|
| 1 | +package auth_test |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "regexp" |
| 6 | + "testing" |
| 7 | + "time" |
| 8 | + |
| 9 | + "github.com/golang-jwt/jwt/v4" |
| 10 | + "github.com/rotationalio/go-ensign/auth" |
| 11 | + "github.com/rotationalio/go-ensign/auth/authtest" |
| 12 | + "github.com/stretchr/testify/suite" |
| 13 | +) |
| 14 | + |
| 15 | +type authTestSuite struct { |
| 16 | + suite.Suite |
| 17 | + srv *authtest.Server |
| 18 | + auth *auth.Client |
| 19 | +} |
| 20 | + |
| 21 | +func (s *authTestSuite) SetupSuite() { |
| 22 | + var err error |
| 23 | + assert := s.Assert() |
| 24 | + |
| 25 | + s.srv, err = authtest.NewServer() |
| 26 | + assert.NoError(err, "could not create authtest server") |
| 27 | + |
| 28 | + s.auth, err = auth.New(s.srv.URL(), false) |
| 29 | + assert.NoError(err, "could not create auth client") |
| 30 | +} |
| 31 | + |
| 32 | +func (s *authTestSuite) TearDownSuite() { |
| 33 | + s.srv.Close() |
| 34 | +} |
| 35 | + |
| 36 | +func (s *authTestSuite) AfterTest(suiteName, testName string) { |
| 37 | + s.auth.Reset() |
| 38 | +} |
| 39 | + |
| 40 | +func TestAuth(t *testing.T) { |
| 41 | + suite.Run(t, &authTestSuite{}) |
| 42 | +} |
| 43 | + |
| 44 | +func (s *authTestSuite) TestLogin() { |
| 45 | + require := s.Require() |
| 46 | + clientID, clientSecret := s.srv.Register() |
| 47 | + |
| 48 | + creds, err := s.auth.Login(context.Background(), clientID, clientSecret) |
| 49 | + require.NoError(err, "could not login with credentials") |
| 50 | + require.NotZero(creds, "expected credentials to be returned") |
| 51 | + |
| 52 | + // Credentials should be cached if valid so the same creds should be returned |
| 53 | + other, err := s.auth.Credentials(context.Background()) |
| 54 | + require.NoError(err, "could not fetch credentials") |
| 55 | + |
| 56 | + credsc, ok := creds.(*auth.Credentials) |
| 57 | + require.True(ok, "could not convert creds to credentials") |
| 58 | + otherc, ok := other.(*auth.Credentials) |
| 59 | + require.True(ok, "could not convert other creds to credentials") |
| 60 | + require.True(credsc.Equals(otherc)) |
| 61 | +} |
| 62 | + |
| 63 | +func (s *authTestSuite) TestLoginError() { |
| 64 | + require := s.Require() |
| 65 | + ctx := context.Background() |
| 66 | + |
| 67 | + // Cannot login without credentials |
| 68 | + _, err := s.auth.Login(ctx, "", "") |
| 69 | + require.ErrorIs(err, auth.ErrIncompleteCreds) |
| 70 | + _, err = s.auth.Login(ctx, "foo", "") |
| 71 | + require.ErrorIs(err, auth.ErrIncompleteCreds) |
| 72 | + _, err = s.auth.Login(ctx, "", "foo") |
| 73 | + require.ErrorIs(err, auth.ErrIncompleteCreds) |
| 74 | + |
| 75 | + // Cannot login with incorrect credentials |
| 76 | + _, err = s.auth.Login(ctx, "hacker", "password") |
| 77 | + require.EqualError(err, "[401] invalid credentials") |
| 78 | +} |
| 79 | + |
| 80 | +func (s *authTestSuite) TestCredentials() { |
| 81 | + require := s.Require() |
| 82 | + ctx := context.Background() |
| 83 | + |
| 84 | + // If tokens and apikeys are nil, an error should be returned |
| 85 | + s.auth.Reset() |
| 86 | + _, err := s.auth.Credentials(ctx) |
| 87 | + require.ErrorIs(err, auth.ErrNoAPIKeys) |
| 88 | + |
| 89 | + // If apikeys are set, then the tokens should be correctly authenticated |
| 90 | + apikey := &auth.APIKey{} |
| 91 | + apikey.ClientID, apikey.ClientSecret = s.srv.Register() |
| 92 | + s.auth.SetAPIKey(apikey) |
| 93 | + |
| 94 | + creds, err := s.auth.Credentials(ctx) |
| 95 | + require.NoError(err, "could not authenticate to test server") |
| 96 | + |
| 97 | + // Creds should be cached while they are still valid |
| 98 | + other, err := s.auth.Credentials(ctx) |
| 99 | + require.NoError(err, "could not authenticate to test server") |
| 100 | + require.Equal(creds, other, "expected creds to be identical since they are cached") |
| 101 | + |
| 102 | + // If the tokens are not valid an error should be returned |
| 103 | + s.auth.SetTokens(&auth.Tokens{AccessToken: "invalid", RefreshToken: "invalid"}) |
| 104 | + _, err = s.auth.Credentials(ctx) |
| 105 | + require.EqualError(err, "token contains an invalid number of segments") |
| 106 | + |
| 107 | + // If the access token is expired but the refresh token is valid, should refresh |
| 108 | + unexpired := &authtest.Claims{ |
| 109 | + RegisteredClaims: jwt.RegisteredClaims{ |
| 110 | + NotBefore: jwt.NewNumericDate(time.Now().Add(-1 * time.Minute)), |
| 111 | + ExpiresAt: jwt.NewNumericDate(time.Now().Add(5 * time.Minute)), |
| 112 | + }, |
| 113 | + } |
| 114 | + expired := &authtest.Claims{ |
| 115 | + RegisteredClaims: jwt.RegisteredClaims{ |
| 116 | + NotBefore: jwt.NewNumericDate(time.Now().Add(-10 * time.Minute)), |
| 117 | + ExpiresAt: jwt.NewNumericDate(time.Now().Add(-5 * time.Minute)), |
| 118 | + }, |
| 119 | + } |
| 120 | + |
| 121 | + tokens := &auth.Tokens{} |
| 122 | + tokens.AccessToken, err = s.srv.Sign(s.srv.CreateToken(expired)) |
| 123 | + require.NoError(err, "could not create expired access token") |
| 124 | + tokens.RefreshToken, err = s.srv.Sign(s.srv.CreateToken(unexpired)) |
| 125 | + require.NoError(err, "could not create unexpired refresh token") |
| 126 | + s.auth.SetTokens(tokens) |
| 127 | + |
| 128 | + other, err = s.auth.Credentials(ctx) |
| 129 | + require.NoError(err, "could not authenticate to test server") |
| 130 | + require.NotEqual(creds, other, "expected new creds to be issued from refresh") |
| 131 | + |
| 132 | + // Should reauthenticate if both the access token and the refresh token are expired |
| 133 | + // NOTE: must create new tokens struct to avoid cached timestamps |
| 134 | + tokens = &auth.Tokens{} |
| 135 | + tokens.AccessToken, err = s.srv.Sign(s.srv.CreateToken(expired)) |
| 136 | + require.NoError(err, "could not create expired access token") |
| 137 | + tokens.RefreshToken, err = s.srv.Sign(s.srv.CreateToken(expired)) |
| 138 | + require.NoError(err, "could not create expired refresh token") |
| 139 | + s.auth.SetTokens(tokens) |
| 140 | + |
| 141 | + compr, err := s.auth.Credentials(ctx) |
| 142 | + require.NoError(err, "could not authenticate to test server") |
| 143 | + require.NotEqual(other, compr, "expected new creds to be issued from authenticate") |
| 144 | + |
| 145 | +} |
| 146 | + |
| 147 | +func (s *authTestSuite) TestAuthenticate() { |
| 148 | + require := s.Require() |
| 149 | + |
| 150 | + req := &auth.APIKey{} |
| 151 | + req.ClientID, req.ClientSecret = s.srv.Register() |
| 152 | + |
| 153 | + rep, err := s.auth.Authenticate(context.Background(), req) |
| 154 | + require.NoError(err, "could not authenticate with good credentials") |
| 155 | + require.NotZero(rep, "no response returned") |
| 156 | + require.NotZero(rep.AccessToken, "no access token returned") |
| 157 | + require.NotZero(rep.RefreshToken, "no refresh token returned") |
| 158 | + |
| 159 | + // Test authenticate requires apikeys |
| 160 | + _, err = s.auth.Authenticate(context.Background(), nil) |
| 161 | + require.ErrorIs(err, auth.ErrNoAPIKeys) |
| 162 | + _, err = s.auth.Authenticate(context.Background(), &auth.APIKey{}) |
| 163 | + require.ErrorIs(err, auth.ErrNoAPIKeys) |
| 164 | + _, err = s.auth.Authenticate(context.Background(), &auth.APIKey{ClientID: "foo"}) |
| 165 | + require.ErrorIs(err, auth.ErrNoAPIKeys) |
| 166 | + _, err = s.auth.Authenticate(context.Background(), &auth.APIKey{ClientSecret: "foo"}) |
| 167 | + require.ErrorIs(err, auth.ErrNoAPIKeys) |
| 168 | +} |
| 169 | + |
| 170 | +func (s *authTestSuite) TestRefresh() { |
| 171 | + var err error |
| 172 | + require := s.Require() |
| 173 | + |
| 174 | + // Test valid refresh |
| 175 | + req := &auth.Tokens{} |
| 176 | + claims := &authtest.Claims{RegisteredClaims: jwt.RegisteredClaims{Subject: "testing"}} |
| 177 | + req.AccessToken, req.RefreshToken, err = s.srv.CreateTokenPair(claims) |
| 178 | + require.NoError(err, "could not create tokens to test refresh") |
| 179 | + |
| 180 | + rep, err := s.auth.Refresh(context.Background(), req) |
| 181 | + require.NoError(err, "could not refresh tokens") |
| 182 | + require.NotZero(rep, "no access tokens returned") |
| 183 | + require.NotEqual(rep.AccessToken, req.AccessToken) |
| 184 | + require.NotEqual(rep.RefreshToken, req.RefreshToken) |
| 185 | + |
| 186 | + // Test invalid refresh |
| 187 | + req.RefreshToken = "bad refresh token" |
| 188 | + _, err = s.auth.Refresh(context.Background(), req) |
| 189 | + require.EqualError(err, "[500] token contains an invalid number of segments") |
| 190 | + |
| 191 | + // Test expired token |
| 192 | + claims = &authtest.Claims{ |
| 193 | + RegisteredClaims: jwt.RegisteredClaims{ |
| 194 | + Subject: "expired", |
| 195 | + ExpiresAt: jwt.NewNumericDate(time.Now().Add(-5 * time.Minute)), |
| 196 | + }, |
| 197 | + } |
| 198 | + req.RefreshToken, err = s.srv.Sign(s.srv.CreateToken(claims)) |
| 199 | + require.NoError(err, "could not create expired refresh token") |
| 200 | + |
| 201 | + _, err = s.auth.Refresh(context.Background(), req) |
| 202 | + require.Error(err, "expected an error returned") |
| 203 | + require.Regexp(regexp.MustCompile(`^\[500\] token is expired by 5m0\.(\d+)s$`), err.Error()) |
| 204 | +} |
| 205 | + |
| 206 | +func (s *authTestSuite) TestStatus() { |
| 207 | + require := s.Require() |
| 208 | + status, err := s.auth.Status(context.Background()) |
| 209 | + require.NoError(err, "could not make status request") |
| 210 | + require.Equal("ok", status.Status) |
| 211 | + require.Equal("test", status.Version) |
| 212 | +} |
0 commit comments