chengcheng
5c679ff13f
支持 Manifest V2 动态 tid 验证、Tenant Context 同步和租户内 JIT 投影，并保留 Manifest V1 与旧 Session 兼容。\n\n增加 tenantHint、租户切换、普通注册关闭及 application/principal/tenant 两级 SSF 撤销；迁移、定向安全测试和本地双租户跨仓 E2E 已通过。\n\nrelease_required=true；未执行 Release、Staging 或真实链路。
229 lines
8.9 KiB
Go
229 lines
8.9 KiB
Go
package identity
|
|
|
|
import (
|
|
"encoding/json"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestRevisionStateTransitions(t *testing.T) {
|
|
tests := []struct {
|
|
from, to RevisionState
|
|
allowed bool
|
|
}{
|
|
{RevisionDraft, RevisionValidated, true},
|
|
{RevisionDraft, RevisionFailed, true},
|
|
{RevisionValidated, RevisionActive, true},
|
|
{RevisionValidated, RevisionFailed, true},
|
|
{RevisionActive, RevisionSuperseded, true},
|
|
{RevisionSuperseded, RevisionValidated, true},
|
|
{RevisionSuperseded, RevisionActive, false},
|
|
{RevisionDraft, RevisionActive, false},
|
|
{RevisionFailed, RevisionActive, false},
|
|
{RevisionActive, RevisionValidated, false},
|
|
}
|
|
for _, test := range tests {
|
|
if got := CanTransition(test.from, test.to); got != test.allowed {
|
|
t.Errorf("CanTransition(%q, %q)=%v, want %v", test.from, test.to, got, test.allowed)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestRevisionNeverSerializesSecretValues(t *testing.T) {
|
|
type secretFields interface {
|
|
MachineSecret() string
|
|
}
|
|
var _ = any((*Revision)(nil))
|
|
if _, exposesSecret := any((*Revision)(nil)).(secretFields); exposesSecret {
|
|
t.Fatal("Revision unexpectedly exposes a machine secret value")
|
|
}
|
|
revision := Revision{MachineCredentialRef: "identity-machine-example", SessionEncryptionKeyRef: "identity-session-example"}
|
|
if revision.MachineCredentialRef == "" || revision.SessionEncryptionKeyRef == "" {
|
|
t.Fatal("Revision must retain SecretStore references")
|
|
}
|
|
}
|
|
|
|
func TestValidatePairingInputDerivesExactGatewayURIs(t *testing.T) {
|
|
input := PairingInput{
|
|
AuthCenterURL: "https://auth.example.com", PublicBaseURL: "https://api.example.com",
|
|
WebBaseURL: "https://gateway.example.com", LocalTenantKey: "default",
|
|
}
|
|
metadata, err := input.ConsumerMetadata(true, "production")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if metadata.RedirectURIs[0] != "https://api.example.com/api/v1/auth/oidc/callback" ||
|
|
metadata.LogoutURIs[0] != "https://gateway.example.com/" ||
|
|
metadata.ReceiverEndpoint != "https://api.example.com/api/v1/security-events/ssf" {
|
|
t.Fatalf("unexpected derived metadata: %#v", metadata)
|
|
}
|
|
}
|
|
|
|
func TestValidatePairingInputRejectsRemoteHTTPAndURLCredentials(t *testing.T) {
|
|
for _, input := range []PairingInput{
|
|
{AuthCenterURL: "http://auth.example.com", PublicBaseURL: "https://api.example.com", WebBaseURL: "https://gateway.example.com", LocalTenantKey: "default"},
|
|
{AuthCenterURL: "https://user:password@auth.example.com", PublicBaseURL: "https://api.example.com", WebBaseURL: "https://gateway.example.com", LocalTenantKey: "default"},
|
|
} {
|
|
if _, err := input.ConsumerMetadata(false, "production"); err == nil {
|
|
t.Fatalf("unsafe pairing input accepted: %#v", input)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestValidatePairingInputRejectsCrossSiteBrowserEndpoints(t *testing.T) {
|
|
for _, test := range []struct {
|
|
name string
|
|
appEnv string
|
|
input PairingInput
|
|
}{
|
|
{
|
|
name: "different registrable domains",
|
|
appEnv: "production",
|
|
input: PairingInput{
|
|
AuthCenterURL: "https://auth.example.com", PublicBaseURL: "https://api.example.com",
|
|
WebBaseURL: "https://gateway.example.net", LocalTenantKey: "default",
|
|
},
|
|
},
|
|
{
|
|
name: "different loopback sites",
|
|
appEnv: "test",
|
|
input: PairingInput{
|
|
AuthCenterURL: "http://127.0.0.1:18000", PublicBaseURL: "http://127.0.0.1:18088",
|
|
WebBaseURL: "http://localhost:15178", LocalTenantKey: "default",
|
|
},
|
|
},
|
|
{
|
|
name: "different schemes",
|
|
appEnv: "test",
|
|
input: PairingInput{
|
|
AuthCenterURL: "http://127.0.0.1:18000", PublicBaseURL: "http://localhost:18088",
|
|
WebBaseURL: "https://localhost:15178", LocalTenantKey: "default",
|
|
},
|
|
},
|
|
} {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
if _, err := test.input.ConsumerMetadata(false, test.appEnv); err == nil {
|
|
t.Fatalf("cross-site browser endpoints were accepted: %#v", test.input)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestValidateRevisionURLsRejectsCrossSiteBrowserEndpoints(t *testing.T) {
|
|
revision := Revision{
|
|
AuthCenterURL: "https://auth.example.com",
|
|
Issuer: "https://auth.example.com/issuer/shared",
|
|
PublicBaseURL: "https://api.example.com",
|
|
WebBaseURL: "https://gateway.example.net",
|
|
}
|
|
if err := ValidateRevisionURLs(revision, "production"); err == nil {
|
|
t.Fatal("cross-site persisted browser endpoints were accepted")
|
|
}
|
|
}
|
|
|
|
func TestNewDraftAppliesSessionDefaultsWithoutPersistingOnboardingCode(t *testing.T) {
|
|
draft, err := NewDraft(PairingInput{
|
|
AuthCenterURL: "https://auth.example.com", OnboardingCode: "onb1.must-never-be-persisted",
|
|
PublicBaseURL: "https://api.example.com", WebBaseURL: "https://gateway.example.com",
|
|
LocalTenantKey: "default", LegacyJWTEnabled: true,
|
|
}, "production")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if draft.State != RevisionDraft || draft.SessionIdleSeconds != 1800 || draft.SessionAbsoluteSeconds != 28800 || draft.SessionRefreshSeconds != 60 {
|
|
t.Fatalf("unexpected draft defaults: %#v", draft)
|
|
}
|
|
payload, _ := json.Marshal(draft)
|
|
if strings.Contains(string(payload), "must-never-be-persisted") || strings.Contains(string(payload), "onboardingCode") {
|
|
t.Fatalf("draft exposed onboarding code: %s", payload)
|
|
}
|
|
}
|
|
|
|
func TestNewDraftAllowsLoopbackHTTPOnlyInLocalEnvironments(t *testing.T) {
|
|
localInput := PairingInput{
|
|
AuthCenterURL: "http://localhost:18000", PublicBaseURL: "http://127.0.0.1:18089",
|
|
WebBaseURL: "http://127.0.0.1:5178", LocalTenantKey: "default",
|
|
}
|
|
secureInput := PairingInput{
|
|
AuthCenterURL: "https://auth.example.com", PublicBaseURL: "https://api.example.com",
|
|
WebBaseURL: "https://gateway.example.com", LocalTenantKey: "default",
|
|
}
|
|
for _, test := range []struct {
|
|
name string
|
|
mutate func(*PairingInput)
|
|
}{
|
|
{name: "auth center", mutate: func(input *PairingInput) { input.AuthCenterURL = localInput.AuthCenterURL }},
|
|
{name: "public base", mutate: func(input *PairingInput) { input.PublicBaseURL = localInput.PublicBaseURL }},
|
|
{name: "web base", mutate: func(input *PairingInput) { input.WebBaseURL = localInput.WebBaseURL }},
|
|
} {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
input := secureInput
|
|
test.mutate(&input)
|
|
for _, appEnv := range []string{"", "production", "staging"} {
|
|
if _, err := NewDraft(input, appEnv); err == nil {
|
|
t.Fatalf("%s accepted loopback HTTP %s URL", appEnv, test.name)
|
|
}
|
|
}
|
|
})
|
|
}
|
|
for _, appEnv := range []string{"local", "development", "dev", "test"} {
|
|
draft, err := NewDraft(localInput, appEnv)
|
|
if err != nil {
|
|
t.Fatalf("%s rejected loopback HTTP pairing URLs: %v", appEnv, err)
|
|
}
|
|
if draft.AuthCenterURL != localInput.AuthCenterURL || draft.PublicBaseURL != localInput.PublicBaseURL || draft.WebBaseURL != localInput.WebBaseURL {
|
|
t.Fatalf("%s changed normalized loopback URLs: %#v", appEnv, draft)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestApplyManifestV2RemovesFixedTenantMappingWhileV1StillRequiresIt(t *testing.T) {
|
|
draft, err := NewDraft(PairingInput{
|
|
AuthCenterURL: "https://auth.example.com", PublicBaseURL: "https://api.example.com",
|
|
WebBaseURL: "https://gateway.example.com",
|
|
}, "production")
|
|
if err != nil {
|
|
t.Fatalf("multi-tenant pairing draft rejected: %v", err)
|
|
}
|
|
applied, err := ApplyManifest(draft, ManifestApplication{
|
|
AppEnv: "production", MachineCredentialRef: "identity-machine-example",
|
|
SessionEncryptionKeyRef: "identity-session-example",
|
|
Manifest: ManifestV2{
|
|
SchemaVersion: 2, TenantMode: "multi_tenant", Issuer: "https://auth.example.com/issuer/shared",
|
|
ApplicationID: "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb",
|
|
Audience: "urn:easyai:resource:bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb",
|
|
Capabilities: []string{"oidc_login", "api_access", "machine_to_machine", "token_introspection", "session_revocation"},
|
|
Scopes: []string{"openid", "gateway.access"},
|
|
Clients: ManifestClients{
|
|
BrowserLogin: &ManifestClient{ClientID: "browser"}, MachineToMachine: &ManifestClient{ClientID: "service"},
|
|
},
|
|
TenantContext: &ManifestTenantContext{
|
|
Endpoint: "https://auth.example.com/api/v1/runtime/tenants/{tenantId}",
|
|
Audience: "urn:easyai:auth-center:tenant-context", Scope: "tenant.context.read",
|
|
},
|
|
SecurityEvents: &ManifestSecurityEvents{
|
|
TransmitterIssuer: "https://auth.example.com/ssf",
|
|
ConfigurationEndpoint: "https://auth.example.com/.well-known/ssf-configuration/ssf",
|
|
Audience: "urn:easyai:ssf:receiver:bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb",
|
|
},
|
|
},
|
|
})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if applied.SchemaVersion != 2 || applied.TenantMode != "multi_tenant" || applied.TenantID != "" ||
|
|
applied.LocalTenantKey != "" || applied.TenantContextEndpoint == "" {
|
|
t.Fatalf("unexpected multi-tenant revision: %#v", applied)
|
|
}
|
|
|
|
v1Draft := draft
|
|
v1Draft.ID = "v1-draft"
|
|
if _, err := ApplyManifest(v1Draft, ManifestApplication{AppEnv: "production", Manifest: ManifestV1{
|
|
SchemaVersion: 1, Issuer: "https://auth.example.com/issuer/shared",
|
|
TenantID: "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa", ApplicationID: "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb",
|
|
Capabilities: []string{}, Scopes: []string{}, Clients: ManifestClients{},
|
|
}}); err == nil {
|
|
t.Fatal("Manifest V1 without a fixed local tenant mapping was accepted")
|
|
}
|
|
}
|