refactor(user): apply chanoges to hurl tests
This commit is contained in:
Edouard Vanbelle
+26
-26
@@ -98,11 +98,11 @@ GET {{base_url}}/api/auth/me
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.username" == "{{username}}"
|
||||
jsonpath "$.full.user.username" == "{{username}}"
|
||||
# federation_kind is skip_serializing_if=Option::is_none, so a
|
||||
# local user's response OMITS the field entirely.
|
||||
jsonpath "$.federation_kind" not exists
|
||||
jsonpath "$.federation_issuer" not exists
|
||||
jsonpath "$.full.federation_kind" not exists
|
||||
jsonpath "$.full.federation_issuer" not exists
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
@@ -202,8 +202,8 @@ GET {{base_url}}/api/auth/me
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.federation_kind" not exists
|
||||
jsonpath "$.federation_issuer" not exists
|
||||
jsonpath "$.full.federation_kind" not exists
|
||||
jsonpath "$.full.federation_issuer" not exists
|
||||
|
||||
|
||||
# ═════════════════════════════════════════════════════════════
|
||||
@@ -252,8 +252,8 @@ GET {{base_url}}/api/auth/me
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.federation_kind" not exists
|
||||
jsonpath "$.federation_issuer" not exists
|
||||
jsonpath "$.full.federation_kind" not exists
|
||||
jsonpath "$.full.federation_issuer" not exists
|
||||
|
||||
|
||||
# ═════════════════════════════════════════════════════════════
|
||||
@@ -307,9 +307,9 @@ GET {{base_url}}/api/auth/me
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.username" == "{{username}}"
|
||||
jsonpath "$.federation_kind" == "oidc"
|
||||
jsonpath "$.federation_issuer" == "{{oidc_issuer}}"
|
||||
jsonpath "$.full.user.username" == "{{username}}"
|
||||
jsonpath "$.full.federation_kind" == "oidc"
|
||||
jsonpath "$.full.federation_issuer" == "{{oidc_issuer}}"
|
||||
|
||||
|
||||
# Scenario 9 — unlink success (admin has a password, so the
|
||||
@@ -326,8 +326,8 @@ GET {{base_url}}/api/auth/me
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.federation_kind" not exists
|
||||
jsonpath "$.federation_issuer" not exists
|
||||
jsonpath "$.full.federation_kind" not exists
|
||||
jsonpath "$.full.federation_issuer" not exists
|
||||
|
||||
|
||||
# ═════════════════════════════════════════════════════════════
|
||||
@@ -380,7 +380,7 @@ GET {{base_url}}/api/auth/me
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.federation_kind" == "oidc"
|
||||
jsonpath "$.full.federation_kind" == "oidc"
|
||||
|
||||
|
||||
# Unlink to reset state before the auto-link scenarios.
|
||||
@@ -447,9 +447,9 @@ HTTP 200
|
||||
[Asserts]
|
||||
# Auto-link resolved to the pre-existing admin, NOT a fresh
|
||||
# JIT-provisioned user. The load-bearing assertion.
|
||||
jsonpath "$.user.username" == "{{username}}"
|
||||
jsonpath "$.user.federation_kind" == "oidc"
|
||||
jsonpath "$.user.federation_issuer" == "{{oidc_issuer}}"
|
||||
jsonpath "$.user.full.user.username" == "{{username}}"
|
||||
jsonpath "$.user.full.federation_kind" == "oidc"
|
||||
jsonpath "$.user.full.federation_issuer" == "{{oidc_issuer}}"
|
||||
[Captures]
|
||||
# Fresh cookies replace the password session's; capture the
|
||||
# new CSRF for the unlink below.
|
||||
@@ -463,9 +463,9 @@ GET {{base_url}}/api/auth/me
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.username" == "{{username}}"
|
||||
jsonpath "$.federation_kind" == "oidc"
|
||||
jsonpath "$.federation_issuer" == "{{oidc_issuer}}"
|
||||
jsonpath "$.full.user.username" == "{{username}}"
|
||||
jsonpath "$.full.federation_kind" == "oidc"
|
||||
jsonpath "$.full.federation_issuer" == "{{oidc_issuer}}"
|
||||
|
||||
|
||||
# Reset admin state before the next scenario (auto-link would
|
||||
@@ -535,7 +535,7 @@ GET {{base_url}}/api/auth/me
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.federation_kind" not exists
|
||||
jsonpath "$.full.federation_kind" not exists
|
||||
|
||||
|
||||
# Reset fake IdP state (email_verified back to true, sub back
|
||||
@@ -599,7 +599,7 @@ X-CSRF-Token: {{autolink_csrf_token}}
|
||||
|
||||
HTTP 201
|
||||
[Captures]
|
||||
alias_user_id: jsonpath "$.id"
|
||||
alias_user_id: jsonpath "$.user.id"
|
||||
|
||||
|
||||
# Point the fake IdP at a fresh sub with admin's email. Both
|
||||
@@ -636,7 +636,7 @@ GET {{base_url}}/api/auth/me
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.federation_kind" not exists
|
||||
jsonpath "$.full.federation_kind" not exists
|
||||
|
||||
|
||||
# Cleanup — delete the collider so later scenarios see the same
|
||||
@@ -701,8 +701,8 @@ Content-Type: application/json
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.user.username" == "oidc_user"
|
||||
jsonpath "$.user.federation_kind" == "oidc"
|
||||
jsonpath "$.user.full.user.username" == "oidc_user"
|
||||
jsonpath "$.user.full.federation_kind" == "oidc"
|
||||
[Captures]
|
||||
# Fresh CSRF from the OIDC session cookies — the admin CSRFs
|
||||
# won't validate against these new cookies.
|
||||
@@ -730,5 +730,5 @@ GET {{base_url}}/api/auth/me
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.federation_kind" == "oidc"
|
||||
jsonpath "$.federation_issuer" == "{{oidc_issuer}}"
|
||||
jsonpath "$.full.federation_kind" == "oidc"
|
||||
jsonpath "$.full.federation_issuer" == "{{oidc_issuer}}"
|
||||
|
||||
+19
-19
@@ -172,7 +172,7 @@ Content-Type: application/json
|
||||
|
||||
HTTP 200
|
||||
[Captures]
|
||||
oidc_session_user: jsonpath "$.user.username"
|
||||
oidc_session_user: jsonpath "$.user.full.user.username"
|
||||
# Snapshotted so Step 7's refresh can prove the tokens rotated
|
||||
# rather than being re-issued unchanged. The refresh handler in
|
||||
# auth_handler.rs always rotates all three cookies (access JWT,
|
||||
@@ -184,8 +184,8 @@ initial_access_token: jsonpath "$.access_token"
|
||||
initial_refresh_token: jsonpath "$.refresh_token"
|
||||
initial_csrf_token: cookie "oxicloud_csrf"
|
||||
[Asserts]
|
||||
jsonpath "$.user.username" == "oidc_user"
|
||||
jsonpath "$.user.email" == "oidc@example.com"
|
||||
jsonpath "$.user.full.user.username" == "oidc_user"
|
||||
jsonpath "$.user.full.user.email" == "oidc@example.com"
|
||||
jsonpath "$.access_token" isString
|
||||
# Multiple Set-Cookie headers come back as a list of values, so
|
||||
# `contains` only matches whole-element strings. Each cookie shows up
|
||||
@@ -211,10 +211,10 @@ HTTP 200
|
||||
# Stash the user id for the re-login check in Step 10 below — a
|
||||
# second OIDC flow with the same `sub` must resolve back to this
|
||||
# exact user, not silently create a duplicate.
|
||||
oidc_user_id: jsonpath "$.id"
|
||||
oidc_user_id: jsonpath "$.full.user.id"
|
||||
[Asserts]
|
||||
jsonpath "$.username" == "oidc_user"
|
||||
jsonpath "$.email" == "oidc@example.com"
|
||||
jsonpath "$.full.user.username" == "oidc_user"
|
||||
jsonpath "$.full.user.email" == "oidc@example.com"
|
||||
# Post the federation-identity rename (docs/plan/ocm.md § Schema
|
||||
# rename) UserDto exposes federation_kind + federation_issuer as
|
||||
# separate nullable fields. Local users have both null; OIDC users
|
||||
@@ -222,24 +222,24 @@ jsonpath "$.email" == "oidc@example.com"
|
||||
# the fake IdP (tests/oidc/fake_idp/server.js) that URL is the
|
||||
# issuer published in its discovery document, which matches
|
||||
# `oidc_issuer` from test.env.
|
||||
jsonpath "$.federation_kind" == "oidc"
|
||||
jsonpath "$.federation_issuer" == "{{oidc_issuer}}"
|
||||
jsonpath "$.full.federation_kind" == "oidc"
|
||||
jsonpath "$.full.federation_issuer" == "{{oidc_issuer}}"
|
||||
# Full claim round-trip — the fake IdP (tests/oidc/fake_idp/server.js)
|
||||
# pins these values and OxiCloud must persist each one verbatim during
|
||||
# JIT provisioning (see auth_application_service.rs around line 2257).
|
||||
# A regression that drops, swaps, or truncates a claim trips here.
|
||||
# Note the field name flip on the API side: OIDC `picture` becomes
|
||||
# UserDto.image (a URL or data URI).
|
||||
jsonpath "$.given_name" == "OIDC"
|
||||
jsonpath "$.family_name" == "Test"
|
||||
jsonpath "$.image" == "https://example.com/oidc-test-user.png"
|
||||
jsonpath "$.full.user.given_name" == "OIDC"
|
||||
jsonpath "$.full.user.family_name" == "Test"
|
||||
jsonpath "$.full.user.image" == "https://example.com/oidc-test-user.png"
|
||||
# Group-to-role mapping. server-with-oidc.env sets
|
||||
# OXICLOUD_OIDC_ADMIN_GROUPS=admin-users; the fake IdP's claims include
|
||||
# `groups: ["admin-users"]`. The JIT path intersects the claim against
|
||||
# the env and promotes the new user from `user` to `admin`. A
|
||||
# regression here would silently strip (or wrongly grant) admin rights
|
||||
# for every SSO deployment that uses group-based role mapping.
|
||||
jsonpath "$.role" == "admin"
|
||||
jsonpath "$.full.user.role" == "admin"
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
@@ -274,7 +274,7 @@ refreshed_refresh_token: jsonpath "$.refresh_token"
|
||||
# the (freshly-rotated) `oxicloud_csrf` cookie on the browser.
|
||||
refreshed_csrf_token: cookie "oxicloud_csrf"
|
||||
[Asserts]
|
||||
jsonpath "$.user.username" == "oidc_user"
|
||||
jsonpath "$.user.full.user.username" == "oidc_user"
|
||||
jsonpath "$.access_token" isString
|
||||
jsonpath "$.refresh_token" isString
|
||||
# All three cookies must rotate. If any value were re-used, a
|
||||
@@ -296,7 +296,7 @@ GET {{base_url}}/api/auth/me
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.username" == "oidc_user"
|
||||
jsonpath "$.full.user.username" == "oidc_user"
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
@@ -412,8 +412,8 @@ HTTP 200
|
||||
[Asserts]
|
||||
# Same local id — proves the existing-user resolver matched on `sub`
|
||||
# (or `oidc_provider + oidc_subject`) instead of minting a new row.
|
||||
jsonpath "$.user.id" == "{{oidc_user_id}}"
|
||||
jsonpath "$.user.username" == "oidc_user"
|
||||
jsonpath "$.user.full.user.id" == "{{oidc_user_id}}"
|
||||
jsonpath "$.user.full.user.username" == "oidc_user"
|
||||
# Role from the prior JIT-provisioned admin survives the re-login.
|
||||
# Two regressions this catches: (a) the existing-user branch wiping
|
||||
# the role to a default `user`; (b) the existing-user branch
|
||||
@@ -421,7 +421,7 @@ jsonpath "$.user.username" == "oidc_user"
|
||||
# IdP still emits `groups: ["admin-users"]`, OXICLOUD_OIDC_ADMIN_GROUPS
|
||||
# still resolves to "admin"). Either way, the role should remain
|
||||
# `admin` — otherwise we have a silent admin demotion on every login.
|
||||
jsonpath "$.user.role" == "admin"
|
||||
jsonpath "$.user.full.user.role" == "admin"
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
@@ -876,7 +876,7 @@ Content-Type: application/json
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.user.username" == "oidc_user"
|
||||
jsonpath "$.user.full.user.username" == "oidc_user"
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
@@ -889,7 +889,7 @@ GET {{base_url}}/api/auth/me
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.username" == "oidc_user"
|
||||
jsonpath "$.full.user.username" == "oidc_user"
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
|
||||
@@ -123,10 +123,10 @@ Content-Type: application/json
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.user.username" == "oidc_user"
|
||||
jsonpath "$.user.full.user.username" == "oidc_user"
|
||||
# Group-to-role mapping worked — this is now the admin (and the only
|
||||
# user).
|
||||
jsonpath "$.user.role" == "admin"
|
||||
jsonpath "$.user.full.user.role" == "admin"
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
@@ -138,7 +138,7 @@ GET {{base_url}}/api/auth/me
|
||||
|
||||
HTTP 200
|
||||
[Asserts]
|
||||
jsonpath "$.username" == "oidc_user"
|
||||
jsonpath "$.full.user.username" == "oidc_user"
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────
|
||||
|
||||
Reference in New Issue
Block a user