platform/otdfctl/pkg/auth/provider_test.go at bc0c2e0e1a5e6d0e10b0d5eccbaca039e1910647 · opentdf/platform · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
package auth

import (
	"context"
	"testing"
	"time"

	"github.com/opentdf/platform/otdfctl/pkg/profiles"
	"github.com/opentdf/platform/sdk"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
	"golang.org/x/oauth2"
)

type fakeProvider struct {
	sdkCalled      bool
	validateCalled bool
	getTokenCalled bool
	token          *oauth2.Token
}

func (f *fakeProvider) SDKAuthOption(_ *profiles.OtdfctlProfileStore) (sdk.Option, error) {
	f.sdkCalled = true
	return sdk.WithInsecurePlaintextConn(), nil
}

func (f *fakeProvider) Validate(_ context.Context, _ *profiles.OtdfctlProfileStore) error {
	f.validateCalled = true
	return nil
}

func (f *fakeProvider) GetToken(_ context.Context, _ *profiles.OtdfctlProfileStore) (*oauth2.Token, error) {
	f.getTokenCalled = true
	return f.token, nil
}

func newProfileWithAuthCreds(t *testing.T, creds profiles.AuthCredentials) *profiles.OtdfctlProfileStore {
	t.Helper()
	store, err := profiles.NewOtdfctlProfileStore(profiles.ProfileDriverMemory, &profiles.ProfileConfig{
		Name:     "test",
		Endpoint: "http://localhost:8080",
	}, true)
	require.NoError(t, err)
	require.NoError(t, store.SetAuthCredentials(creds))
	return store
}

func TestRegisterProvider_Dispatch(t *testing.T) {
	const authType = "custom-dispatch-test"
	fake := &fakeProvider{token: &oauth2.Token{AccessToken: "tok"}}
	RegisterProvider(authType, fake)

	profile := newProfileWithAuthCreds(t, profiles.AuthCredentials{AuthType: authType})

	_, err := GetSDKAuthOptionFromProfile(profile)
	require.NoError(t, err)
	assert.True(t, fake.sdkCalled)

	require.NoError(t, ValidateProfileAuthCredentials(context.Background(), profile))
	assert.True(t, fake.validateCalled)

	tok, err := GetTokenWithProfile(context.Background(), profile)
	require.NoError(t, err)
	assert.True(t, fake.getTokenCalled)
	assert.Equal(t, "tok", tok.AccessToken)
}

func TestUnknownAuthType(t *testing.T) {
	profile := newProfileWithAuthCreds(t, profiles.AuthCredentials{AuthType: "not-registered"})

	_, err := GetSDKAuthOptionFromProfile(profile)
	require.ErrorIs(t, err, ErrInvalidAuthType)

	err = ValidateProfileAuthCredentials(context.Background(), profile)
	require.ErrorIs(t, err, ErrInvalidAuthType)

	_, err = GetTokenWithProfile(context.Background(), profile)
	require.ErrorIs(t, err, ErrInvalidAuthType)
}

func TestEmptyAuthType_Validate(t *testing.T) {
	profile := newProfileWithAuthCreds(t, profiles.AuthCredentials{AuthType: ""})

	err := ValidateProfileAuthCredentials(context.Background(), profile)
	require.ErrorIs(t, err, ErrProfileCredentialsNotFound)
}

func TestBuiltinAccessTokenValidation(t *testing.T) {
	valid := newProfileWithAuthCreds(t, profiles.AuthCredentials{
		AuthType: profiles.AuthTypeAccessToken,
		AccessToken: profiles.AuthCredentialsAccessToken{
			AccessToken: "abc",
			Expiration:  time.Now().Add(time.Hour).Unix(),
		},
	})
	require.NoError(t, ValidateProfileAuthCredentials(context.Background(), valid))

	expired := newProfileWithAuthCreds(t, profiles.AuthCredentials{
		AuthType: profiles.AuthTypeAccessToken,
		AccessToken: profiles.AuthCredentialsAccessToken{
			AccessToken: "abc",
			Expiration:  time.Now().Add(-time.Hour).Unix(),
		},
	})
	require.ErrorIs(t, ValidateProfileAuthCredentials(context.Background(), expired), ErrAccessTokenExpired)
}