PLT-3484 OAuth2 Service Provider (#3632)
* PLT-3484 OAuth2 Service Provider * PM text review for OAuth 2.0 Service Provider * PLT-3484 OAuth2 Service Provider UI tweaks (#3668) * Tweaks to help text * Pushing OAuth improvements (#3680) * Re-arrange System Console for OAuth 2.0 Provider
Этот коммит содержится в:
enahum
коммит произвёл
Harrison Healey
Harrison Healey
родитель
ea027c8de4
Коммит
5bc3cea6fe
231
web/web_test.go
231
web/web_test.go
@@ -72,122 +72,125 @@ func TestGetAccessToken(t *testing.T) {
|
||||
|
||||
app := &model.OAuthApp{Name: "TestApp" + model.NewId(), Homepage: "https://nowhere.com", Description: "test", CallbackUrls: []string{"https://nowhere.com"}}
|
||||
|
||||
if !utils.Cfg.ServiceSettings.EnableOAuthServiceProvider {
|
||||
data := url.Values{"grant_type": []string{"junk"}, "client_id": []string{"12345678901234567890123456"}, "client_secret": []string{"12345678901234567890123456"}, "code": []string{"junk"}, "redirect_uri": []string{app.CallbackUrls[0]}}
|
||||
utils.Cfg.ServiceSettings.EnableOAuthServiceProvider = false
|
||||
data := url.Values{"grant_type": []string{"junk"}, "client_id": []string{"12345678901234567890123456"}, "client_secret": []string{"12345678901234567890123456"}, "code": []string{"junk"}, "redirect_uri": []string{app.CallbackUrls[0]}}
|
||||
|
||||
if _, err := ApiClient.GetAccessToken(data); err == nil {
|
||||
t.Fatal("should have failed - oauth providing turned off")
|
||||
}
|
||||
} else {
|
||||
|
||||
ApiClient.Must(ApiClient.LoginById(ruser.Id, "passwd1"))
|
||||
ApiClient.SetTeamId(rteam.Data.(*model.Team).Id)
|
||||
app = ApiClient.Must(ApiClient.RegisterApp(app)).Data.(*model.OAuthApp)
|
||||
|
||||
redirect := ApiClient.Must(ApiClient.AllowOAuth(model.AUTHCODE_RESPONSE_TYPE, app.Id, app.CallbackUrls[0], "all", "123")).Data.(map[string]string)["redirect"]
|
||||
rurl, _ := url.Parse(redirect)
|
||||
|
||||
ApiClient.Logout()
|
||||
|
||||
data := url.Values{"grant_type": []string{"junk"}, "client_id": []string{app.Id}, "client_secret": []string{app.ClientSecret}, "code": []string{rurl.Query().Get("code")}, "redirect_uri": []string{app.CallbackUrls[0]}}
|
||||
|
||||
if _, err := ApiClient.GetAccessToken(data); err == nil {
|
||||
t.Fatal("should have failed - bad grant type")
|
||||
}
|
||||
|
||||
data.Set("grant_type", model.ACCESS_TOKEN_GRANT_TYPE)
|
||||
data.Set("client_id", "")
|
||||
if _, err := ApiClient.GetAccessToken(data); err == nil {
|
||||
t.Fatal("should have failed - missing client id")
|
||||
}
|
||||
data.Set("client_id", "junk")
|
||||
if _, err := ApiClient.GetAccessToken(data); err == nil {
|
||||
t.Fatal("should have failed - bad client id")
|
||||
}
|
||||
|
||||
data.Set("client_id", app.Id)
|
||||
data.Set("client_secret", "")
|
||||
if _, err := ApiClient.GetAccessToken(data); err == nil {
|
||||
t.Fatal("should have failed - missing client secret")
|
||||
}
|
||||
|
||||
data.Set("client_secret", "junk")
|
||||
if _, err := ApiClient.GetAccessToken(data); err == nil {
|
||||
t.Fatal("should have failed - bad client secret")
|
||||
}
|
||||
|
||||
data.Set("client_secret", app.ClientSecret)
|
||||
data.Set("code", "")
|
||||
if _, err := ApiClient.GetAccessToken(data); err == nil {
|
||||
t.Fatal("should have failed - missing code")
|
||||
}
|
||||
|
||||
data.Set("code", "junk")
|
||||
if _, err := ApiClient.GetAccessToken(data); err == nil {
|
||||
t.Fatal("should have failed - bad code")
|
||||
}
|
||||
|
||||
data.Set("code", rurl.Query().Get("code"))
|
||||
data.Set("redirect_uri", "junk")
|
||||
if _, err := ApiClient.GetAccessToken(data); err == nil {
|
||||
t.Fatal("should have failed - non-matching redirect uri")
|
||||
}
|
||||
|
||||
// reset data for successful request
|
||||
data.Set("grant_type", model.ACCESS_TOKEN_GRANT_TYPE)
|
||||
data.Set("client_id", app.Id)
|
||||
data.Set("client_secret", app.ClientSecret)
|
||||
data.Set("code", rurl.Query().Get("code"))
|
||||
data.Set("redirect_uri", app.CallbackUrls[0])
|
||||
|
||||
token := ""
|
||||
if result, err := ApiClient.GetAccessToken(data); err != nil {
|
||||
t.Fatal(err)
|
||||
} else {
|
||||
rsp := result.Data.(*model.AccessResponse)
|
||||
if len(rsp.AccessToken) == 0 {
|
||||
t.Fatal("access token not returned")
|
||||
} else {
|
||||
token = rsp.AccessToken
|
||||
}
|
||||
if rsp.TokenType != model.ACCESS_TOKEN_TYPE {
|
||||
t.Fatal("access token type incorrect")
|
||||
}
|
||||
}
|
||||
|
||||
if result, err := ApiClient.DoApiGet("/users/profiles?access_token="+token, "", ""); err != nil {
|
||||
t.Fatal(err)
|
||||
} else {
|
||||
userMap := model.UserMapFromJson(result.Body)
|
||||
if len(userMap) == 0 {
|
||||
t.Fatal("user map empty - did not get results correctly")
|
||||
}
|
||||
}
|
||||
|
||||
if _, err := ApiClient.DoApiGet("/users/profiles", "", ""); err == nil {
|
||||
t.Fatal("should have failed - no access token provided")
|
||||
}
|
||||
|
||||
if _, err := ApiClient.DoApiGet("/users/profiles?access_token=junk", "", ""); err == nil {
|
||||
t.Fatal("should have failed - bad access token provided")
|
||||
}
|
||||
|
||||
ApiClient.SetOAuthToken(token)
|
||||
if result, err := ApiClient.DoApiGet("/users/profiles", "", ""); err != nil {
|
||||
t.Fatal(err)
|
||||
} else {
|
||||
userMap := model.UserMapFromJson(result.Body)
|
||||
if len(userMap) == 0 {
|
||||
t.Fatal("user map empty - did not get results correctly")
|
||||
}
|
||||
}
|
||||
|
||||
if _, err := ApiClient.GetAccessToken(data); err == nil {
|
||||
t.Fatal("should have failed - tried to reuse auth code")
|
||||
}
|
||||
|
||||
ApiClient.ClearOAuthToken()
|
||||
if _, err := ApiClient.GetAccessToken(data); err == nil {
|
||||
t.Fatal("should have failed - oauth providing turned off")
|
||||
}
|
||||
utils.Cfg.ServiceSettings.EnableOAuthServiceProvider = true
|
||||
|
||||
ApiClient.Must(ApiClient.LoginById(ruser.Id, "passwd1"))
|
||||
ApiClient.SetTeamId(rteam.Data.(*model.Team).Id)
|
||||
*utils.Cfg.ServiceSettings.EnableOnlyAdminIntegrations = false
|
||||
app = ApiClient.Must(ApiClient.RegisterApp(app)).Data.(*model.OAuthApp)
|
||||
*utils.Cfg.ServiceSettings.EnableOnlyAdminIntegrations = true
|
||||
|
||||
redirect := ApiClient.Must(ApiClient.AllowOAuth(model.AUTHCODE_RESPONSE_TYPE, app.Id, app.CallbackUrls[0], "all", "123")).Data.(map[string]string)["redirect"]
|
||||
rurl, _ := url.Parse(redirect)
|
||||
|
||||
teamId := rteam.Data.(*model.Team).Id
|
||||
|
||||
ApiClient.Logout()
|
||||
|
||||
data = url.Values{"grant_type": []string{"junk"}, "client_id": []string{app.Id}, "client_secret": []string{app.ClientSecret}, "code": []string{rurl.Query().Get("code")}, "redirect_uri": []string{app.CallbackUrls[0]}}
|
||||
|
||||
if _, err := ApiClient.GetAccessToken(data); err == nil {
|
||||
t.Fatal("should have failed - bad grant type")
|
||||
}
|
||||
|
||||
data.Set("grant_type", model.ACCESS_TOKEN_GRANT_TYPE)
|
||||
data.Set("client_id", "")
|
||||
if _, err := ApiClient.GetAccessToken(data); err == nil {
|
||||
t.Fatal("should have failed - missing client id")
|
||||
}
|
||||
data.Set("client_id", "junk")
|
||||
if _, err := ApiClient.GetAccessToken(data); err == nil {
|
||||
t.Fatal("should have failed - bad client id")
|
||||
}
|
||||
|
||||
data.Set("client_id", app.Id)
|
||||
data.Set("client_secret", "")
|
||||
if _, err := ApiClient.GetAccessToken(data); err == nil {
|
||||
t.Fatal("should have failed - missing client secret")
|
||||
}
|
||||
|
||||
data.Set("client_secret", "junk")
|
||||
if _, err := ApiClient.GetAccessToken(data); err == nil {
|
||||
t.Fatal("should have failed - bad client secret")
|
||||
}
|
||||
|
||||
data.Set("client_secret", app.ClientSecret)
|
||||
data.Set("code", "")
|
||||
if _, err := ApiClient.GetAccessToken(data); err == nil {
|
||||
t.Fatal("should have failed - missing code")
|
||||
}
|
||||
|
||||
data.Set("code", "junk")
|
||||
if _, err := ApiClient.GetAccessToken(data); err == nil {
|
||||
t.Fatal("should have failed - bad code")
|
||||
}
|
||||
|
||||
data.Set("code", rurl.Query().Get("code"))
|
||||
data.Set("redirect_uri", "junk")
|
||||
if _, err := ApiClient.GetAccessToken(data); err == nil {
|
||||
t.Fatal("should have failed - non-matching redirect uri")
|
||||
}
|
||||
|
||||
// reset data for successful request
|
||||
data.Set("grant_type", model.ACCESS_TOKEN_GRANT_TYPE)
|
||||
data.Set("client_id", app.Id)
|
||||
data.Set("client_secret", app.ClientSecret)
|
||||
data.Set("code", rurl.Query().Get("code"))
|
||||
data.Set("redirect_uri", app.CallbackUrls[0])
|
||||
|
||||
token := ""
|
||||
if result, err := ApiClient.GetAccessToken(data); err != nil {
|
||||
t.Fatal(err)
|
||||
} else {
|
||||
rsp := result.Data.(*model.AccessResponse)
|
||||
if len(rsp.AccessToken) == 0 {
|
||||
t.Fatal("access token not returned")
|
||||
} else {
|
||||
token = rsp.AccessToken
|
||||
}
|
||||
if rsp.TokenType != model.ACCESS_TOKEN_TYPE {
|
||||
t.Fatal("access token type incorrect")
|
||||
}
|
||||
}
|
||||
|
||||
if result, err := ApiClient.DoApiGet("/users/profiles/"+teamId+"?access_token="+token, "", ""); err != nil {
|
||||
t.Fatal(err)
|
||||
} else {
|
||||
userMap := model.UserMapFromJson(result.Body)
|
||||
if len(userMap) == 0 {
|
||||
t.Fatal("user map empty - did not get results correctly")
|
||||
}
|
||||
}
|
||||
|
||||
if _, err := ApiClient.DoApiGet("/users/profiles/"+teamId, "", ""); err == nil {
|
||||
t.Fatal("should have failed - no access token provided")
|
||||
}
|
||||
|
||||
if _, err := ApiClient.DoApiGet("/users/profiles/"+teamId+"?access_token=junk", "", ""); err == nil {
|
||||
t.Fatal("should have failed - bad access token provided")
|
||||
}
|
||||
|
||||
ApiClient.SetOAuthToken(token)
|
||||
if result, err := ApiClient.DoApiGet("/users/profiles/"+teamId, "", ""); err != nil {
|
||||
t.Fatal(err)
|
||||
} else {
|
||||
userMap := model.UserMapFromJson(result.Body)
|
||||
if len(userMap) == 0 {
|
||||
t.Fatal("user map empty - did not get results correctly")
|
||||
}
|
||||
}
|
||||
|
||||
if _, err := ApiClient.GetAccessToken(data); err == nil {
|
||||
t.Fatal("should have failed - tried to reuse auth code")
|
||||
}
|
||||
|
||||
ApiClient.ClearOAuthToken()
|
||||
}
|
||||
|
||||
func TestIncomingWebhook(t *testing.T) {
|
||||
|
||||
Ссылка в новой задаче
Block a user