mirror of
https://github.com/pomerium/pomerium.git
synced 2025-05-01 03:16:31 +02:00
dbd7f55b20
* databroker: add databroker, identity manager, update cache (#864) * databroker: add databroker, identity manager, update cache * fix cache tests * directory service (#885) * directory: add google and okta * add onelogin * add directory provider * initialize before sync, upate google provider, remove dead code * add azure provider * fix azure provider * fix gitlab * add gitlab test, fix azure test * hook up okta * remove dead code * fix tests * fix flaky test * authorize: use databroker data for rego policy (#904) * wip * add directory provider * initialize before sync, upate google provider, remove dead code * fix flaky test * update authorize to use databroker data * implement signed jwt * wait for session and user to appear * fix test * directory service (#885) * directory: add google and okta * add onelogin * add directory provider * initialize before sync, upate google provider, remove dead code * add azure provider * fix azure provider * fix gitlab * add gitlab test, fix azure test * hook up okta * remove dead code * fix tests * fix flaky test * remove log line * only redirect when no session id exists * prepare rego query as part of create * return on ctx done * retry on disconnect for sync * move jwt signing * use != * use parent ctx for wait * remove session state, remove logs * rename function * add log message * pre-allocate slice * use errgroup * return nil on eof for sync * move check * disable timeout on gRPC requests in envoy * fix gitlab test * use v4 backoff * authenticate: databroker changes (#914) * wip * add directory provider * initialize before sync, upate google provider, remove dead code * fix flaky test * update authorize to use databroker data * implement signed jwt * wait for session and user to appear * fix test * directory service (#885) * directory: add google and okta * add onelogin * add directory provider * initialize before sync, upate google provider, remove dead code * add azure provider * fix azure provider * fix gitlab * add gitlab test, fix azure test * hook up okta * remove dead code * fix tests * fix flaky test * remove log line * only redirect when no session id exists * prepare rego query as part of create * return on ctx done * retry on disconnect for sync * move jwt signing * use != * use parent ctx for wait * remove session state, remove logs * rename function * add log message * pre-allocate slice * use errgroup * return nil on eof for sync * move check * disable timeout on gRPC requests in envoy * fix dashboard * delete session on logout * permanently delete sessions once they are marked as deleted * remove permanent delete * fix tests * remove groups and refresh test * databroker: remove dead code, rename cache url, move dashboard (#925) * wip * add directory provider * initialize before sync, upate google provider, remove dead code * fix flaky test * update authorize to use databroker data * implement signed jwt * wait for session and user to appear * fix test * directory service (#885) * directory: add google and okta * add onelogin * add directory provider * initialize before sync, upate google provider, remove dead code * add azure provider * fix azure provider * fix gitlab * add gitlab test, fix azure test * hook up okta * remove dead code * fix tests * fix flaky test * remove log line * only redirect when no session id exists * prepare rego query as part of create * return on ctx done * retry on disconnect for sync * move jwt signing * use != * use parent ctx for wait * remove session state, remove logs * rename function * add log message * pre-allocate slice * use errgroup * return nil on eof for sync * move check * disable timeout on gRPC requests in envoy * fix dashboard * delete session on logout * permanently delete sessions once they are marked as deleted * remove permanent delete * fix tests * remove cache service * remove kv * remove refresh docs * remove obsolete cache docs * add databroker url option * cache: use memberlist to detect multiple instances * add databroker service url * remove cache service * remove kv * remove refresh docs * remove obsolete cache docs * add databroker url option * cache: use memberlist to detect multiple instances * add databroker service url * wip * remove groups and refresh test * fix redirect, signout * remove databroker client from proxy * remove unused method * remove user dashboard test * handle missing session ids * session: reject sessions with no id * sessions: invalidate old sessions via databroker server version (#930) * session: add a version field tied to the databroker server version that can be used to invalidate sessions * fix tests * add log * authenticate: create user record immediately, call "get" directly in authorize (#931)
86 lines
2.4 KiB
Go
86 lines
2.4 KiB
Go
package manager
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/golang/protobuf/ptypes"
|
|
"github.com/stretchr/testify/assert"
|
|
"google.golang.org/protobuf/types/known/anypb"
|
|
"google.golang.org/protobuf/types/known/wrapperspb"
|
|
|
|
"github.com/pomerium/pomerium/internal/grpc/session"
|
|
)
|
|
|
|
func TestUser_UnmarshalJSON(t *testing.T) {
|
|
var u User
|
|
err := json.Unmarshal([]byte(`{
|
|
"name": "joe",
|
|
"email": "joe@test.com",
|
|
"some-other-claim": "xyz"
|
|
}`), &u)
|
|
assert.NoError(t, err)
|
|
assert.NotNil(t, u.User)
|
|
assert.Equal(t, "joe", u.User.Name)
|
|
assert.Equal(t, "joe@test.com", u.User.Email)
|
|
anyv, _ := ptypes.MarshalAny(&wrapperspb.StringValue{Value: "xyz"})
|
|
assert.Equal(t, map[string]*anypb.Any{
|
|
"some-other-claim": anyv,
|
|
}, u.Claims)
|
|
}
|
|
|
|
func TestSession_NextRefresh(t *testing.T) {
|
|
tm1 := time.Date(2020, 6, 5, 12, 0, 0, 0, time.UTC)
|
|
s := Session{
|
|
Session: &session.Session{},
|
|
lastRefresh: tm1,
|
|
gracePeriod: time.Second * 10,
|
|
coolOffDuration: time.Minute,
|
|
}
|
|
assert.Equal(t, tm1.Add(time.Minute), s.NextRefresh())
|
|
|
|
tm2 := time.Date(2020, 6, 5, 13, 0, 0, 0, time.UTC)
|
|
pbtm2, _ := ptypes.TimestampProto(tm2)
|
|
s.OauthToken = &session.OAuthToken{
|
|
ExpiresAt: pbtm2,
|
|
}
|
|
assert.Equal(t, tm2.Add(-time.Second*10), s.NextRefresh())
|
|
|
|
tm3 := time.Date(2020, 6, 5, 12, 30, 0, 0, time.UTC)
|
|
pbtm3, _ := ptypes.TimestampProto(tm3)
|
|
s.IdToken = &session.IDToken{
|
|
ExpiresAt: pbtm3,
|
|
}
|
|
assert.Equal(t, tm3.Add(-time.Second*10), s.NextRefresh())
|
|
|
|
tm4 := time.Date(2020, 6, 5, 12, 15, 0, 0, time.UTC)
|
|
pbtm4, _ := ptypes.TimestampProto(tm4)
|
|
s.ExpiresAt = pbtm4
|
|
assert.Equal(t, tm4, s.NextRefresh())
|
|
}
|
|
|
|
func TestSession_UnmarshalJSON(t *testing.T) {
|
|
tm := time.Date(2020, 6, 5, 12, 0, 0, 0, time.UTC)
|
|
pbtm, _ := ptypes.TimestampProto(tm)
|
|
var s Session
|
|
err := json.Unmarshal([]byte(`{
|
|
"iss": "https://some.issuer.com",
|
|
"sub": "subject",
|
|
"exp": `+fmt.Sprint(tm.Unix())+`,
|
|
"iat": `+fmt.Sprint(tm.Unix())+`,
|
|
"some-other-claim": "xyz"
|
|
}`), &s)
|
|
assert.NoError(t, err)
|
|
assert.NotNil(t, s.Session)
|
|
assert.NotNil(t, s.Session.IdToken)
|
|
assert.Equal(t, "https://some.issuer.com", s.Session.IdToken.Issuer)
|
|
assert.Equal(t, "subject", s.Session.IdToken.Subject)
|
|
assert.Equal(t, pbtm, s.Session.IdToken.ExpiresAt)
|
|
assert.Equal(t, pbtm, s.Session.IdToken.IssuedAt)
|
|
anyv, _ := ptypes.MarshalAny(&wrapperspb.StringValue{Value: "xyz"})
|
|
assert.Equal(t, map[string]*anypb.Any{
|
|
"some-other-claim": anyv,
|
|
}, s.Claims)
|
|
}
|