Initial Dever 0.0.1

test/rust/runtime/auth/tenant.rs

@@ -0,0 +1,98 @@
+use super::{
+    request::{configured, request},
+    *,
+};
+use dever_runtime::auth::{Error, Identity};
+
+#[test]
+fn signed_tenant_reference_needs_provider_identity_before_becoming_storage_id() {
+    let service = configured(Some("https://unit.test"), "user.account.verify").unwrap();
+    let login = request(
+        "POST",
+        &[("Host", "unit.test"), ("Origin", "https://unit.test")],
+    );
+    let (mut context, _) = service.prepare("admin", &login, true, 100).unwrap();
+    let token = context
+        .issue("user", "session-id", Some("external-tenant"), 100)
+        .unwrap();
+    assert_eq!(
+        settings().providers["session"]
+            .verify_token(&token, "admin", 100)
+            .unwrap()
+            .tenant
+            .as_deref(),
+        Some("external-tenant")
+    );
+    context
+        .issue_cookie("user", "session-id", Some("external-tenant"), 100)
+        .unwrap();
+    let mut response = dever_runtime::api::response("{}");
+    context.publish(&mut response);
+    let value = response.headers().get("set-cookie").unwrap().as_bytes();
+    let cookie = std::str::from_utf8(value)
+        .unwrap()
+        .split(';')
+        .next()
+        .unwrap();
+    let incoming = request("GET", &[("Host", "unit.test"), ("Cookie", cookie)]);
+    let (mut verified, claims) = service.prepare("admin", &incoming, false, 100).unwrap();
+    assert_eq!(claims.unwrap().tenant.as_deref(), Some("external-tenant"));
+    assert_eq!(verified.verified_tenant(), None);
+    assert_eq!(verified.tenant_id(None).unwrap_err(), Error::Unauthorized);
+    for id in [0, -1] {
+        assert_eq!(
+            verified
+                .establish(Identity {
+                    id: "verified-user".into(),
+                    user_id: Some(7),
+                    tenant_id: Some(id)
+                })
+                .unwrap_err(),
+            Error::Unauthorized
+        );
+        assert_eq!(verified.verified_tenant(), None);
+    }
+    verified
+        .establish(Identity {
+            id: "verified-user".into(),
+            user_id: Some(7),
+            tenant_id: Some(43),
+        })
+        .unwrap();
+    assert_eq!(verified.verified_tenant(), Some(43));
+    assert_eq!(verified.tenant_id(Some(17)).unwrap(), Some(43));
+    assert_eq!(verified.tenant_id(Some(13)).unwrap_err(), Error::Internal);
+}
+
+#[test]
+#[cfg(feature = "job")]
+fn restored_job_reverifies_tenant_and_persists_the_internal_id_separately() {
+    let service = configured(Some("https://unit.test"), "user.account.verify").unwrap();
+    let claims = Claims {
+        subject: "user".into(),
+        session: "session-id".into(),
+        tenant: Some("external-tenant".into()),
+        site: "admin".into(),
+    };
+    assert!(service.trusted("other", &claims).is_err());
+    let mut context = service.trusted("session", &claims).unwrap();
+    assert_eq!(context.verified_tenant(), None);
+    assert!(
+        context
+            .job_execution("news.article.admin.create".into())
+            .is_err()
+    );
+    context
+        .establish(Identity {
+            id: "verified-user".into(),
+            user_id: Some(7),
+            tenant_id: Some(43),
+        })
+        .unwrap();
+    let execution = context
+        .job_execution("news.article.admin.create".into())
+        .unwrap();
+    assert!(
+        matches!(execution, dever_runtime::job::Execution::User { tenant: Some(reference), tenant_id: Some(43), .. } if reference == "external-tenant")
+    );
+}