99 lines
3.4 KiB
Rust
99 lines
3.4 KiB
Rust
use super::{
|
|
request::{configured, request},
|
|
*,
|
|
};
|
|
use dever_runtime::auth::{Error, Identity};
|
|
|
|
#[test]
|
|
fn signed_tenant_reference_needs_provider_identity_before_becoming_storage_id() {
|
|
let service = configured(Some("https://unit.test"), "user.account.verify").unwrap();
|
|
let login = request(
|
|
"POST",
|
|
&[("Host", "unit.test"), ("Origin", "https://unit.test")],
|
|
);
|
|
let (mut context, _) = service.prepare("admin", &login, true, 100).unwrap();
|
|
let token = context
|
|
.issue("user", "session-id", Some("external-tenant"), 100)
|
|
.unwrap();
|
|
assert_eq!(
|
|
settings().providers["session"]
|
|
.verify_token(&token, "admin", 100)
|
|
.unwrap()
|
|
.tenant
|
|
.as_deref(),
|
|
Some("external-tenant")
|
|
);
|
|
context
|
|
.issue_cookie("user", "session-id", Some("external-tenant"), 100)
|
|
.unwrap();
|
|
let mut response = dever_runtime::api::response("{}");
|
|
context.publish(&mut response);
|
|
let value = response.headers().get("set-cookie").unwrap().as_bytes();
|
|
let cookie = std::str::from_utf8(value)
|
|
.unwrap()
|
|
.split(';')
|
|
.next()
|
|
.unwrap();
|
|
let incoming = request("GET", &[("Host", "unit.test"), ("Cookie", cookie)]);
|
|
let (mut verified, claims) = service.prepare("admin", &incoming, false, 100).unwrap();
|
|
assert_eq!(claims.unwrap().tenant.as_deref(), Some("external-tenant"));
|
|
assert_eq!(verified.verified_tenant(), None);
|
|
assert_eq!(verified.tenant_id(None).unwrap_err(), Error::Unauthorized);
|
|
for id in [0, -1] {
|
|
assert_eq!(
|
|
verified
|
|
.establish(Identity {
|
|
id: "verified-user".into(),
|
|
user_id: Some(7),
|
|
tenant_id: Some(id)
|
|
})
|
|
.unwrap_err(),
|
|
Error::Unauthorized
|
|
);
|
|
assert_eq!(verified.verified_tenant(), None);
|
|
}
|
|
verified
|
|
.establish(Identity {
|
|
id: "verified-user".into(),
|
|
user_id: Some(7),
|
|
tenant_id: Some(43),
|
|
})
|
|
.unwrap();
|
|
assert_eq!(verified.verified_tenant(), Some(43));
|
|
assert_eq!(verified.tenant_id(Some(17)).unwrap(), Some(43));
|
|
assert_eq!(verified.tenant_id(Some(13)).unwrap_err(), Error::Internal);
|
|
}
|
|
|
|
#[test]
|
|
#[cfg(feature = "job")]
|
|
fn restored_job_reverifies_tenant_and_persists_the_internal_id_separately() {
|
|
let service = configured(Some("https://unit.test"), "user.account.verify").unwrap();
|
|
let claims = Claims {
|
|
subject: "user".into(),
|
|
session: "session-id".into(),
|
|
tenant: Some("external-tenant".into()),
|
|
site: "admin".into(),
|
|
};
|
|
assert!(service.trusted("other", &claims).is_err());
|
|
let mut context = service.trusted("session", &claims).unwrap();
|
|
assert_eq!(context.verified_tenant(), None);
|
|
assert!(
|
|
context
|
|
.job_execution("news.article.admin.create".into())
|
|
.is_err()
|
|
);
|
|
context
|
|
.establish(Identity {
|
|
id: "verified-user".into(),
|
|
user_id: Some(7),
|
|
tenant_id: Some(43),
|
|
})
|
|
.unwrap();
|
|
let execution = context
|
|
.job_execution("news.article.admin.create".into())
|
|
.unwrap();
|
|
assert!(
|
|
matches!(execution, dever_runtime::job::Execution::User { tenant: Some(reference), tenant_id: Some(43), .. } if reference == "external-tenant")
|
|
);
|
|
}
|