| 1 | package main |
| 2 | |
| 3 | // 🤖 GitHub code-flow door tests (github.go, #1112): a fake GitHub — one |
| 4 | // httptest server playing both the token-exchange and /user endpoints — |
| 5 | // swapped in via the package URL seams. The oidc suite covers the shared |
| 6 | // anchor machinery; these pin the exchange contract, the resolve-or-create |
| 7 | // path keying on the numeric id, and the GET half of the return trampoline. |
| 8 | |
| 9 | import ( |
| 10 | "encoding/json" |
| 11 | "fmt" |
| 12 | "net/http" |
| 13 | "net/http/httptest" |
| 14 | "strings" |
| 15 | "testing" |
| 16 | ) |
| 17 | |
| 18 | // fakeGithub answers the exchange with a token whose validity it controls, |
| 19 | // and /user with a fixed numeric id. Codes prefixed "bad" refuse. |
| 20 | func fakeGithub(t *testing.T, userID int64) *httptest.Server { |
| 21 | t.Helper() |
| 22 | mux := http.NewServeMux() |
| 23 | mux.HandleFunc("POST /login/oauth/access_token", func(w http.ResponseWriter, r *http.Request) { |
| 24 | if err := r.ParseForm(); err != nil || r.PostFormValue("client_secret") != "gh-secret" { |
| 25 | w.Write([]byte(`{"error":"bad_client"}`)) |
| 26 | return |
| 27 | } |
| 28 | if strings.HasPrefix(r.PostFormValue("code"), "bad") { |
| 29 | w.Write([]byte(`{"error":"bad_verification_code"}`)) |
| 30 | return |
| 31 | } |
| 32 | w.Write([]byte(`{"access_token":"gho_test","token_type":"bearer"}`)) |
| 33 | }) |
| 34 | mux.HandleFunc("GET /user", func(w http.ResponseWriter, r *http.Request) { |
| 35 | if r.Header.Get("Authorization") != "Bearer gho_test" { |
| 36 | w.WriteHeader(http.StatusUnauthorized) |
| 37 | return |
| 38 | } |
| 39 | fmt.Fprintf(w, `{"id":%d,"login":"someone"}`, userID) |
| 40 | }) |
| 41 | fake := httptest.NewServer(mux) |
| 42 | t.Cleanup(fake.Close) |
| 43 | return fake |
| 44 | } |
| 45 | |
| 46 | func githubServer(t *testing.T, userID int64) (*httptest.Server, *Server) { |
| 47 | t.Helper() |
| 48 | ts, s := newTestServer(t) |
| 49 | fake := fakeGithub(t, userID) |
| 50 | oldTok, oldUser := githubTokenURL, githubUserURL |
| 51 | githubTokenURL = fake.URL + "/login/oauth/access_token" |
| 52 | githubUserURL = fake.URL + "/user" |
| 53 | t.Cleanup(func() { githubTokenURL, githubUserURL = oldTok, oldUser }) |
| 54 | s.github = &githubDoor{clientID: "gh-client", secret: "gh-secret", pepper: []byte("gh-pepper")} |
| 55 | return ts, s |
| 56 | } |
| 57 | |
| 58 | func githubVerifyReq(t *testing.T, ts *httptest.Server, headers map[string]string, body map[string]any) *http.Response { |
| 59 | t.Helper() |
| 60 | b, _ := json.Marshal(body) |
| 61 | return do(t, "POST", ts.URL+"/api/oidc/github/verify", "", headers, b) |
| 62 | } |
| 63 | |
| 64 | func TestGithubDisabledIs404(t *testing.T) { |
| 65 | ts, _ := newTestServer(t) |
| 66 | if resp := githubVerifyReq(t, ts, nil, map[string]any{"code": "x"}); resp.StatusCode != http.StatusNotFound { |
| 67 | t.Fatalf("disabled verify: got %d, want 404", resp.StatusCode) |
| 68 | } |
| 69 | if resp := do(t, "GET", ts.URL+"/oidc/return?code=x&state=web.x", "", nil, nil); resp.StatusCode != http.StatusNotFound { |
| 70 | t.Fatalf("disabled GET return: got %d, want 404", resp.StatusCode) |
| 71 | } |
| 72 | } |
| 73 | |
| 74 | func TestGithubSignInCreatesThenResolvesAccount(t *testing.T) { |
| 75 | ts, _ := githubServer(t, 4242) |
| 76 | var first struct { |
| 77 | Token string `json:"token"` |
| 78 | Proof string `json:"proof"` |
| 79 | Created bool `json:"created"` |
| 80 | } |
| 81 | resp := githubVerifyReq(t, ts, nil, map[string]any{"code": "good-1"}) |
| 82 | if resp.StatusCode != http.StatusOK { |
| 83 | t.Fatalf("first sign-in: got %d, want 200", resp.StatusCode) |
| 84 | } |
| 85 | if err := json.NewDecoder(resp.Body).Decode(&first); err != nil || first.Token == "" || first.Proof == "" || !first.Created { |
| 86 | t.Fatalf("first sign-in: bad body (%+v, err %v)", first, err) |
| 87 | } |
| 88 | |
| 89 | // The same numeric id — through a different code — is the SAME account. |
| 90 | var second struct { |
| 91 | Token string `json:"token"` |
| 92 | Created bool `json:"created"` |
| 93 | } |
| 94 | resp = githubVerifyReq(t, ts, nil, map[string]any{"code": "good-2"}) |
| 95 | if resp.StatusCode != http.StatusOK { |
| 96 | t.Fatalf("second sign-in: got %d, want 200", resp.StatusCode) |
| 97 | } |
| 98 | if err := json.NewDecoder(resp.Body).Decode(&second); err != nil || second.Created { |
| 99 | t.Fatalf("second sign-in should resolve, not create (%+v, err %v)", second, err) |
| 100 | } |
| 101 | } |
| 102 | |
| 103 | func TestGithubBadCodeIs401(t *testing.T) { |
| 104 | ts, _ := githubServer(t, 4242) |
| 105 | if resp := githubVerifyReq(t, ts, nil, map[string]any{"code": "bad-code"}); resp.StatusCode != http.StatusUnauthorized { |
| 106 | t.Fatalf("bad code: got %d, want 401", resp.StatusCode) |
| 107 | } |
| 108 | } |
| 109 | |
| 110 | func TestGithubReturnTrampoline(t *testing.T) { |
| 111 | ts, _ := githubServer(t, 4242) |
| 112 | client := &http.Client{CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }} |
| 113 | resp, err := client.Get(ts.URL + "/oidc/return?code=abc&state=web.r1") |
| 114 | if err != nil { |
| 115 | t.Fatal(err) |
| 116 | } |
| 117 | if resp.StatusCode != http.StatusSeeOther { |
| 118 | t.Fatalf("web state: got %d, want 303", resp.StatusCode) |
| 119 | } |
| 120 | if loc := resp.Header.Get("Location"); loc != "/#oauth=abc&state=web.r1" { |
| 121 | t.Fatalf("web state location: %q", loc) |
| 122 | } |
| 123 | resp, err = client.Get(ts.URL + "/oidc/return?code=abc&state=mac.r2") |
| 124 | if err != nil { |
| 125 | t.Fatal(err) |
| 126 | } |
| 127 | if loc := resp.Header.Get("Location"); !strings.HasPrefix(loc, oidcReturnScheme+"#state=mac.r2&code=abc") { |
| 128 | t.Fatalf("native state location: %q", loc) |
| 129 | } |
| 130 | } |
| 131 | |
| 132 | // The regression Paul hit live: the github anchor stored fine (and merges |
| 133 | // moved it) but the listing/removal surfaces spoke only oidcProviderNames, |
| 134 | // so it was invisible and un-removable. Pin the whole loop: sign in, LIST |
| 135 | // the anchor, and confirm the removal ROUTE recognizes the kind (the |
| 136 | // last-method 409 — not the unknown-kind 400). |
| 137 | func TestGithubAnchorListsAndRoutesRemoval(t *testing.T) { |
| 138 | ts, s := githubServer(t, 9001) |
| 139 | var signin struct { |
| 140 | Token string `json:"token"` |
| 141 | Proof string `json:"proof"` |
| 142 | } |
| 143 | resp := githubVerifyReq(t, ts, nil, map[string]any{"code": "good"}) |
| 144 | if resp.StatusCode != http.StatusOK { |
| 145 | t.Fatalf("sign-in: got %d", resp.StatusCode) |
| 146 | } |
| 147 | if err := json.NewDecoder(resp.Body).Decode(&signin); err != nil { |
| 148 | t.Fatal(err) |
| 149 | } |
| 150 | |
| 151 | resp = do(t, "GET", ts.URL+"/api/anchors", signin.Token, nil, nil) |
| 152 | if resp.StatusCode != http.StatusOK { |
| 153 | t.Fatalf("list: got %d", resp.StatusCode) |
| 154 | } |
| 155 | var listing struct { |
| 156 | Anchors []struct { |
| 157 | Kind string `json:"kind"` |
| 158 | ID string `json:"id"` |
| 159 | } `json:"anchors"` |
| 160 | } |
| 161 | if err := json.NewDecoder(resp.Body).Decode(&listing); err != nil { |
| 162 | t.Fatal(err) |
| 163 | } |
| 164 | ghID := "" |
| 165 | for _, a := range listing.Anchors { |
| 166 | if a.Kind == "github" { |
| 167 | ghID = a.ID |
| 168 | } |
| 169 | } |
| 170 | if ghID == "" { |
| 171 | t.Fatalf("github anchor missing from listing: %+v", listing.Anchors) |
| 172 | } |
| 173 | _ = s |
| 174 | |
| 175 | // Its removal must ROUTE (the one method on the account → the |
| 176 | // last-method 409, never the unknown-kind 400). |
| 177 | resp = do(t, "DELETE", ts.URL+"/api/anchors/github/"+ghID, signin.Token, |
| 178 | map[string]string{"X-Ceremony-Proof": signin.Proof}, nil) |
| 179 | if resp.StatusCode != http.StatusConflict { |
| 180 | t.Fatalf("remove route: got %d, want 409 (last method)", resp.StatusCode) |
| 181 | } |
| 182 | } |
| 183 | |
amadan