Skip to content

Commit

Permalink
address comments
Browse files Browse the repository at this point in the history 
Signed-off-by: nyagamunene <[email protected]>
  • Loading branch information
@nyagamunene @dborovcanin
nyagamunene authored and dborovcanin committed Dec 16, 2024
1 parent 265bdd0 commit e1eb192
Show file tree
Hide file tree
Showing 8 changed files with 260 additions and 98 deletions.
175 changes: 161 additions & 14 deletions auth/api/grpc/auth/endpoint_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,12 +41,15 @@ const (
invalidDuration = 7 * 24 * time.Hour
validToken = "valid"
inValidToken = "invalid"
validPATToken = "valid"
inValidPATToken = "invalid"
validPolicy = "valid"
)

var (
domainID = testsutil.GenerateUUID(&testing.T{})
authAddr = fmt.Sprintf("localhost:%d", port)
clientID = testsutil.GenerateUUID(&testing.T{})
)

func startGRPCServer(svc auth.Service, port int) *grpc.Server {
Expand Down Expand Up @@ -96,13 +99,15 @@ func TestIdentify(t *testing.T) {
}

for _, tc := range cases {
svcCall := svc.On("Identify", mock.Anything, mock.Anything).Return(auth.Key{Subject: id, User: email, Domain: domainID}, tc.svcErr)
idt, err := grpcClient.Authenticate(context.Background(), &grpcAuthV1.AuthNReq{Token: tc.token})
if idt != nil {
assert.Equal(t, tc.idt, idt, fmt.Sprintf("%s: expected %v got %v", tc.desc, tc.idt, idt))
}
assert.True(t, errors.Contains(err, tc.err), fmt.Sprintf("%s: expected %s got %s\n", tc.desc, tc.err, err))
svcCall.Unset()
t.Run(tc.desc, func(t *testing.T) {
svcCall := svc.On("Identify", mock.Anything, mock.Anything).Return(auth.Key{Subject: id, User: email, Domain: domainID}, tc.svcErr)
idt, err := grpcClient.Authenticate(context.Background(), &grpcAuthV1.AuthNReq{Token: tc.token})
if idt != nil {
assert.Equal(t, tc.idt, idt, fmt.Sprintf("%s: expected %v got %v", tc.desc, tc.idt, idt))
}
assert.True(t, errors.Contains(err, tc.err), fmt.Sprintf("%s: expected %s got %s\n", tc.desc, tc.err, err))
svcCall.Unset()
})
}
}

Expand Down Expand Up @@ -220,12 +225,154 @@ func TestAuthorize(t *testing.T) {
},
}
for _, tc := range cases {
svccall := svc.On("Authorize", mock.Anything, mock.Anything).Return(tc.err)
ar, err := grpcClient.Authorize(context.Background(), tc.authRequest)
if ar != nil {
assert.Equal(t, tc.authResponse, ar, fmt.Sprintf("%s: expected %v got %v", tc.desc, tc.authResponse, ar))
}
assert.True(t, errors.Contains(err, tc.err), fmt.Sprintf("%s: expected %s got %s\n", tc.desc, tc.err, err))
svccall.Unset()
t.Run(tc.desc, func(t *testing.T) {
svccall := svc.On("Authorize", mock.Anything, mock.Anything).Return(tc.err)
ar, err := grpcClient.Authorize(context.Background(), tc.authRequest)
if ar != nil {
assert.Equal(t, tc.authResponse, ar, fmt.Sprintf("%s: expected %v got %v", tc.desc, tc.authResponse, ar))
}
assert.True(t, errors.Contains(err, tc.err), fmt.Sprintf("%s: expected %s got %s\n", tc.desc, tc.err, err))
svccall.Unset()
})
}
}

func TestIdentifyPAT(t *testing.T) {
conn, err := grpc.NewClient(authAddr, grpc.WithTransportCredentials(insecure.NewCredentials()))
assert.Nil(t, err, fmt.Sprintf("Unexpected error creating client connection %s", err))
defer conn.Close()
grpcClient := grpcapi.NewAuthClient(conn, time.Second)

cases := []struct {
desc string
token string
idt *grpcAuthV1.AuthNPATRes
svcErr error
err error
}{
{
desc: "authenticate user with valid user token",
token: validToken,
idt: &grpcAuthV1.AuthNPATRes{Id: id, UserId: clientID},
err: nil,
},
{
desc: "authenticate user with invalid user token",
token: "invalid",
idt: &grpcAuthV1.AuthNPATRes{},
svcErr: svcerr.ErrAuthentication,
err: svcerr.ErrAuthentication,
},
{
desc: "authenticate user with empty token",
token: "",
idt: &grpcAuthV1.AuthNPATRes{},
err: apiutil.ErrBearerToken,
},
}

for _, tc := range cases {
t.Run(tc.desc, func(t *testing.T) {
svcCall := svc.On("IdentifyPAT", mock.Anything, tc.token).Return(auth.PAT{ID: id, User: clientID, IssuedAt: time.Now()}, tc.svcErr)
idt, err := grpcClient.AuthenticatePAT(context.Background(), &grpcAuthV1.AuthNReq{Token: tc.token})
if idt != nil {
assert.Equal(t, tc.idt, idt, fmt.Sprintf("%s: expected %v got %v", tc.desc, tc.idt, idt))
}
assert.True(t, errors.Contains(err, tc.err), fmt.Sprintf("%s: expected %s got %s\n", tc.desc, tc.err, err))
svcCall.Unset()
})
}
}

func TestAuthorizePAT(t *testing.T) {
conn, err := grpc.NewClient(authAddr, grpc.WithTransportCredentials(insecure.NewCredentials()))
assert.Nil(t, err, fmt.Sprintf("Unexpected error creating client connection %s", err))
defer conn.Close()

grpcClient := grpcapi.NewAuthClient(conn, time.Second)
cases := []struct {
desc string
token string
authRequest *grpcAuthV1.AuthZpatReq
authResponse *grpcAuthV1.AuthZRes
err error
}{
{
desc: "authorize user with authorized token",
token: validPATToken,
authRequest: &grpcAuthV1.AuthZpatReq{
UserId: id,
PatId: id,
PlatformEntityType: uint32(auth.PlatformDomainsScope),
OptionalDomainId: domainID,
OptionalDomainEntityType: uint32(auth.DomainClientsScope),
Operation: uint32(auth.CreateOp),
EntityIds: []string{clientID},
},
authResponse: &grpcAuthV1.AuthZRes{Authorized: true},
err: nil,
},
{
desc: "authorize user with unauthorized token",
token: inValidPATToken,
authRequest: &grpcAuthV1.AuthZpatReq{
UserId: id,
PatId: id,
PlatformEntityType: uint32(auth.PlatformDomainsScope),
OptionalDomainId: domainID,
OptionalDomainEntityType: uint32(auth.DomainClientsScope),
Operation: uint32(auth.CreateOp),
EntityIds: []string{clientID},
},
authResponse: &grpcAuthV1.AuthZRes{Authorized: false},
err: svcerr.ErrAuthorization,
},
{
desc: "authorize user with missing user id",
token: validPATToken,
authRequest: &grpcAuthV1.AuthZpatReq{
PatId: id,
PlatformEntityType: uint32(auth.PlatformDomainsScope),
OptionalDomainId: domainID,
OptionalDomainEntityType: uint32(auth.DomainClientsScope),
Operation: uint32(auth.CreateOp),
EntityIds: []string{clientID},
},
authResponse: &grpcAuthV1.AuthZRes{Authorized: false},
err: apiutil.ErrMissingUserID,
},
{
desc: "authorize user with missing pat id",
token: validPATToken,
authRequest: &grpcAuthV1.AuthZpatReq{
UserId: id,
PlatformEntityType: uint32(auth.PlatformDomainsScope),
OptionalDomainId: domainID,
OptionalDomainEntityType: uint32(auth.DomainClientsScope),
Operation: uint32(auth.CreateOp),
EntityIds: []string{clientID},
},
authResponse: &grpcAuthV1.AuthZRes{Authorized: false},
err: apiutil.ErrMissingPATID,
},
}
for _, tc := range cases {
t.Run(tc.desc, func(t *testing.T) {
svccall := svc.On("AuthorizePAT",
mock.Anything,
tc.authRequest.UserId,
tc.authRequest.PatId,
mock.Anything,
tc.authRequest.OptionalDomainId,
mock.Anything,
mock.Anything,
mock.Anything).Return(tc.err)
ar, err := grpcClient.AuthorizePAT(context.Background(), tc.authRequest)
if ar != nil {
assert.Equal(t, tc.authResponse, ar, fmt.Sprintf("%s: expected %v got %v", tc.desc, tc.authResponse, ar))
}
assert.True(t, errors.Contains(err, tc.err), fmt.Sprintf("%s: expected %s got %s\n", tc.desc, tc.err, err))
svccall.Unset()
})
}
}
4 changes: 2 additions & 2 deletions auth/api/grpc/auth/requests.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -63,10 +63,10 @@ type authPATReq struct {

func (req authPATReq) validate() error {
if req.userID == "" {
return apiutil.ErrBearerToken
return apiutil.ErrMissingUserID
}
if req.patID == "" {
return apiutil.ErrBearerToken
return apiutil.ErrMissingPATID
}
return nil
}
4 changes: 2 additions & 2 deletions auth/api/http/pats/responses.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -152,7 +152,7 @@ type addPatScopeEntryRes struct {
}

func (res addPatScopeEntryRes) Code() int {
return http.StatusAccepted
return http.StatusOK

Check warning on line 155 in auth/api/http/pats/responses.go

View check run for this annotation

Codecov / codecov/patch

auth/api/http/pats/responses.go#L154-L155 

Added lines #L154 - L155 were not covered by tests
}

func (res addPatScopeEntryRes) Headers() map[string]string {
Expand All @@ -168,7 +168,7 @@ type removePatScopeEntryRes struct {
}

func (res removePatScopeEntryRes) Code() int {
return http.StatusAccepted
return http.StatusOK

Check warning on line 171 in auth/api/http/pats/responses.go

View check run for this annotation

Codecov / codecov/patch

auth/api/http/pats/responses.go#L170-L171 

Added lines #L170 - L171 were not covered by tests
}

func (res removePatScopeEntryRes) Headers() map[string]string {
Expand Down
132 changes: 69 additions & 63 deletions auth/api/http/pats/transport.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -37,75 +37,81 @@ func MakeHandler(svc auth.Service, mux *chi.Mux, logger *slog.Logger) *chi.Mux {
opts...,
).ServeHTTP)

r.Get("/{id}", kithttp.NewServer(
(retrievePATEndpoint(svc)),
decodeRetrievePATRequest,
api.EncodeResponse,
opts...,
).ServeHTTP)

r.Patch("/{id}/name", kithttp.NewServer(
(updatePATNameEndpoint(svc)),
decodeUpdatePATNameRequest,
api.EncodeResponse,
opts...,
).ServeHTTP)

r.Patch("/{id}/description", kithttp.NewServer(
(updatePATDescriptionEndpoint(svc)),
decodeUpdatePATDescriptionRequest,
api.EncodeResponse,
opts...,
).ServeHTTP)

r.Get("/", kithttp.NewServer(
(listPATSEndpoint(svc)),
listPATSEndpoint(svc),
decodeListPATSRequest,
api.EncodeResponse,
opts...,
).ServeHTTP)

r.Delete("/{id}", kithttp.NewServer(
(deletePATEndpoint(svc)),
decodeDeletePATRequest,
api.EncodeResponse,
opts...,
).ServeHTTP)

r.Patch("/{id}/secret/reset", kithttp.NewServer(
(resetPATSecretEndpoint(svc)),
decodeResetPATSecretRequest,
api.EncodeResponse,
opts...,
).ServeHTTP)

r.Patch("/{id}/secret/revoke", kithttp.NewServer(
(revokePATSecretEndpoint(svc)),
decodeRevokePATSecretRequest,
api.EncodeResponse,
opts...,
).ServeHTTP)

r.Patch("/{id}/scope/add", kithttp.NewServer(
(addPATScopeEntryEndpoint(svc)),
decodeAddPATScopeEntryRequest,
api.EncodeResponse,
opts...,
).ServeHTTP)

r.Patch("/{id}/scope/remove", kithttp.NewServer(
(removePATScopeEntryEndpoint(svc)),
decodeRemovePATScopeEntryRequest,
api.EncodeResponse,
opts...,
).ServeHTTP)

r.Delete("/{id}/scope", kithttp.NewServer(
(clearPATAllScopeEntryEndpoint(svc)),
decodeClearPATAllScopeEntryRequest,
api.EncodeResponse,
opts...,
).ServeHTTP)
r.Route("/{id}", func(r chi.Router) {
r.Get("/", kithttp.NewServer(
retrievePATEndpoint(svc),
decodeRetrievePATRequest,
api.EncodeResponse,
opts...,
).ServeHTTP)

r.Patch("/name", kithttp.NewServer(
updatePATNameEndpoint(svc),
decodeUpdatePATNameRequest,
api.EncodeResponse,
opts...,
).ServeHTTP)

r.Patch("/description", kithttp.NewServer(
updatePATDescriptionEndpoint(svc),
decodeUpdatePATDescriptionRequest,
api.EncodeResponse,
opts...,
).ServeHTTP)

r.Delete("/", kithttp.NewServer(
deletePATEndpoint(svc),
decodeDeletePATRequest,
api.EncodeResponse,
opts...,
).ServeHTTP)

r.Route("/secret", func(r chi.Router) {
r.Patch("/reset", kithttp.NewServer(
resetPATSecretEndpoint(svc),
decodeResetPATSecretRequest,
api.EncodeResponse,
opts...,
).ServeHTTP)

r.Patch("/revoke", kithttp.NewServer(
revokePATSecretEndpoint(svc),
decodeRevokePATSecretRequest,
api.EncodeResponse,
opts...,
).ServeHTTP)
})

r.Route("/scope", func(r chi.Router) {
r.Patch("/add", kithttp.NewServer(
addPATScopeEntryEndpoint(svc),
decodeAddPATScopeEntryRequest,
api.EncodeResponse,
opts...,
).ServeHTTP)

r.Patch("/remove", kithttp.NewServer(
removePATScopeEntryEndpoint(svc),
decodeRemovePATScopeEntryRequest,
api.EncodeResponse,
opts...,
).ServeHTTP)

r.Delete("/", kithttp.NewServer(
clearPATAllScopeEntryEndpoint(svc),
decodeClearPATAllScopeEntryRequest,
api.EncodeResponse,
opts...,
).ServeHTTP)
})
})
})
return mux
}
Expand Down
Loading

0 comments on commit e1eb192

Please sign in to comment.