test(oidc): test OIDC login and refresh flow

- ensure Oxicloud s correctly functional with OIDC login - refresh token works - givenname, familyname, picture are imported in users' informations - test relogin (server is not using same path) - test email verified - test admin group provided from IdP
2026-06-28 22:40:06 +02:00
parent 324fcd486f
commit ada4b021bf
10 changed files with 2044 additions and 3 deletions
@@ -0,0 +1,68 @@
+# OxiCloud test-server env file for the OIDC integration test.
+#
+# Layered on top of server.env: identical to the default test-server
+# config EXCEPT the OIDC client is enabled and pointed at the fake
+# IdP under tests/oidc/fake_idp/ (a panva/node-oidc-provider wrapper
+# started by tests/oidc/run.sh).
+#
+# Run pattern (used by tests/oidc/run.sh):
+#   bash tests/common/spawn-db.sh
+#   node tests/oidc/fake_idp/server.js &      # auto-approve OIDC IdP on :1080
+#   ./target/debug/oxicloud --config tests/common/server-with-oidc.env
+#
+# `--config` makes the binary read THIS file verbatim — there is no
+# auto-merge with server.env, so every variable the server needs has
+# to be repeated here. Keeping the duplication explicit beats a sourcing
+# scheme: dotenvy doesn't follow `source` directives, and the matrix of
+# "which env file is in effect" is easier to read when each one is
+# self-contained.
+
+# ── Shared test config (mirrors server.env) ────────────────────────────────
+DATABASE_URL=postgres://oxicloud_test:oxicloud_test@localhost:5433/oxicloud_test
+OXICLOUD_DB_CONNECTION_STRING=postgres://oxicloud_test:oxicloud_test@localhost:5433/oxicloud_test
+OXICLOUD_STATIC_PATH=./static
+OXICLOUD_JWT_SECRET=test-secret-do-not-use-in-prod-minimum-32-chars
+OXICLOUD_ENABLE_AUTH=true
+OXICLOUD_ENABLE_TRASH=true
+OXICLOUD_ENABLE_SEARCH=true
+OXICLOUD_ENABLE_FILE_SHARING=true
+OXICLOUD_ENABLE_MUSIC=true
+OXICLOUD_EXPOSE_SYSTEM_USERS=true
+OXICLOUD_WOPI_ENABLED=false
+OXICLOUD_NEXTCLOUD_ENABLED=true
+OXICLOUD_ENABLE_ADMIN_INTERNAL_ENDPOINTS=true
+
+RUST_LOG="warn,audit=info,oxicloud::infrastructure::services::oidc_service=info,oxicloud::application::services::auth_application_service=info"
+
+OXICLOUD_RATE_LIMIT_REFRESH_MAX=3600
+OXICLOUD_RATE_LIMIT_LOGIN_MAX=3600
+OXICLOUD_RATE_LIMIT_REGISTER_MAX=3600
+OXICLOUD_TRUST_PROXY_CIDR=0.0.0.0/0
+
+# ── OIDC client wired at the fake-idp sidecar ──────────────────────────────
+# tests/oidc/fake_idp/server.js (panva/node-oidc-provider) publishes the
+# issuer at the root URL; discovery is at /.well-known/openid-configuration
+# under it. Update the `clients[0].client_id` field there in tandem if you
+# rename the client.
+OXICLOUD_OIDC_ENABLED=true
+OXICLOUD_OIDC_ISSUER_URL=http://localhost:1080
+OXICLOUD_OIDC_CLIENT_ID=oxicloud-test
+OXICLOUD_OIDC_CLIENT_SECRET=test-client-secret-not-used-in-prod
+# The IdP redirects back to this exact URL after auto-approving; must
+# match the OxiCloud server's actual host + port (port 8087 from
+# tests/api/test.env's base_url).
+OXICLOUD_OIDC_REDIRECT_URI=http://localhost:8087/api/auth/oidc/callback
+OXICLOUD_OIDC_SCOPES="openid profile email"
+# Frontend redirect target after a successful callback. Tracks the
+# d1bbe8ba fix: the backend appends `/login?oidc_code=…` to this base,
+# so the value here is the SPA origin only.
+OXICLOUD_OIDC_FRONTEND_URL=http://localhost:8087
+OXICLOUD_OIDC_AUTO_PROVISION=true
+OXICLOUD_OIDC_PROVIDER_NAME=MockSSO
+# Group-to-role mapping. The fake IdP emits `groups: ["admin-users"]`
+# in every id_token; with this env set, the JIT-provisioning code in
+# auth_application_service.rs intersects the claim against this list
+# and promotes the new user from `user` to `admin` on a non-empty
+# match. This is the standard Authentik/Keycloak/Entra pattern: an
+# IdP group becomes an OxiCloud role.
+OXICLOUD_OIDC_ADMIN_GROUPS=admin-users