func TestKeyCacher(t *testing.T) {
tNow := time.Now()
now := func() time.Time { return tNow }
s := memory.New()
tests := []struct {
before func()
wantCallToStorage bool
}{
{
before: func() {},
wantCallToStorage: true,
},
{
before: func() {
s.UpdateKeys(func(old storage.Keys) (storage.Keys, error) {
old.NextRotation = tNow.Add(time.Minute)
return old, nil
})
},
wantCallToStorage: true,
},
{
before: func() {},
wantCallToStorage: false,
},
{
before: func() {
tNow = tNow.Add(time.Hour)
},
wantCallToStorage: true,
},
{
before: func() {
tNow = tNow.Add(time.Hour)
s.UpdateKeys(func(old storage.Keys) (storage.Keys, error) {
old.NextRotation = tNow.Add(time.Minute)
return old, nil
})
},
wantCallToStorage: true,
},
{
before: func() {},
wantCallToStorage: false,
},
}
gotCall := false
s = newKeyCacher(storageWithKeysTrigger{s, func() { gotCall = true }}, now)
for i, tc := range tests {
gotCall = false
tc.before()
s.GetKeys()
if gotCall != tc.wantCallToStorage {
t.Errorf("case %d: expected call to storage=%t got call to storage=%t", i, tc.wantCallToStorage, gotCall)
}
}
}
func newTestServer(ctx context.Context, t *testing.T, updateConfig func(c *Config)) (*httptest.Server, *Server) {
var server *Server
s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
server.ServeHTTP(w, r)
}))
config := Config{
Issuer: s.URL,
Storage: memory.New(),
Connectors: []Connector{
{
ID: "mock",
DisplayName: "Mock",
Connector: mock.NewCallbackConnector(),
},
},
Web: WebConfig{
Dir: filepath.Join(os.Getenv("GOPATH"), "src/github.com/coreos/dex/web"),
},
}
if updateConfig != nil {
updateConfig(&config)
}
s.URL = config.Issuer
var err error
if server, err = newServer(ctx, config, staticRotationStrategy(testKey)); err != nil {
t.Fatal(err)
}
server.skipApproval = true // Don't prompt for approval, just immediately redirect with code.
return s, server
}
// Attempts to create, update and delete a test Password
func TestPassword(t *testing.T) {
logger := &logrus.Logger{
Out: os.Stderr,
Formatter: &logrus.TextFormatter{DisableColors: true},
Level: logrus.DebugLevel,
}
s := memory.New(logger)
serv := NewAPI(s, logger)
ctx := context.Background()
p := api.Password{
Email: "*****@*****.**",
// bcrypt hash of the value "test1" with cost 10
Hash: []byte("$2a$10$XVMN/Fid.Ks4CXgzo8fpR.iU1khOMsP5g9xQeXuBm1wXjRX8pjUtO"),
Username: "******",
UserId: "test123",
}
createReq := api.CreatePasswordReq{
Password: &p,
}
if _, err := serv.CreatePassword(ctx, &createReq); err != nil {
t.Fatalf("Unable to create password: %v", err)
}
updateReq := api.UpdatePasswordReq{
Email: "*****@*****.**",
NewUsername: "******",
}
if _, err := serv.UpdatePassword(ctx, &updateReq); err != nil {
t.Fatalf("Unable to update password: %v", err)
}
pass, err := s.GetPassword(updateReq.Email)
if err != nil {
t.Fatalf("Unable to retrieve password: %v", err)
}
if pass.Username != updateReq.NewUsername {
t.Fatalf("UpdatePassword failed. Expected username %s retrieved %s", updateReq.NewUsername, pass.Username)
}
deleteReq := api.DeletePasswordReq{
Email: "*****@*****.**",
}
if _, err := serv.DeletePassword(ctx, &deleteReq); err != nil {
t.Fatalf("Unable to delete password: %v", err)
}
}
func TestPasswordDB(t *testing.T) {
s := memory.New()
conn := newPasswordDB(s)
pw := "hi"
h, err := bcrypt.GenerateFromPassword([]byte(pw), bcrypt.MinCost)
if err != nil {
t.Fatal(err)
}
s.CreatePassword(storage.Password{
Email: "*****@*****.**",
Username: "******",
UserID: "foobar",
Hash: h,
})
tests := []struct {
name string
username string
password string
wantIdentity connector.Identity
wantInvalid bool
wantErr bool
}{
{
name: "valid password",
username: "******",
password: pw,
wantIdentity: connector.Identity{
Email: "*****@*****.**",
Username: "******",
UserID: "foobar",
EmailVerified: true,
},
},
{
name: "unknown user",
username: "******",
password: pw,
wantInvalid: true,
},
{
name: "invalid password",
username: "******",
password: "******",
wantInvalid: true,
},
}
for _, tc := range tests {
ident, valid, err := conn.Login(context.Background(), connector.Scopes{}, tc.username, tc.password)
if err != nil {
if !tc.wantErr {
t.Errorf("%s: %v", tc.name, err)
}
continue
}
if tc.wantErr {
t.Errorf("%s: expected error", tc.name)
continue
}
if !valid {
if !tc.wantInvalid {
t.Errorf("%s: expected valid password", tc.name)
}
continue
}
if tc.wantInvalid {
t.Errorf("%s: expected invalid password", tc.name)
continue
}
if diff := pretty.Compare(tc.wantIdentity, ident); diff != "" {
t.Errorf("%s: %s", tc.name, diff)
}
}
}
