63 lines
2.5 KiB
Go
63 lines
2.5 KiB
Go
package integration
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"testing"
|
|
|
|
"git.sundynix.cn/Blizzard/Veyra/internal/apperror"
|
|
"git.sundynix.cn/Blizzard/Veyra/internal/repository"
|
|
"git.sundynix.cn/Blizzard/Veyra/internal/service"
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
)
|
|
|
|
func testDevelopmentUserCredentialChange(t *testing.T, ctx context.Context, pool *pgxpool.Pool, auth *service.AuthService) {
|
|
t.Helper()
|
|
user, err := auth.ProvisionUser(ctx, "maintenance_user", "a-maintenance-password", "Maintenance", "USER")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
session, err := auth.Login(ctx, "maintenance_user", "a-maintenance-password", "app")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
repo := repository.NewIdentityRepository(pool)
|
|
updater := service.NewDevelopmentUserCredentialService(repo, true)
|
|
if _, err := service.NewDevelopmentUserCredentialService(repo, false).Set(ctx, "maintenance_user", "maintenance_new", "tiny"); !errors.Is(err, apperror.ErrForbidden) {
|
|
t.Fatal("production maintenance allowed")
|
|
}
|
|
if _, err := updater.Set(ctx, "operator", "maintenance_new", "tiny"); !errors.Is(err, apperror.ErrForbidden) {
|
|
t.Fatal("administrator changed through USER command")
|
|
}
|
|
if _, err := updater.Set(ctx, "maintenance_user", "maintenance_new", "abc"); !errors.Is(err, apperror.ErrInvalidInput) {
|
|
t.Fatal("invalid password accepted")
|
|
}
|
|
if _, err := updater.Set(ctx, "maintenance_user", "bob", "tiny"); !errors.Is(err, apperror.ErrConflict) {
|
|
t.Fatal("duplicate login accepted")
|
|
}
|
|
if _, err := auth.Authenticate(ctx, session.Token, "app"); err != nil {
|
|
t.Fatal("failed change revoked session")
|
|
}
|
|
id, err := updater.Set(ctx, "maintenance_user", "maintenance_new", "tiny")
|
|
if err != nil || id != user.ID {
|
|
t.Fatal("user identity not preserved")
|
|
}
|
|
if _, err := auth.Authenticate(ctx, session.Token, "app"); !errors.Is(err, apperror.ErrUnauthenticated) {
|
|
t.Fatal("old session remained valid")
|
|
}
|
|
if _, err := auth.Login(ctx, "maintenance_user", "a-maintenance-password", "app"); !errors.Is(err, apperror.ErrUnauthenticated) {
|
|
t.Fatal("old credentials remained valid")
|
|
}
|
|
login, err := auth.Login(ctx, "maintenance_new", "tiny", "app")
|
|
if err != nil || login.User.ID != user.ID {
|
|
t.Fatal("new credentials failed")
|
|
}
|
|
if _, err := auth.Login(ctx, "maintenance_new", "tiny", "admin"); !errors.Is(err, apperror.ErrUnauthenticated) && !errors.Is(err, apperror.ErrForbidden) {
|
|
t.Fatal("USER authenticated as administrator")
|
|
}
|
|
_, credential, err := repo.FindCredential(ctx, "maintenance_new")
|
|
if err != nil || credential.PasswordHash == "tiny" {
|
|
t.Fatal("password stored without hashing")
|
|
}
|
|
}
|