
"data5": float64(7.9),
|
||
|
|
"data6": json.Number("-12345"),
|
||
|
|
"data7": int(42),
|
||
|
|
"data8": []interface{}{ // mixed
|
||
|
|
"foo", true, float64(7.9), json.Number("-12345"), int(42),
|
||
|
|
},
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"data1": "val1",
|
||
|
|
"/data2/child": "val2",
|
||
|
|
"data3": "val3",
|
||
|
|
"data4": "val4",
|
||
|
|
"data5": "val5",
|
||
|
|
"data6": "val6",
|
||
|
|
"data7": "val7",
|
||
|
|
"data8": "val8",
|
||
|
|
},
|
||
|
|
map[string][]string{
|
||
|
|
"val1": []string{"foo"},
|
||
|
|
"val2": []string{"bar"},
|
||
|
|
"val3": []string{"true"},
|
||
|
|
"val4": []string{"false"},
|
||
|
|
"val5": []string{"7"},
|
||
|
|
"val6": []string{"-12345"},
|
||
|
|
"val7": []string{"42"},
|
||
|
|
"val8": []string{
|
||
|
|
"foo", "true", "7", "-12345", "42",
|
||
|
|
},
|
||
|
|
},
|
||
|
|
false,
|
||
|
|
},
|
||
|
|
|
||
|
|
"error: a struct isn't stringifiable (singular)": {
|
||
|
|
map[string]interface{}{
|
||
|
|
"data1": map[string]interface{}{
|
||
|
|
"child": map[string]interface{}{
|
||
|
|
"inner": "bar",
|
||
|
|
},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"data1": "val1",
|
||
|
|
},
|
||
|
|
nil,
|
||
|
|
true,
|
||
|
|
},
|
||
|
|
"error: a slice isn't stringifiable (singular)": {
|
||
|
|
map[string]interface{}{
|
||
|
|
"data1": []interface{}{
|
||
|
|
"child", []interface{}{"bar"},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"data1": "val1",
|
||
|
|
},
|
||
|
|
nil,
|
||
|
|
true,
|
||
|
|
},
|
||
|
|
|
||
|
|
"non-string-slice data (string)": {
|
||
|
|
map[string]interface{}{
|
||
|
|
"data1": "foo",
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"data1": "val1",
|
||
|
|
},
|
||
|
|
map[string][]string{
|
||
|
|
"val1": []string{"foo"}, // singular values become lists
|
||
|
|
},
|
||
|
|
false,
|
||
|
|
},
|
||
|
|
|
||
|
|
"all - list": {
|
||
|
|
map[string]interface{}{
|
||
|
|
"data1": []interface{}{"foo", "otherFoo"},
|
||
|
|
"data2": []interface{}{"bar", "otherBar"},
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"data1": "val1",
|
||
|
|
"data2": "val2",
|
||
|
|
},
|
||
|
|
map[string][]string{
|
||
|
|
"val1": []string{"foo", "otherFoo"},
|
||
|
|
"val2": []string{"bar", "otherBar"},
|
||
|
|
},
|
||
|
|
false,
|
||
|
|
},
|
||
|
|
"some - list": {
|
||
|
|
map[string]interface{}{
|
||
|
|
"data1": []interface{}{"foo", "otherFoo"},
|
||
|
|
"data2": map[string]interface{}{
|
||
|
|
"child": []interface{}{"bar", "otherBar"},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"data1": "val1",
|
||
|
|
"/data2/child": "val2",
|
||
|
|
},
|
||
|
|
map[string][]string{
|
||
|
|
"val1": []string{"foo", "otherFoo"},
|
||
|
|
"val2": []string{"bar", "otherBar"},
|
||
|
|
},
|
||
|
|
false,
|
||
|
|
},
|
||
|
|
"none - list": {
|
||
|
|
map[string]interface{}{
|
||
|
|
"data1": []interface{}{"foo"},
|
||
|
|
"data2": []interface{}{"bar"},
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"data8": "val1",
|
||
|
|
"data9": "val2",
|
||
|
|
},
|
||
|
|
emptyMap,
|
||
|
|
false,
|
||
|
|
},
|
||
|
|
"list omits empty strings": {
|
||
|
|
map[string]interface{}{
|
||
|
|
"data1": []interface{}{"foo", "", "otherFoo", ""},
|
||
|
|
"data2": "",
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"data1": "val1",
|
||
|
|
"data2": "val2",
|
||
|
|
},
|
||
|
|
map[string][]string{
|
||
|
|
"val1": []string{"foo", "otherFoo"},
|
||
|
|
"val2": []string{},
|
||
|
|
},
|
||
|
|
false,
|
||
|
|
},
|
||
|
|
|
||
|
|
"nested data - list": {
|
||
|
|
map[string]interface{}{
|
||
|
|
"data1": []interface{}{"foo"},
|
||
|
|
"data2": map[string]interface{}{
|
||
|
|
"child": []interface{}{"bar"},
|
||
|
|
},
|
||
|
|
"data3": []interface{}{true},
|
||
|
|
"data4": []interface{}{false},
|
||
|
|
"data5": []interface{}{float64(7.9)},
|
||
|
|
"data6": []interface{}{json.Number("-12345")},
|
||
|
|
"data7": []interface{}{int(42)},
|
||
|
|
"data8": []interface{}{ // mixed
|
||
|
|
"foo", true, float64(7.9), json.Number("-12345"), int(42),
|
||
|
|
},
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"data1": "val1",
|
||
|
|
"/data2/child": "val2",
|
||
|
|
"data3": "val3",
|
||
|
|
"data4": "val4",
|
||
|
|
"data5": "val5",
|
||
|
|
"data6": "val6",
|
||
|
|
"data7": "val7",
|
||
|
|
"data8": "val8",
|
||
|
|
},
|
||
|
|
map[string][]string{
|
||
|
|
"val1": []string{"foo"},
|
||
|
|
"val2": []string{"bar"},
|
||
|
|
"val3": []string{"true"},
|
||
|
|
"val4": []string{"false"},
|
||
|
|
"val5": []string{"7"},
|
||
|
|
"val6": []string{"-12345"},
|
||
|
|
"val7": []string{"42"},
|
||
|
|
"val8": []string{
|
||
|
|
"foo", "true", "7", "-12345", "42",
|
||
|
|
},
|
||
|
|
},
|
||
|
|
false,
|
||
|
|
},
|
||
|
|
|
||
|
|
"JSONPointer": {
|
||
|
|
map[string]interface{}{
|
||
|
|
"foo": "a",
|
||
|
|
"bar": map[string]interface{}{
|
||
|
|
"baz": []string{"x", "y", "z"},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"foo": "val1",
|
||
|
|
"/bar/baz/1": "val2",
|
||
|
|
},
|
||
|
|
map[string][]string{
|
||
|
|
"val1": []string{"a"},
|
||
|
|
"val2": []string{"y"},
|
||
|
|
},
|
||
|
|
false,
|
||
|
|
},
|
||
|
|
"JSONPointer not found": {
|
||
|
|
map[string]interface{}{
|
||
|
|
"foo": "a",
|
||
|
|
"bar": map[string]interface{}{
|
||
|
|
"baz": []string{"x", "y", "z"},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
map[string]string{
|
||
|
|
"foo": "val1",
|
||
|
|
"/bar/XXX/1243": "val2",
|
||
|
|
},
|
||
|
|
map[string][]string{
|
||
|
|
"val1": []string{"a"},
|
||
|
|
},
|
||
|
|
false,
|
||
|
|
},
|
||
|
|
}
|
||
|
|
|
||
|
|
for name, test := range tests {
|
||
|
|
test := test
|
||
|
|
t.Run(name, func(t *testing.T) {
|
||
|
|
actual, err := extractListMetadata(nil, test.allClaims, test.claimMappings)
|
||
|
|
if test.errExpected {
|
||
|
|
require.Error(t, err)
|
||
|
|
} else {
|
||
|
|
require.NoError(t, err)
|
||
|
|
require.Equal(t, test.expected, actual)
|
||
|
|
}
|
||
|
|
})
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestGetClaim(t *testing.T) {
|
||
|
|
data := `{
|
||
|
|
"a": 42,
|
||
|
|
"b": "bar",
|
||
|
|
"c": {
|
||
|
|
"d": 95,
|
||
|
|
"e": [
|
||
|
|
"dog",
|
||
|
|
"cat",
|
||
|
|
"bird"
|
||
|
|
],
|
||
|
|
"f": {
|
||
|
|
"g": "zebra"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"h": true,
|
||
|
|
"i": false
|
||
|
|
}`
|
||
|
|
var claims map[string]interface{}
|
||
|
|
require.NoError(t, json.Unmarshal([]byte(data), &claims))
|
||
|
|
|
||
|
|
tests := []struct {
|
||
|
|
claim string
|
||
|
|
value interface{}
|
||
|
|
}{
|
||
|
|
{"a", float64(42)},
|
||
|
|
{"/a", float64(42)},
|
||
|
|
{"b", "bar"},
|
||
|
|
{"/c/d", float64(95)},
|
||
|
|
{"/c/e/1", "cat"},
|
||
|
|
{"/c/f/g", "zebra"},
|
||
|
|
{"nope", nil},
|
||
|
|
{"/c/f/h", nil},
|
||
|
|
{"", nil},
|
||
|
|
{"\\", nil},
|
||
|
|
{"h", true},
|
||
|
|
{"i", false},
|
||
|
|
{"/c/e", []interface{}{"dog", "cat", "bird"}},
|
||
|
|
{"/c/f", map[string]interface{}{"g": "zebra"}},
|
||
|
|
}
|
||
|
|
|
||
|
|
for _, test := range tests {
|
||
|
|
t.Run(test.claim, func(t *testing.T) {
|
||
|
|
v := getClaim(nil, claims, test.claim)
|
||
|
|
require.Equal(t, test.value, v)
|
||
|
|
})
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestNormalizeList(t *testing.T) {
|
||
|
|
tests := []struct {
|
||
|
|
raw interface{}
|
||
|
|
normalized []interface{}
|
||
|
|
ok bool
|
||
|
|
}{
|
||
|
|
{
|
||
|
|
raw: []interface{}{"green", 42},
|
||
|
|
normalized: []interface{}{"green", 42},
|
||
|
|
ok: true,
|
||
|
|
},
|
||
|
|
{
|
||
|
|
raw: []interface{}{"green"},
|
||
|
|
normalized: []interface{}{"green"},
|
||
|
|
ok: true,
|
||
|
|
},
|
||
|
|
{
|
||
|
|
raw: []interface{}{},
|
||
|
|
normalized: []interface{}{},
|
||
|
|
ok: true,
|
||
|
|
},
|
||
|
|
{
|
||
|
|
raw: "green",
|
||
|
|
normalized: []interface{}{"green"},
|
||
|
|
ok: true,
|
||
|
|
},
|
||
|
|
{
|
||
|
|
raw: "",
|
||
|
|
normalized: []interface{}{""},
|
||
|
|
ok: true,
|
||
|
|
},
|
||
|
|
{
|
||
|
|
raw: 42,
|
||
|
|
normalized: []interface{}{42},
|
||
|
|
ok: true,
|
||
|
|
},
|
||
|
|
{
|
||
|
|
raw: struct{ A int }{A: 5},
|
||
|
|
normalized: nil,
|
||
|
|
ok: false,
|
||
|
|
},
|
||
|
|
{
|
||
|
|
raw: nil,
|
||
|
|
normalized: nil,
|
||
|
|
ok: false,
|
||
|
|
},
|
||
|
|
}
|
||
|
|
for _, tc := range tests {
|
||
|
|
tc := tc
|
||
|
|
t.Run(fmt.Sprintf("%#v", tc.raw), func(t *testing.T) {
|
||
|
|
normalized, ok := normalizeList(tc.raw)
|
||
|
|
assert.Equal(t, tc.normalized, normalized)
|
||
|
|
assert.Equal(t, tc.ok, ok)
|
||
|
|
})
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestStringifyMetadataValue(t *testing.T) {
|
||
|
|
cases := map[string]struct {
|
||
|
|
value interface{}
|
||
|
|
expect string
|
||
|
|
expectFailure bool
|
||
|
|
}{
|
||
|
|
"empty string": {"", "", false},
|
||
|
|
"string": {"foo", "foo", false},
|
||
|
|
"true": {true, "true", false},
|
||
|
|
"false": {false, "false", false},
|
||
|
|
"json number": {json.Number("-12345"), "-12345", false},
|
||
|
|
"float64": {float64(7.9), "7", false},
|
||
|
|
//
|
||
|
|
"float32": {float32(7.9), "7", false},
|
||
|
|
"int8": {int8(42), "42", false},
|
||
|
|
"int16": {int16(42), "42", false},
|
||
|
|
"int32": {int32(42), "42", false},
|
||
|
|
"int64": {int64(42), "42", false},
|
||
|
|
"int": {int(42), "42", false},
|
||
|
|
"uint8": {uint8(42), "42", false},
|
||
|
|
"uint16": {uint16(42), "42", false},
|
||
|
|
"uint32": {uint32(42), "42", false},
|
||
|
|
"uint64": {uint64(42), "42", false},
|
||
|
|
"uint": {uint(42), "42", false},
|
||
|
|
// fail
|
||
|
|
"string slice": {[]string{"a"}, "", true},
|
||
|
|
"int slice": {[]int64{99}, "", true},
|
||
|
|
"map": {map[string]int{"a": 99}, "", true},
|
||
|
|
"nil": {nil, "", true},
|
||
|
|
"struct": {struct{ A int }{A: 5}, "", true},
|
||
|
|
}
|
||
|
|
|
||
|
|
for name, tc := range cases {
|
||
|
|
tc := tc
|
||
|
|
t.Run(name, func(t *testing.T) {
|
||
|
|
got, ok := stringifyMetadataValue(tc.value)
|
||
|
|
if tc.expectFailure {
|
||
|
|
require.False(t, ok)
|
||
|
|
} else {
|
||
|
|
require.True(t, ok)
|
||
|
|
require.Equal(t, tc.expect, got)
|
||
|
|
}
|
||
|
|
})
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestValidateAudience(t *testing.T) {
|
||
|
|
tests := []struct {
|
||
|
|
boundAudiences []string
|
||
|
|
audience []string
|
||
|
|
errExpectedLax bool
|
||
|
|
errExpectedStrict bool
|
||
|
|
}{
|
||
|
|
{[]string{"a"}, []string{"a"}, false, false},
|
||
|
|
{[]string{"a"}, []string{"b"}, true, true},
|
||
|
|
{[]string{"a"}, []string{""}, true, true},
|
||
|
|
{[]string{}, []string{"a"}, false, true},
|
||
|
|
{[]string{"a", "b"}, []string{"a"}, false, false},
|
||
|
|
{[]string{"a", "b"}, []string{"b"}, false, false},
|
||
|
|
{[]string{"a", "b"}, []string{"a", "b", "c"}, false, false},
|
||
|
|
{[]string{"a", "b"}, []string{"c", "d"}, true, true},
|
||
|
|
}
|
||
|
|
|
||
|
|
for _, tc := range tests {
|
||
|
|
tc := tc
|
||
|
|
|
||
|
|
t.Run(fmt.Sprintf(
|
||
|
|
"boundAudiences=%#v audience=%#v strict=false",
|
||
|
|
tc.boundAudiences, tc.audience,
|
||
|
|
), func(t *testing.T) {
|
||
|
|
err := validateAudience(tc.boundAudiences, tc.audience, false)
|
||
|
|
if tc.errExpectedLax {
|
||
|
|
require.Error(t, err)
|
||
|
|
} else {
|
||
|
|
require.NoError(t, err)
|
||
|
|
}
|
||
|
|
})
|
||
|
|
|
||
|
|
t.Run(fmt.Sprintf(
|
||
|
|
"boundAudiences=%#v audience=%#v strict=true",
|
||
|
|
tc.boundAudiences, tc.audience,
|
||
|
|
), func(t *testing.T) {
|
||
|
|
err := validateAudience(tc.boundAudiences, tc.audience, true)
|
||
|
|
if tc.errExpectedStrict {
|
||
|
|
require.Error(t, err)
|
||
|
|
} else {
|
||
|
|
require.NoError(t, err)
|
||
|
|
}
|
||
|
|
})
|
||
|
|
}
|
||
|
|
}
|