mirror of
https://github.com/andwati/zitadel.git
synced 2026-11-01 11:52:15 +00:00
feat: native app links for passkeys (#12580)
# Which Problems Are Solved - Native iOS/Android passkeys need OS trust files on the ZITADEL domain; without them, Associated Domains / App Links verification fails. - Operators could not configure iOS Team ID + Bundle ID or Android package name + SHA-256 fingerprints on OIDC apps. - `/.well-known/apple-app-site-association` and `/.well-known/assetlinks.json` were not served from application config. # How the Problems Are Solved - Add iOS/Android app-link fields on OIDC app create/update (Application API v2 + Management), with validation. - Persist and project those fields; query active app-link configs instance-wide. - Serve AASA (`webcredentials`) and Digital Asset Links (`get_login_creds`) from well-known paths, with configurable `Cache-Control` and fingerprint normalization at serve time. - Console UI to edit the fields, with links to the well-known endpoints. - Operator docs for configuration, endpoints, caching, and verification. # Additional Changes - Document on API fields that well-known responses may be HTTP-cached and platform verifiers may delay propagation. - Runtime config: `WellKnown.AppLinksCacheControlMaxAge` (default `5m`; `0` → `no-store`). # Additional Context - Closes #12497 - Implemented and reviewed as stack: - #12531 API contract - #12532 storage wiring - #12536 well-known endpoints - #12537 console - #12547 docs --------- Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Livio Spring
Cursor
@@ -15,30 +15,36 @@ func CreateOIDCAppRequestToDomain(name, appID, projectID string, req *applicatio
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
iosTeamID, iosBundleID := iosAppLinkConfigToDomain(req.GetIos())
|
||||
androidPackageName, androidFingerprints := androidAppLinkConfigToDomain(req.GetAndroid())
|
||||
return &domain.OIDCApp{
|
||||
ObjectRoot: models.ObjectRoot{
|
||||
AggregateID: projectID,
|
||||
},
|
||||
AppID: appID,
|
||||
AppName: name,
|
||||
OIDCVersion: gu.Ptr(domain.OIDCVersionV1),
|
||||
RedirectUris: req.GetRedirectUris(),
|
||||
ResponseTypes: oidcResponseTypesToDomain(req.GetResponseTypes()),
|
||||
GrantTypes: oidcGrantTypesToDomain(req.GetGrantTypes()),
|
||||
ApplicationType: gu.Ptr(oidcApplicationTypeToDomain(req.GetApplicationType())),
|
||||
AuthMethodType: gu.Ptr(oidcAuthMethodTypeToDomain(req.GetAuthMethodType())),
|
||||
PostLogoutRedirectUris: req.GetPostLogoutRedirectUris(),
|
||||
DevMode: &req.DevelopmentMode,
|
||||
AccessTokenType: gu.Ptr(oidcTokenTypeToDomain(req.GetAccessTokenType())),
|
||||
AccessTokenRoleAssertion: gu.Ptr(req.GetAccessTokenRoleAssertion()),
|
||||
IDTokenRoleAssertion: gu.Ptr(req.GetIdTokenRoleAssertion()),
|
||||
IDTokenUserinfoAssertion: gu.Ptr(req.GetIdTokenUserinfoAssertion()),
|
||||
ClockSkew: gu.Ptr(req.GetClockSkew().AsDuration()),
|
||||
AdditionalOrigins: req.GetAdditionalOrigins(),
|
||||
SkipNativeAppSuccessPage: gu.Ptr(req.GetSkipNativeAppSuccessPage()),
|
||||
BackChannelLogoutURI: gu.Ptr(req.GetBackChannelLogoutUri()),
|
||||
LoginVersion: loginVersion,
|
||||
LoginBaseURI: loginBaseURI,
|
||||
AppID: appID,
|
||||
AppName: name,
|
||||
OIDCVersion: gu.Ptr(domain.OIDCVersionV1),
|
||||
RedirectUris: req.GetRedirectUris(),
|
||||
ResponseTypes: oidcResponseTypesToDomain(req.GetResponseTypes()),
|
||||
GrantTypes: oidcGrantTypesToDomain(req.GetGrantTypes()),
|
||||
ApplicationType: gu.Ptr(oidcApplicationTypeToDomain(req.GetApplicationType())),
|
||||
AuthMethodType: gu.Ptr(oidcAuthMethodTypeToDomain(req.GetAuthMethodType())),
|
||||
PostLogoutRedirectUris: req.GetPostLogoutRedirectUris(),
|
||||
DevMode: &req.DevelopmentMode,
|
||||
AccessTokenType: gu.Ptr(oidcTokenTypeToDomain(req.GetAccessTokenType())),
|
||||
AccessTokenRoleAssertion: gu.Ptr(req.GetAccessTokenRoleAssertion()),
|
||||
IDTokenRoleAssertion: gu.Ptr(req.GetIdTokenRoleAssertion()),
|
||||
IDTokenUserinfoAssertion: gu.Ptr(req.GetIdTokenUserinfoAssertion()),
|
||||
ClockSkew: gu.Ptr(req.GetClockSkew().AsDuration()),
|
||||
AdditionalOrigins: req.GetAdditionalOrigins(),
|
||||
SkipNativeAppSuccessPage: gu.Ptr(req.GetSkipNativeAppSuccessPage()),
|
||||
BackChannelLogoutURI: gu.Ptr(req.GetBackChannelLogoutUri()),
|
||||
LoginVersion: loginVersion,
|
||||
LoginBaseURI: loginBaseURI,
|
||||
IOSTeamID: iosTeamID,
|
||||
IOSBundleID: iosBundleID,
|
||||
AndroidPackageName: androidPackageName,
|
||||
AndroidSHA256CertFingerprints: androidFingerprints,
|
||||
}, nil
|
||||
}
|
||||
|
||||
@@ -47,28 +53,35 @@ func UpdateOIDCAppConfigRequestToDomain(appID, projectID string, app *applicatio
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// nested messages: omit = no change; present (incl. empty) = set/clear
|
||||
iosTeamID, iosBundleID := iosAppLinkConfigToDomain(app.Ios)
|
||||
androidPackageName, androidFingerprints := androidAppLinkConfigToDomain(app.Android)
|
||||
return &domain.OIDCApp{
|
||||
ObjectRoot: models.ObjectRoot{
|
||||
AggregateID: projectID,
|
||||
},
|
||||
AppID: appID,
|
||||
RedirectUris: app.RedirectUris,
|
||||
ResponseTypes: oidcResponseTypesToDomain(app.ResponseTypes),
|
||||
GrantTypes: oidcGrantTypesToDomain(app.GrantTypes),
|
||||
ApplicationType: oidcApplicationTypeToDomainPtr(app.ApplicationType),
|
||||
AuthMethodType: oidcAuthMethodTypeToDomainPtr(app.AuthMethodType),
|
||||
PostLogoutRedirectUris: app.PostLogoutRedirectUris,
|
||||
DevMode: app.DevelopmentMode,
|
||||
AccessTokenType: oidcTokenTypeToDomainPtr(app.AccessTokenType),
|
||||
AccessTokenRoleAssertion: app.AccessTokenRoleAssertion,
|
||||
IDTokenRoleAssertion: app.IdTokenRoleAssertion,
|
||||
IDTokenUserinfoAssertion: app.IdTokenUserinfoAssertion,
|
||||
ClockSkew: gu.Ptr(app.GetClockSkew().AsDuration()),
|
||||
AdditionalOrigins: app.AdditionalOrigins,
|
||||
SkipNativeAppSuccessPage: app.SkipNativeAppSuccessPage,
|
||||
BackChannelLogoutURI: app.BackChannelLogoutUri,
|
||||
LoginVersion: loginVersion,
|
||||
LoginBaseURI: loginBaseURI,
|
||||
AppID: appID,
|
||||
RedirectUris: app.RedirectUris,
|
||||
ResponseTypes: oidcResponseTypesToDomain(app.ResponseTypes),
|
||||
GrantTypes: oidcGrantTypesToDomain(app.GrantTypes),
|
||||
ApplicationType: oidcApplicationTypeToDomainPtr(app.ApplicationType),
|
||||
AuthMethodType: oidcAuthMethodTypeToDomainPtr(app.AuthMethodType),
|
||||
PostLogoutRedirectUris: app.PostLogoutRedirectUris,
|
||||
DevMode: app.DevelopmentMode,
|
||||
AccessTokenType: oidcTokenTypeToDomainPtr(app.AccessTokenType),
|
||||
AccessTokenRoleAssertion: app.AccessTokenRoleAssertion,
|
||||
IDTokenRoleAssertion: app.IdTokenRoleAssertion,
|
||||
IDTokenUserinfoAssertion: app.IdTokenUserinfoAssertion,
|
||||
ClockSkew: gu.Ptr(app.GetClockSkew().AsDuration()),
|
||||
AdditionalOrigins: app.AdditionalOrigins,
|
||||
SkipNativeAppSuccessPage: app.SkipNativeAppSuccessPage,
|
||||
BackChannelLogoutURI: app.BackChannelLogoutUri,
|
||||
LoginVersion: loginVersion,
|
||||
LoginBaseURI: loginBaseURI,
|
||||
IOSTeamID: iosTeamID,
|
||||
IOSBundleID: iosBundleID,
|
||||
AndroidPackageName: androidPackageName,
|
||||
AndroidSHA256CertFingerprints: androidFingerprints,
|
||||
}, nil
|
||||
}
|
||||
|
||||
@@ -213,10 +226,50 @@ func appOIDCConfigToPb(oidcApp *query.OIDCApp) *application.Application_OidcConf
|
||||
SkipNativeAppSuccessPage: oidcApp.SkipNativeAppSuccessPage,
|
||||
BackChannelLogoutUri: oidcApp.BackChannelLogoutURI,
|
||||
LoginVersion: loginVersionToPb(oidcApp.LoginVersion, oidcApp.LoginBaseURI),
|
||||
Ios: iosAppLinkConfigToPb(oidcApp.IOSTeamID, oidcApp.IOSBundleID),
|
||||
Android: androidAppLinkConfigToPb(oidcApp.AndroidPackageName, oidcApp.AndroidSHA256CertFingerprints),
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func iosAppLinkConfigToDomain(cfg *application.IOSAppLinkConfig) (teamID, bundleID *string) {
|
||||
if cfg == nil {
|
||||
return nil, nil
|
||||
}
|
||||
return gu.Ptr(cfg.GetTeamId()), gu.Ptr(cfg.GetBundleId())
|
||||
}
|
||||
|
||||
func androidAppLinkConfigToDomain(cfg *application.AndroidAppLinkConfig) (packageName *string, fingerprints []string) {
|
||||
if cfg == nil {
|
||||
return nil, nil
|
||||
}
|
||||
fps := cfg.GetSha256CertFingerprints()
|
||||
if fps == nil {
|
||||
fps = []string{}
|
||||
}
|
||||
return gu.Ptr(cfg.GetPackageName()), fps
|
||||
}
|
||||
|
||||
func iosAppLinkConfigToPb(teamID, bundleID string) *application.IOSAppLinkConfig {
|
||||
if teamID == "" && bundleID == "" {
|
||||
return nil
|
||||
}
|
||||
return &application.IOSAppLinkConfig{
|
||||
TeamId: teamID,
|
||||
BundleId: bundleID,
|
||||
}
|
||||
}
|
||||
|
||||
func androidAppLinkConfigToPb(packageName string, fingerprints []string) *application.AndroidAppLinkConfig {
|
||||
if packageName == "" && len(fingerprints) == 0 {
|
||||
return nil
|
||||
}
|
||||
return &application.AndroidAppLinkConfig{
|
||||
PackageName: packageName,
|
||||
Sha256CertFingerprints: fingerprints,
|
||||
}
|
||||
}
|
||||
|
||||
func oidcResponseTypesFromModel(responseTypes []domain.OIDCResponseType) []application.OIDCResponseType {
|
||||
oidcResponseTypes := make([]application.OIDCResponseType, len(responseTypes))
|
||||
for i, responseType := range responseTypes {
|
||||
|
||||
@@ -66,29 +66,41 @@ func TestCreateOIDCAppRequestToDomain(t *testing.T) {
|
||||
LoginVersion: &application.LoginVersion{Version: &application.LoginVersion_LoginV2{LoginV2: &application.LoginV2{
|
||||
BaseUri: gu.Ptr("https://login"),
|
||||
}}},
|
||||
Ios: &application.IOSAppLinkConfig{
|
||||
TeamId: "TEAMID",
|
||||
BundleId: "com.example.app",
|
||||
},
|
||||
Android: &application.AndroidAppLinkConfig{
|
||||
PackageName: "com.example.app",
|
||||
Sha256CertFingerprints: []string{"AA:BB:CC"},
|
||||
},
|
||||
},
|
||||
expectedModel: &domain.OIDCApp{
|
||||
ObjectRoot: models.ObjectRoot{AggregateID: "project1"},
|
||||
AppName: "all fields set",
|
||||
AppID: "app1",
|
||||
OIDCVersion: gu.Ptr(domain.OIDCVersionV1),
|
||||
RedirectUris: []string{"https://redirect"},
|
||||
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
|
||||
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
|
||||
ApplicationType: gu.Ptr(domain.OIDCApplicationTypeWeb),
|
||||
AuthMethodType: gu.Ptr(domain.OIDCAuthMethodTypeBasic),
|
||||
PostLogoutRedirectUris: []string{"https://logout"},
|
||||
DevMode: gu.Ptr(true),
|
||||
AccessTokenType: gu.Ptr(domain.OIDCTokenTypeBearer),
|
||||
AccessTokenRoleAssertion: gu.Ptr(true),
|
||||
IDTokenRoleAssertion: gu.Ptr(true),
|
||||
IDTokenUserinfoAssertion: gu.Ptr(true),
|
||||
ClockSkew: gu.Ptr(5 * time.Second),
|
||||
AdditionalOrigins: []string{"https://origin"},
|
||||
SkipNativeAppSuccessPage: gu.Ptr(true),
|
||||
BackChannelLogoutURI: gu.Ptr("https://backchannel"),
|
||||
LoginVersion: gu.Ptr(domain.LoginVersion2),
|
||||
LoginBaseURI: gu.Ptr("https://login"),
|
||||
ObjectRoot: models.ObjectRoot{AggregateID: "project1"},
|
||||
AppName: "all fields set",
|
||||
AppID: "app1",
|
||||
OIDCVersion: gu.Ptr(domain.OIDCVersionV1),
|
||||
RedirectUris: []string{"https://redirect"},
|
||||
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
|
||||
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
|
||||
ApplicationType: gu.Ptr(domain.OIDCApplicationTypeWeb),
|
||||
AuthMethodType: gu.Ptr(domain.OIDCAuthMethodTypeBasic),
|
||||
PostLogoutRedirectUris: []string{"https://logout"},
|
||||
DevMode: gu.Ptr(true),
|
||||
AccessTokenType: gu.Ptr(domain.OIDCTokenTypeBearer),
|
||||
AccessTokenRoleAssertion: gu.Ptr(true),
|
||||
IDTokenRoleAssertion: gu.Ptr(true),
|
||||
IDTokenUserinfoAssertion: gu.Ptr(true),
|
||||
ClockSkew: gu.Ptr(5 * time.Second),
|
||||
AdditionalOrigins: []string{"https://origin"},
|
||||
SkipNativeAppSuccessPage: gu.Ptr(true),
|
||||
BackChannelLogoutURI: gu.Ptr("https://backchannel"),
|
||||
LoginVersion: gu.Ptr(domain.LoginVersion2),
|
||||
LoginBaseURI: gu.Ptr("https://login"),
|
||||
IOSTeamID: gu.Ptr("TEAMID"),
|
||||
IOSBundleID: gu.Ptr("com.example.app"),
|
||||
AndroidPackageName: gu.Ptr("com.example.app"),
|
||||
AndroidSHA256CertFingerprints: []string{"AA:BB:CC"},
|
||||
},
|
||||
},
|
||||
}
|
||||
@@ -182,6 +194,71 @@ func TestUpdateOIDCAppConfigRequestToDomain(t *testing.T) {
|
||||
LoginBaseURI: gu.Ptr("https://login"),
|
||||
},
|
||||
},
|
||||
{
|
||||
testName: "omit app links leaves nil",
|
||||
appID: "app1",
|
||||
projectID: "proj1",
|
||||
req: &application.UpdateOIDCApplicationConfigurationRequest{},
|
||||
expectedModel: &domain.OIDCApp{
|
||||
ObjectRoot: models.ObjectRoot{AggregateID: "proj1"},
|
||||
AppID: "app1",
|
||||
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
|
||||
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
|
||||
ClockSkew: gu.Ptr(time.Duration(0)),
|
||||
LoginVersion: gu.Ptr(domain.LoginVersionUnspecified),
|
||||
LoginBaseURI: gu.Ptr(""),
|
||||
},
|
||||
},
|
||||
{
|
||||
testName: "set app links",
|
||||
appID: "app1",
|
||||
projectID: "proj1",
|
||||
req: &application.UpdateOIDCApplicationConfigurationRequest{
|
||||
Ios: &application.IOSAppLinkConfig{
|
||||
TeamId: "TEAMID",
|
||||
BundleId: "com.example.app",
|
||||
},
|
||||
Android: &application.AndroidAppLinkConfig{
|
||||
PackageName: "com.example.app",
|
||||
Sha256CertFingerprints: []string{"AA:BB:CC"},
|
||||
},
|
||||
},
|
||||
expectedModel: &domain.OIDCApp{
|
||||
ObjectRoot: models.ObjectRoot{AggregateID: "proj1"},
|
||||
AppID: "app1",
|
||||
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
|
||||
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
|
||||
ClockSkew: gu.Ptr(time.Duration(0)),
|
||||
LoginVersion: gu.Ptr(domain.LoginVersionUnspecified),
|
||||
LoginBaseURI: gu.Ptr(""),
|
||||
IOSTeamID: gu.Ptr("TEAMID"),
|
||||
IOSBundleID: gu.Ptr("com.example.app"),
|
||||
AndroidPackageName: gu.Ptr("com.example.app"),
|
||||
AndroidSHA256CertFingerprints: []string{"AA:BB:CC"},
|
||||
},
|
||||
},
|
||||
{
|
||||
testName: "clear app links with empty messages",
|
||||
appID: "app1",
|
||||
projectID: "proj1",
|
||||
req: &application.UpdateOIDCApplicationConfigurationRequest{
|
||||
Ios: &application.IOSAppLinkConfig{},
|
||||
Android: &application.AndroidAppLinkConfig{},
|
||||
},
|
||||
expectedModel: &domain.OIDCApp{
|
||||
ObjectRoot: models.ObjectRoot{AggregateID: "proj1"},
|
||||
AppID: "app1",
|
||||
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
|
||||
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
|
||||
ClockSkew: gu.Ptr(time.Duration(0)),
|
||||
LoginVersion: gu.Ptr(domain.LoginVersionUnspecified),
|
||||
LoginBaseURI: gu.Ptr(""),
|
||||
IOSTeamID: gu.Ptr(""),
|
||||
IOSBundleID: gu.Ptr(""),
|
||||
AndroidPackageName: gu.Ptr(""),
|
||||
AndroidSHA256CertFingerprints: []string{},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range tt {
|
||||
@@ -453,26 +530,30 @@ func TestAppOIDCConfigToPb(t *testing.T) {
|
||||
{
|
||||
name: "full config",
|
||||
input: &query.OIDCApp{
|
||||
RedirectURIs: []string{"https://example.com/callback"},
|
||||
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
|
||||
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
|
||||
AppType: domain.OIDCApplicationTypeWeb,
|
||||
ClientID: "client123",
|
||||
AuthMethodType: domain.OIDCAuthMethodTypeBasic,
|
||||
PostLogoutRedirectURIs: []string{"https://example.com/logout"},
|
||||
ComplianceProblems: []string{"problem1", "problem2"},
|
||||
IsDevMode: true,
|
||||
AccessTokenType: domain.OIDCTokenTypeBearer,
|
||||
AssertAccessTokenRole: true,
|
||||
AssertIDTokenRole: true,
|
||||
AssertIDTokenUserinfo: true,
|
||||
ClockSkew: 5 * time.Second,
|
||||
AdditionalOrigins: []string{"https://app.example.com"},
|
||||
AllowedOrigins: []string{"https://allowed.example.com"},
|
||||
SkipNativeAppSuccessPage: true,
|
||||
BackChannelLogoutURI: "https://example.com/backchannel",
|
||||
LoginVersion: domain.LoginVersion2,
|
||||
LoginBaseURI: gu.Ptr("https://login.example.com"),
|
||||
RedirectURIs: []string{"https://example.com/callback"},
|
||||
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
|
||||
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
|
||||
AppType: domain.OIDCApplicationTypeWeb,
|
||||
ClientID: "client123",
|
||||
AuthMethodType: domain.OIDCAuthMethodTypeBasic,
|
||||
PostLogoutRedirectURIs: []string{"https://example.com/logout"},
|
||||
ComplianceProblems: []string{"problem1", "problem2"},
|
||||
IsDevMode: true,
|
||||
AccessTokenType: domain.OIDCTokenTypeBearer,
|
||||
AssertAccessTokenRole: true,
|
||||
AssertIDTokenRole: true,
|
||||
AssertIDTokenUserinfo: true,
|
||||
ClockSkew: 5 * time.Second,
|
||||
AdditionalOrigins: []string{"https://app.example.com"},
|
||||
AllowedOrigins: []string{"https://allowed.example.com"},
|
||||
SkipNativeAppSuccessPage: true,
|
||||
BackChannelLogoutURI: "https://example.com/backchannel",
|
||||
LoginVersion: domain.LoginVersion2,
|
||||
LoginBaseURI: gu.Ptr("https://login.example.com"),
|
||||
IOSTeamID: "TEAMID",
|
||||
IOSBundleID: "com.example.app",
|
||||
AndroidPackageName: "com.example.app",
|
||||
AndroidSHA256CertFingerprints: []string{"AA:BB:CC"},
|
||||
},
|
||||
expected: &application.Application_OidcConfiguration{
|
||||
OidcConfiguration: &application.OIDCConfiguration{
|
||||
@@ -506,6 +587,14 @@ func TestAppOIDCConfigToPb(t *testing.T) {
|
||||
},
|
||||
},
|
||||
},
|
||||
Ios: &application.IOSAppLinkConfig{
|
||||
TeamId: "TEAMID",
|
||||
BundleId: "com.example.app",
|
||||
},
|
||||
Android: &application.AndroidAppLinkConfig{
|
||||
PackageName: "com.example.app",
|
||||
Sha256CertFingerprints: []string{"AA:BB:CC"},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
|
||||
@@ -0,0 +1,159 @@
|
||||
//go:build integration
|
||||
|
||||
package app_test
|
||||
|
||||
import (
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"google.golang.org/grpc/codes"
|
||||
"google.golang.org/grpc/status"
|
||||
|
||||
"github.com/zitadel/zitadel/internal/integration"
|
||||
"github.com/zitadel/zitadel/pkg/grpc/application/v2"
|
||||
)
|
||||
|
||||
func TestOIDCAppLinkConfig(t *testing.T) {
|
||||
p := instance.CreateProject(IAMOwnerCtx, t, instance.DefaultOrg.GetId(), integration.ProjectName(), false, false)
|
||||
|
||||
ios := &application.IOSAppLinkConfig{
|
||||
TeamId: "ABCDE12345",
|
||||
BundleId: "com.example.app",
|
||||
}
|
||||
android := &application.AndroidAppLinkConfig{
|
||||
PackageName: "com.example.app",
|
||||
Sha256CertFingerprints: []string{"AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99"},
|
||||
}
|
||||
|
||||
t.Run("create with incomplete ios config is rejected", func(t *testing.T) {
|
||||
_, err := instance.Client.ApplicationV2.CreateApplication(IAMOwnerCtx, &application.CreateApplicationRequest{
|
||||
ProjectId: p.GetId(),
|
||||
Name: integration.ApplicationName(),
|
||||
ApplicationType: &application.CreateApplicationRequest_OidcConfiguration{
|
||||
OidcConfiguration: baseOIDCCreateRequest(iosOnlyTeamID()),
|
||||
},
|
||||
})
|
||||
require.Equal(t, codes.InvalidArgument, status.Code(err))
|
||||
})
|
||||
|
||||
t.Run("create get update omit and clear round trip", func(t *testing.T) {
|
||||
created, err := instance.Client.ApplicationV2.CreateApplication(IAMOwnerCtx, &application.CreateApplicationRequest{
|
||||
ProjectId: p.GetId(),
|
||||
Name: integration.ApplicationName(),
|
||||
ApplicationType: &application.CreateApplicationRequest_OidcConfiguration{
|
||||
OidcConfiguration: baseOIDCCreateRequestWithAppLinks(ios, android),
|
||||
},
|
||||
})
|
||||
require.NoError(t, err)
|
||||
require.NotEmpty(t, created.GetApplicationId())
|
||||
|
||||
assertOIDCAppLinks(t, created.GetApplicationId(), ios, android)
|
||||
|
||||
updatedIos := &application.IOSAppLinkConfig{
|
||||
TeamId: "NEWTEAM123",
|
||||
BundleId: "com.example.app.updated",
|
||||
}
|
||||
updatedAndroid := &application.AndroidAppLinkConfig{
|
||||
PackageName: "com.example.app.updated",
|
||||
Sha256CertFingerprints: []string{"11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00"},
|
||||
}
|
||||
_, err = instance.Client.ApplicationV2.UpdateApplication(IAMOwnerCtx, &application.UpdateApplicationRequest{
|
||||
ProjectId: p.GetId(),
|
||||
ApplicationId: created.GetApplicationId(),
|
||||
ApplicationType: &application.UpdateApplicationRequest_OidcConfiguration{
|
||||
OidcConfiguration: &application.UpdateOIDCApplicationConfigurationRequest{
|
||||
Ios: updatedIos,
|
||||
Android: updatedAndroid,
|
||||
},
|
||||
},
|
||||
})
|
||||
require.NoError(t, err)
|
||||
assertOIDCAppLinks(t, created.GetApplicationId(), updatedIos, updatedAndroid)
|
||||
|
||||
_, err = instance.Client.ApplicationV2.UpdateApplication(IAMOwnerCtx, &application.UpdateApplicationRequest{
|
||||
ProjectId: p.GetId(),
|
||||
ApplicationId: created.GetApplicationId(),
|
||||
ApplicationType: &application.UpdateApplicationRequest_OidcConfiguration{
|
||||
OidcConfiguration: &application.UpdateOIDCApplicationConfigurationRequest{
|
||||
PostLogoutRedirectUris: []string{"http://example.com/home-omitted"},
|
||||
},
|
||||
},
|
||||
})
|
||||
require.NoError(t, err)
|
||||
assertOIDCAppLinks(t, created.GetApplicationId(), updatedIos, updatedAndroid)
|
||||
|
||||
_, err = instance.Client.ApplicationV2.UpdateApplication(IAMOwnerCtx, &application.UpdateApplicationRequest{
|
||||
ProjectId: p.GetId(),
|
||||
ApplicationId: created.GetApplicationId(),
|
||||
ApplicationType: &application.UpdateApplicationRequest_OidcConfiguration{
|
||||
OidcConfiguration: &application.UpdateOIDCApplicationConfigurationRequest{
|
||||
Ios: &application.IOSAppLinkConfig{},
|
||||
Android: &application.AndroidAppLinkConfig{},
|
||||
},
|
||||
},
|
||||
})
|
||||
require.NoError(t, err)
|
||||
assertOIDCAppLinks(t, created.GetApplicationId(), nil, nil)
|
||||
})
|
||||
}
|
||||
|
||||
func baseOIDCCreateRequest(opts ...func(*application.CreateOIDCApplicationRequest)) *application.CreateOIDCApplicationRequest {
|
||||
req := &application.CreateOIDCApplicationRequest{
|
||||
RedirectUris: []string{"http://example.com"},
|
||||
ResponseTypes: []application.OIDCResponseType{application.OIDCResponseType_OIDC_RESPONSE_TYPE_CODE},
|
||||
GrantTypes: []application.OIDCGrantType{application.OIDCGrantType_OIDC_GRANT_TYPE_AUTHORIZATION_CODE},
|
||||
ApplicationType: application.OIDCApplicationType_OIDC_APP_TYPE_NATIVE,
|
||||
AuthMethodType: application.OIDCAuthMethodType_OIDC_AUTH_METHOD_TYPE_NONE,
|
||||
PostLogoutRedirectUris: []string{"http://example.com/home"},
|
||||
Version: application.OIDCVersion_OIDC_VERSION_1_0,
|
||||
AccessTokenType: application.OIDCTokenType_OIDC_TOKEN_TYPE_BEARER,
|
||||
}
|
||||
for _, opt := range opts {
|
||||
opt(req)
|
||||
}
|
||||
return req
|
||||
}
|
||||
|
||||
func baseOIDCCreateRequestWithAppLinks(ios *application.IOSAppLinkConfig, android *application.AndroidAppLinkConfig) *application.CreateOIDCApplicationRequest {
|
||||
return baseOIDCCreateRequest(func(req *application.CreateOIDCApplicationRequest) {
|
||||
req.Ios = ios
|
||||
req.Android = android
|
||||
})
|
||||
}
|
||||
|
||||
func iosOnlyTeamID() func(*application.CreateOIDCApplicationRequest) {
|
||||
return func(req *application.CreateOIDCApplicationRequest) {
|
||||
req.Ios = &application.IOSAppLinkConfig{TeamId: "ABCDE12345"}
|
||||
}
|
||||
}
|
||||
|
||||
func assertOIDCAppLinks(t *testing.T, appID string, wantIOS *application.IOSAppLinkConfig, wantAndroid *application.AndroidAppLinkConfig) {
|
||||
t.Helper()
|
||||
retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMOwnerCtx, time.Minute)
|
||||
require.EventuallyWithT(t, func(ct *assert.CollectT) {
|
||||
res, err := instance.Client.ApplicationV2.GetApplication(IAMOwnerCtx, &application.GetApplicationRequest{
|
||||
ApplicationId: appID,
|
||||
})
|
||||
require.NoError(ct, err)
|
||||
cfg := res.GetApplication().GetOidcConfiguration()
|
||||
require.NotNil(ct, cfg)
|
||||
|
||||
if wantIOS == nil {
|
||||
assert.Nil(ct, cfg.GetIos())
|
||||
} else {
|
||||
require.NotNil(ct, cfg.GetIos())
|
||||
assert.Equal(ct, wantIOS.GetTeamId(), cfg.GetIos().GetTeamId())
|
||||
assert.Equal(ct, wantIOS.GetBundleId(), cfg.GetIos().GetBundleId())
|
||||
}
|
||||
|
||||
if wantAndroid == nil {
|
||||
assert.Nil(ct, cfg.GetAndroid())
|
||||
} else {
|
||||
require.NotNil(ct, cfg.GetAndroid())
|
||||
assert.Equal(ct, wantAndroid.GetPackageName(), cfg.GetAndroid().GetPackageName())
|
||||
assert.Equal(ct, wantAndroid.GetSha256CertFingerprints(), cfg.GetAndroid().GetSha256CertFingerprints())
|
||||
}
|
||||
}, retryDuration, tick)
|
||||
}
|
||||
Reference in New Issue
Block a user