feat(master): OIDC login with group check, sessions and CSRF protection
This commit is contained in:
@@ -0,0 +1,227 @@
|
||||
package webauth
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"io"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"strings"
|
||||
"sync"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/shcizo/package-updater/internal/master/model"
|
||||
)
|
||||
|
||||
type fakeProvider struct {
|
||||
claims Claims
|
||||
err error
|
||||
gotVer string
|
||||
}
|
||||
|
||||
func (p *fakeProvider) AuthCodeURL(state, _ string) string {
|
||||
return "https://auth.example/authorize?state=" + url.QueryEscape(state)
|
||||
}
|
||||
|
||||
func (p *fakeProvider) Exchange(_ context.Context, _ string, verifier string) (Claims, error) {
|
||||
p.gotVer = verifier
|
||||
return p.claims, p.err
|
||||
}
|
||||
|
||||
type fakeStore struct {
|
||||
mu sync.Mutex
|
||||
sessions map[string]model.Session
|
||||
}
|
||||
|
||||
func newFakeStore() *fakeStore { return &fakeStore{sessions: map[string]model.Session{}} }
|
||||
|
||||
func (f *fakeStore) CreateSession(_ context.Context, s model.Session) error {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
f.sessions[s.ID] = s
|
||||
return nil
|
||||
}
|
||||
|
||||
func (f *fakeStore) GetSession(_ context.Context, id string, now time.Time) (model.Session, error) {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
s, ok := f.sessions[id]
|
||||
if !ok || !s.ExpiresAt.After(now) {
|
||||
return model.Session{}, model.ErrNotFound
|
||||
}
|
||||
return s, nil
|
||||
}
|
||||
|
||||
func (f *fakeStore) DeleteSession(_ context.Context, id string) error {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
delete(f.sessions, id)
|
||||
return nil
|
||||
}
|
||||
|
||||
func newAuth(p *fakeProvider, s *fakeStore) *Auth {
|
||||
return New(p, s, "updater-admins", true, slog.New(slog.NewTextHandler(io.Discard, nil)))
|
||||
}
|
||||
|
||||
// startLogin runs /auth/login and returns the flow cookie and the state.
|
||||
func startLogin(t *testing.T, a *Auth) (*http.Cookie, string) {
|
||||
t.Helper()
|
||||
rec := httptest.NewRecorder()
|
||||
a.Login(rec, httptest.NewRequest(http.MethodGet, "/auth/login", nil))
|
||||
require.Equal(t, http.StatusFound, rec.Code)
|
||||
loc, err := url.Parse(rec.Header().Get("Location"))
|
||||
require.NoError(t, err)
|
||||
cookies := rec.Result().Cookies()
|
||||
require.Len(t, cookies, 1)
|
||||
return cookies[0], loc.Query().Get("state")
|
||||
}
|
||||
|
||||
func callback(a *Auth, flow *http.Cookie, state string) *httptest.ResponseRecorder {
|
||||
req := httptest.NewRequest(http.MethodGet, "/auth/callback?code=c&state="+url.QueryEscape(state), nil)
|
||||
req.AddCookie(flow)
|
||||
rec := httptest.NewRecorder()
|
||||
a.Callback(rec, req)
|
||||
return rec
|
||||
}
|
||||
|
||||
func TestLogin_SetsFlowCookieAndRedirects(t *testing.T) {
|
||||
a := newAuth(&fakeProvider{}, newFakeStore())
|
||||
flow, state := startLogin(t, a)
|
||||
assert.True(t, flow.HttpOnly)
|
||||
assert.True(t, flow.Secure)
|
||||
assert.NotEmpty(t, state)
|
||||
}
|
||||
|
||||
func TestCallback_StateMismatchRejected(t *testing.T) {
|
||||
a := newAuth(&fakeProvider{}, newFakeStore())
|
||||
flow, _ := startLogin(t, a)
|
||||
rec := callback(a, flow, "forged")
|
||||
assert.Equal(t, http.StatusBadRequest, rec.Code)
|
||||
}
|
||||
|
||||
func TestCallback_UserOutsideGroupForbidden(t *testing.T) {
|
||||
store := newFakeStore()
|
||||
a := newAuth(&fakeProvider{claims: Claims{Subject: "u", Groups: []string{"family"}}}, store)
|
||||
flow, state := startLogin(t, a)
|
||||
rec := callback(a, flow, state)
|
||||
assert.Equal(t, http.StatusForbidden, rec.Code)
|
||||
assert.Empty(t, store.sessions)
|
||||
}
|
||||
|
||||
func TestCallback_ExchangeFailure(t *testing.T) {
|
||||
a := newAuth(&fakeProvider{err: errors.New("bad code")}, newFakeStore())
|
||||
flow, state := startLogin(t, a)
|
||||
assert.Equal(t, http.StatusUnauthorized, callback(a, flow, state).Code)
|
||||
}
|
||||
|
||||
func TestCallback_CreatesSession(t *testing.T) {
|
||||
store := newFakeStore()
|
||||
p := &fakeProvider{claims: Claims{Subject: "u1", Name: "Samuel", Groups: []string{"updater-admins"}}}
|
||||
a := newAuth(p, store)
|
||||
flow, state := startLogin(t, a)
|
||||
rec := callback(a, flow, state)
|
||||
|
||||
require.Equal(t, http.StatusFound, rec.Code)
|
||||
assert.Equal(t, "/", rec.Header().Get("Location"))
|
||||
assert.NotEmpty(t, p.gotVer, "the PKCE verifier from the flow cookie must reach the exchange")
|
||||
var sessionCookie *http.Cookie
|
||||
for _, c := range rec.Result().Cookies() {
|
||||
if c.Name == sessionCookieName {
|
||||
sessionCookie = c
|
||||
}
|
||||
}
|
||||
require.NotNil(t, sessionCookie)
|
||||
assert.True(t, sessionCookie.HttpOnly)
|
||||
assert.Equal(t, http.SameSiteLaxMode, sessionCookie.SameSite)
|
||||
s, ok := store.sessions[sessionCookie.Value]
|
||||
require.True(t, ok)
|
||||
assert.Equal(t, "Samuel", s.Name)
|
||||
assert.NotEmpty(t, s.CSRFToken)
|
||||
}
|
||||
|
||||
func protectedRequest(method, target string, sessionID string) *http.Request {
|
||||
req := httptest.NewRequest(method, target, nil)
|
||||
if sessionID != "" {
|
||||
req.AddCookie(&http.Cookie{Name: sessionCookieName, Value: sessionID})
|
||||
}
|
||||
return req
|
||||
}
|
||||
|
||||
func TestRequire(t *testing.T) {
|
||||
store := newFakeStore()
|
||||
store.sessions["live"] = model.Session{ID: "live", Name: "Samuel", CSRFToken: "tok", ExpiresAt: time.Now().Add(time.Hour)}
|
||||
store.sessions["old"] = model.Session{ID: "old", CSRFToken: "tok", ExpiresAt: time.Now().Add(-time.Hour)}
|
||||
a := newAuth(&fakeProvider{}, store)
|
||||
|
||||
var gotName string
|
||||
next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
s, _ := SessionFrom(r.Context())
|
||||
gotName = s.Name
|
||||
w.WriteHeader(http.StatusNoContent)
|
||||
})
|
||||
h := a.Require(next)
|
||||
|
||||
cases := []struct {
|
||||
name string
|
||||
req *http.Request
|
||||
wantCode int
|
||||
wantHeader [2]string
|
||||
}{
|
||||
{"no session GET redirects to login", protectedRequest(http.MethodGet, "/", ""), http.StatusFound, [2]string{"Location", "/auth/login"}},
|
||||
{"expired session on htmx fragment", func() *http.Request {
|
||||
r := protectedRequest(http.MethodGet, "/fragments/services", "old")
|
||||
r.Header.Set("HX-Request", "true")
|
||||
return r
|
||||
}(), http.StatusUnauthorized, [2]string{"HX-Redirect", "/auth/login"}},
|
||||
{"event-stream without session gets plain 401", func() *http.Request {
|
||||
r := protectedRequest(http.MethodGet, "/events", "")
|
||||
r.Header.Set("Accept", "text/event-stream")
|
||||
return r
|
||||
}(), http.StatusUnauthorized, [2]string{"Location", ""}},
|
||||
{"no session POST", protectedRequest(http.MethodPost, "/agents", ""), http.StatusUnauthorized, [2]string{}},
|
||||
{"POST without CSRF", protectedRequest(http.MethodPost, "/agents", "live"), http.StatusForbidden, [2]string{}},
|
||||
{"POST with CSRF header", func() *http.Request {
|
||||
r := protectedRequest(http.MethodPost, "/agents", "live")
|
||||
r.Header.Set("X-CSRF-Token", "tok")
|
||||
return r
|
||||
}(), http.StatusNoContent, [2]string{}},
|
||||
{"POST with CSRF form field", func() *http.Request {
|
||||
r := httptest.NewRequest(http.MethodPost, "/agents", strings.NewReader("csrf_token=tok"))
|
||||
r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
r.AddCookie(&http.Cookie{Name: sessionCookieName, Value: "live"})
|
||||
return r
|
||||
}(), http.StatusNoContent, [2]string{}},
|
||||
{"GET with session", protectedRequest(http.MethodGet, "/", "live"), http.StatusNoContent, [2]string{}},
|
||||
}
|
||||
for _, c := range cases {
|
||||
t.Run(c.name, func(t *testing.T) {
|
||||
rec := httptest.NewRecorder()
|
||||
h.ServeHTTP(rec, c.req)
|
||||
assert.Equal(t, c.wantCode, rec.Code)
|
||||
if c.wantHeader[0] != "" {
|
||||
assert.Equal(t, c.wantHeader[1], rec.Header().Get(c.wantHeader[0]))
|
||||
}
|
||||
})
|
||||
}
|
||||
assert.Equal(t, "Samuel", gotName)
|
||||
}
|
||||
|
||||
func TestLogout_DeletesSession(t *testing.T) {
|
||||
store := newFakeStore()
|
||||
store.sessions["live"] = model.Session{ID: "live", CSRFToken: "tok", ExpiresAt: time.Now().Add(time.Hour)}
|
||||
a := newAuth(&fakeProvider{}, store)
|
||||
|
||||
req := protectedRequest(http.MethodPost, "/auth/logout", "live")
|
||||
req.Header.Set("X-CSRF-Token", "tok")
|
||||
rec := httptest.NewRecorder()
|
||||
a.Require(http.HandlerFunc(a.Logout)).ServeHTTP(rec, req)
|
||||
|
||||
assert.Equal(t, http.StatusOK, rec.Code)
|
||||
assert.Empty(t, store.sessions)
|
||||
}
|
||||
Reference in New Issue
Block a user