From a8bbac37d9861aaed7e03a54a592408c748e587d Mon Sep 17 00:00:00 2001 From: Stefan Benz <46600784+stebenz@users.noreply.github.com> Date: Tue, 14 Oct 2025 18:24:09 +0200 Subject: [PATCH] chore: fix some eventual consistent integration testing (#10752) # Which Problems Are Solved Flakiness in integration tests because of eventual consistentcy. # How the Problems Are Solved Split tests related to feature flags and other eventual consistent resources. # Additional Changes None # Additional Context None Co-authored-by: Marco A. --- .../app/v2beta/integration_test/query_test.go | 10 +- .../v2beta/integration_test/server_test.go | 2 - .../oidc/v2/integration_test/oidc_test.go | 24 +- .../saml/v2/integration_test/saml_test.go | 24 +- .../v2/integration_test/server_test.go | 44 +- .../v2/integration_test/session_test.go | 7 +- .../user/v2/integration_test/email_test.go | 20 +- .../user/v2/integration_test/idp_link_test.go | 12 +- .../grpc/user/v2/integration_test/key_test.go | 322 ++++- .../user/v2/integration_test/metadata_test.go | 16 +- .../grpc/user/v2/integration_test/otp_test.go | 88 +- .../user/v2/integration_test/passkey_test.go | 44 +- .../user/v2/integration_test/password_test.go | 22 +- .../grpc/user/v2/integration_test/pat_test.go | 323 ++++- .../user/v2/integration_test/phone_test.go | 34 +- .../user/v2/integration_test/query_test.go | 1119 ++++++++++++++--- .../user/v2/integration_test/secret_test.go | 32 +- .../user/v2/integration_test/server_test.go | 80 ++ .../user/v2/integration_test/totp_test.go | 40 +- .../grpc/user/v2/integration_test/u2f_test.go | 24 +- .../user/v2/integration_test/user_test.go | 544 ++++---- 21 files changed, 2100 insertions(+), 731 deletions(-) create mode 100644 internal/api/grpc/user/v2/integration_test/server_test.go diff --git a/internal/api/grpc/app/v2beta/integration_test/query_test.go b/internal/api/grpc/app/v2beta/integration_test/query_test.go index 4112df19a..440c8c3f3 100644 --- a/internal/api/grpc/app/v2beta/integration_test/query_test.go +++ b/internal/api/grpc/app/v2beta/integration_test/query_test.go @@ -668,13 +668,12 @@ func TestListApplicationKeys(t *testing.T) { tomorrow := time.Now().AddDate(0, 0, 1) in2Days := tomorrow.AddDate(0, 0, 1) in3Days := in2Days.AddDate(0, 0, 1) + in4Days := in3Days.AddDate(0, 0, 1) - appKey1 := createAppKey(t, IAMOwnerCtx, instance, p.GetId(), createdApiApp1.GetAppId(), in2Days) - appKey2 := createAppKey(t, IAMOwnerCtx, instance, p.GetId(), createdApiApp1.GetAppId(), in3Days) + appKey1 := createAppKey(t, IAMOwnerCtx, instance, p.GetId(), createdApiApp1.GetAppId(), in3Days) + appKey2 := createAppKey(t, IAMOwnerCtx, instance, p.GetId(), createdApiApp1.GetAppId(), in4Days) appKey3 := createAppKey(t, IAMOwnerCtx, instance, p.GetId(), createdApiApp1.GetAppId(), tomorrow) - appKey4 := createAppKey(t, IAMOwnerCtx, instance, p.GetId(), createdApiApp2.GetAppId(), tomorrow) - - t.Parallel() + appKey4 := createAppKey(t, IAMOwnerCtx, instance, p.GetId(), createdApiApp2.GetAppId(), in2Days) tt := []struct { testName string @@ -728,7 +727,6 @@ func TestListApplicationKeys(t *testing.T) { require.Equal(ttt, tc.expectedErrorType, status.Code(err)) if tc.expectedErrorType == codes.OK { require.Len(ttt, res.GetKeys(), len(tc.expectedAppKeysIDs)) - for i, k := range res.GetKeys() { assert.Equal(ttt, tc.expectedAppKeysIDs[i], k.GetId()) } diff --git a/internal/api/grpc/app/v2beta/integration_test/server_test.go b/internal/api/grpc/app/v2beta/integration_test/server_test.go index 488064930..9e077d1a1 100644 --- a/internal/api/grpc/app/v2beta/integration_test/server_test.go +++ b/internal/api/grpc/app/v2beta/integration_test/server_test.go @@ -212,8 +212,6 @@ func createAppKey(t *testing.T, ctx context.Context, inst *integration.Instance, ExpirationDate: timestamppb.New(expirationDate.UTC()), }, ) - require.Nil(t, err) - return res } diff --git a/internal/api/grpc/oidc/v2/integration_test/oidc_test.go b/internal/api/grpc/oidc/v2/integration_test/oidc_test.go index 5cba4fc37..e2ddebe6b 100644 --- a/internal/api/grpc/oidc/v2/integration_test/oidc_test.go +++ b/internal/api/grpc/oidc/v2/integration_test/oidc_test.go @@ -17,9 +17,11 @@ import ( "github.com/zitadel/zitadel/internal/integration" "github.com/zitadel/zitadel/pkg/grpc/app" + filter "github.com/zitadel/zitadel/pkg/grpc/filter/v2beta" mgmt "github.com/zitadel/zitadel/pkg/grpc/management" "github.com/zitadel/zitadel/pkg/grpc/object/v2" oidc_pb "github.com/zitadel/zitadel/pkg/grpc/oidc/v2" + project_v2beta "github.com/zitadel/zitadel/pkg/grpc/project/v2beta" "github.com/zitadel/zitadel/pkg/grpc/session/v2" ) @@ -624,7 +626,7 @@ func TestServer_CreateCallback_Permission(t *testing.T) { projectID, clientID := createOIDCApplication(ctx, t, false, true) orgResp := Instance.CreateOrganization(ctx, integration.OrganizationName(), integration.Email()) - Instance.CreateProjectGrant(ctx, t, projectID, orgResp.GetOrganizationId()) + createProjectGrant(ctx, t, projectID, orgResp.GetOrganizationId()) user := Instance.CreateHumanUserVerified(ctx, orgResp.GetOrganizationId(), integration.Email(), integration.Phone()) return createSessionAndAuthRequestForCallback(ctx, t, clientID, Instance.Users.Get(integration.UserTypeLogin).ID, user.GetUserId()) @@ -939,6 +941,26 @@ func createOIDCApplication(ctx context.Context, t *testing.T, projectRoleCheck, return project.GetId(), clientV2.GetClientId() } +func createProjectGrant(ctx context.Context, t *testing.T, projectID, grantedOrgID string) { + Instance.CreateProjectGrant(ctx, t, projectID, grantedOrgID) + + retryDuration, tick := integration.WaitForAndTickWithMaxDuration(ctx, time.Minute) + require.EventuallyWithT(t, func(collect *assert.CollectT) { + resp, err := Instance.Client.Projectv2Beta.ListProjectGrants(ctx, &project_v2beta.ListProjectGrantsRequest{ + Filters: []*project_v2beta.ProjectGrantSearchFilter{ + {Filter: &project_v2beta.ProjectGrantSearchFilter_InProjectIdsFilter{InProjectIdsFilter: &filter.InIDsFilter{ + Ids: []string{projectID}, + }}}, + {Filter: &project_v2beta.ProjectGrantSearchFilter_ProjectGrantResourceOwnerFilter{ProjectGrantResourceOwnerFilter: &filter.IDFilter{ + Id: grantedOrgID, + }}}, + }, + }) + assert.NoError(collect, err) + assert.Len(collect, resp.GetProjectGrants(), 1) + }, retryDuration, tick) +} + func createProjectUserGrant(ctx context.Context, t *testing.T, orgID, projectID, userID string) { resp := Instance.CreateAuthorizationProject(t, ctx, projectID, userID) diff --git a/internal/api/grpc/saml/v2/integration_test/saml_test.go b/internal/api/grpc/saml/v2/integration_test/saml_test.go index d5c3e3d38..70a63009d 100644 --- a/internal/api/grpc/saml/v2/integration_test/saml_test.go +++ b/internal/api/grpc/saml/v2/integration_test/saml_test.go @@ -17,8 +17,10 @@ import ( "google.golang.org/protobuf/types/known/timestamppb" "github.com/zitadel/zitadel/internal/integration" + filter "github.com/zitadel/zitadel/pkg/grpc/filter/v2beta" mgmt "github.com/zitadel/zitadel/pkg/grpc/management" "github.com/zitadel/zitadel/pkg/grpc/object/v2" + project_v2beta "github.com/zitadel/zitadel/pkg/grpc/project/v2beta" saml_pb "github.com/zitadel/zitadel/pkg/grpc/saml/v2" "github.com/zitadel/zitadel/pkg/grpc/session/v2" ) @@ -609,7 +611,7 @@ func TestServer_CreateResponse_Permission(t *testing.T) { dep: func(ctx context.Context, t *testing.T) *saml_pb.CreateResponseRequest { projectID, _, sp := createSAMLApplication(ctx, t, idpMetadata, saml.HTTPRedirectBinding, false, true) orgResp := Instance.CreateOrganization(ctx, integration.OrganizationName(), integration.Email()) - Instance.CreateProjectGrant(ctx, t, projectID, orgResp.GetOrganizationId()) + createProjectGrant(ctx, t, projectID, orgResp.GetOrganizationId()) user := Instance.CreateHumanUserVerified(ctx, orgResp.GetOrganizationId(), integration.Email(), integration.Phone()) return createSessionAndSmlRequestForCallback(ctx, t, sp, Instance.Users[integration.UserTypeLogin].ID, acsRedirect, user.GetUserId(), saml.HTTPRedirectBinding) @@ -693,6 +695,26 @@ func createSAMLApplication(ctx context.Context, t *testing.T, idpMetadata *saml. return project.GetId(), rootURL, sp } +func createProjectGrant(ctx context.Context, t *testing.T, projectID, grantedOrgID string) { + Instance.CreateProjectGrant(ctx, t, projectID, grantedOrgID) + + retryDuration, tick := integration.WaitForAndTickWithMaxDuration(ctx, time.Minute) + require.EventuallyWithT(t, func(collect *assert.CollectT) { + resp, err := Instance.Client.Projectv2Beta.ListProjectGrants(ctx, &project_v2beta.ListProjectGrantsRequest{ + Filters: []*project_v2beta.ProjectGrantSearchFilter{ + {Filter: &project_v2beta.ProjectGrantSearchFilter_InProjectIdsFilter{InProjectIdsFilter: &filter.InIDsFilter{ + Ids: []string{projectID}, + }}}, + {Filter: &project_v2beta.ProjectGrantSearchFilter_ProjectGrantResourceOwnerFilter{ProjectGrantResourceOwnerFilter: &filter.IDFilter{ + Id: grantedOrgID, + }}}, + }, + }) + assert.NoError(collect, err) + assert.Len(collect, resp.GetProjectGrants(), 1) + }, retryDuration, tick) +} + func createProjectUserGrant(ctx context.Context, t *testing.T, orgID, projectID, userID string) { resp := Instance.CreateAuthorizationProject(t, ctx, projectID, userID) diff --git a/internal/api/grpc/session/v2/integration_test/server_test.go b/internal/api/grpc/session/v2/integration_test/server_test.go index 6ea2b4dbd..19d9d7879 100644 --- a/internal/api/grpc/session/v2/integration_test/server_test.go +++ b/internal/api/grpc/session/v2/integration_test/server_test.go @@ -8,6 +8,8 @@ import ( "testing" "time" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" "github.com/zitadel/logging" "github.com/zitadel/zitadel/internal/integration" @@ -16,15 +18,13 @@ import ( ) var ( - CTX context.Context - IAMOwnerCTX context.Context - UserCTX context.Context - LoginCTX context.Context - Instance *integration.Instance - Client session.SessionServiceClient - User *user.AddHumanUserResponse - DeactivatedUser *user.AddHumanUserResponse - LockedUser *user.AddHumanUserResponse + CTX context.Context + IAMOwnerCTX context.Context + UserCTX context.Context + LoginCTX context.Context + Instance *integration.Instance + Client session.SessionServiceClient + User *user.AddHumanUserResponse ) func TestMain(m *testing.M) { @@ -40,8 +40,6 @@ func TestMain(m *testing.M) { UserCTX = Instance.WithAuthorization(ctx, integration.UserTypeNoPermission) LoginCTX = Instance.WithAuthorization(ctx, integration.UserTypeLogin) User = createFullUser(CTX) - DeactivatedUser = createDeactivatedUser(CTX) - LockedUser = createLockedUser(CTX) return m.Run() }()) } @@ -61,16 +59,36 @@ func createFullUser(ctx context.Context) *user.AddHumanUserResponse { return userResp } -func createDeactivatedUser(ctx context.Context) *user.AddHumanUserResponse { +func createDeactivatedUser(ctx context.Context, t *testing.T) *user.AddHumanUserResponse { userResp := Instance.CreateHumanUser(ctx) _, err := Instance.Client.UserV2.DeactivateUser(ctx, &user.DeactivateUserRequest{UserId: userResp.GetUserId()}) logging.OnError(err).Fatal("deactivate human user") + + retryDuration, tick := integration.WaitForAndTickWithMaxDuration(ctx, time.Minute) + require.EventuallyWithT(t, func(collect *assert.CollectT) { + result, err := Instance.Client.UserV2.GetUserByID(ctx, &user.GetUserByIDRequest{ + UserId: userResp.GetUserId(), + }) + assert.NoError(collect, err) + assert.Equal(t, user.UserState_USER_STATE_INACTIVE, result.GetUser().GetState()) + }, retryDuration, tick, "user not locked in time") + return userResp } -func createLockedUser(ctx context.Context) *user.AddHumanUserResponse { +func createLockedUser(ctx context.Context, t *testing.T) *user.AddHumanUserResponse { userResp := Instance.CreateHumanUser(ctx) _, err := Instance.Client.UserV2.LockUser(ctx, &user.LockUserRequest{UserId: userResp.GetUserId()}) logging.OnError(err).Fatal("lock human user") + + retryDuration, tick := integration.WaitForAndTickWithMaxDuration(ctx, time.Minute) + require.EventuallyWithT(t, func(collect *assert.CollectT) { + result, err := Instance.Client.UserV2.GetUserByID(ctx, &user.GetUserByIDRequest{ + UserId: userResp.GetUserId(), + }) + assert.NoError(collect, err) + assert.Equal(t, user.UserState_USER_STATE_LOCKED, result.GetUser().GetState()) + }, retryDuration, tick, "user not locked in time") + return userResp } diff --git a/internal/api/grpc/session/v2/integration_test/session_test.go b/internal/api/grpc/session/v2/integration_test/session_test.go index c7b9d41d0..a9581eea6 100644 --- a/internal/api/grpc/session/v2/integration_test/session_test.go +++ b/internal/api/grpc/session/v2/integration_test/session_test.go @@ -127,6 +127,9 @@ func verifyFactors(t assert.TestingT, factors *session.Factors, creationDate, ch } func TestServer_CreateSession(t *testing.T) { + lockedUser := createLockedUser(CTX, t) + deactivatedUser := createDeactivatedUser(CTX, t) + tests := []struct { name string req *session.CreateSessionRequest @@ -190,7 +193,7 @@ func TestServer_CreateSession(t *testing.T) { Checks: &session.Checks{ User: &session.CheckUser{ Search: &session.CheckUser_UserId{ - UserId: DeactivatedUser.GetUserId(), + UserId: deactivatedUser.GetUserId(), }, }, }, @@ -203,7 +206,7 @@ func TestServer_CreateSession(t *testing.T) { Checks: &session.Checks{ User: &session.CheckUser{ Search: &session.CheckUser_UserId{ - UserId: LockedUser.GetUserId(), + UserId: lockedUser.GetUserId(), }, }, }, diff --git a/internal/api/grpc/user/v2/integration_test/email_test.go b/internal/api/grpc/user/v2/integration_test/email_test.go index fd64fd589..61adf49ad 100644 --- a/internal/api/grpc/user/v2/integration_test/email_test.go +++ b/internal/api/grpc/user/v2/integration_test/email_test.go @@ -16,7 +16,7 @@ import ( ) func TestServer_Deprecated_SetEmail(t *testing.T) { - userID := Instance.CreateHumanUser(CTX).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() tests := []struct { name string @@ -127,7 +127,7 @@ func TestServer_Deprecated_SetEmail(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - got, err := Client.SetEmail(CTX, tt.req) + got, err := Client.SetEmail(OrgCTX, tt.req) if tt.wantErr { require.Error(t, err) return @@ -145,8 +145,8 @@ func TestServer_Deprecated_SetEmail(t *testing.T) { } func TestServer_ResendEmailCode(t *testing.T) { - userID := Instance.CreateHumanUser(CTX).GetUserId() - verifiedUserID := Instance.CreateHumanUserVerified(CTX, Instance.DefaultOrg.Id, integration.Email(), integration.Phone()).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() + verifiedUserID := Instance.CreateHumanUserVerified(OrgCTX, Instance.DefaultOrg.Id, integration.Email(), integration.Phone()).GetUserId() tests := []struct { name string @@ -231,7 +231,7 @@ func TestServer_ResendEmailCode(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - got, err := Client.ResendEmailCode(CTX, tt.req) + got, err := Client.ResendEmailCode(OrgCTX, tt.req) if tt.wantErr { require.Error(t, err) return @@ -249,8 +249,8 @@ func TestServer_ResendEmailCode(t *testing.T) { } func TestServer_SendEmailCode(t *testing.T) { - userID := Instance.CreateHumanUser(CTX).GetUserId() - verifiedUserID := Instance.CreateHumanUserVerified(CTX, Instance.DefaultOrg.Id, integration.Email(), integration.Phone()).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() + verifiedUserID := Instance.CreateHumanUserVerified(OrgCTX, Instance.DefaultOrg.Id, integration.Email(), integration.Phone()).GetUserId() tests := []struct { name string @@ -341,7 +341,7 @@ func TestServer_SendEmailCode(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - got, err := Client.SendEmailCode(CTX, tt.req) + got, err := Client.SendEmailCode(OrgCTX, tt.req) if tt.wantErr { require.Error(t, err) return @@ -359,7 +359,7 @@ func TestServer_SendEmailCode(t *testing.T) { } func TestServer_VerifyEmail(t *testing.T) { - userResp := Instance.CreateHumanUser(CTX) + userResp := Instance.CreateHumanUser(OrgCTX) tests := []struct { name string req *user.VerifyEmailRequest @@ -399,7 +399,7 @@ func TestServer_VerifyEmail(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - got, err := Client.VerifyEmail(CTX, tt.req) + got, err := Client.VerifyEmail(OrgCTX, tt.req) if tt.wantErr { require.Error(t, err) return diff --git a/internal/api/grpc/user/v2/integration_test/idp_link_test.go b/internal/api/grpc/user/v2/integration_test/idp_link_test.go index 71335859e..7484a4b54 100644 --- a/internal/api/grpc/user/v2/integration_test/idp_link_test.go +++ b/internal/api/grpc/user/v2/integration_test/idp_link_test.go @@ -32,7 +32,7 @@ func TestServer_AddIDPLink(t *testing.T) { { name: "user does not exist", args: args{ - CTX, + OrgCTX, &user.AddIDPLinkRequest{ UserId: "userID", IdpLink: &user.IDPLink{ @@ -48,7 +48,7 @@ func TestServer_AddIDPLink(t *testing.T) { { name: "idp does not exist", args: args{ - CTX, + OrgCTX, &user.AddIDPLinkRequest{ UserId: Instance.Users.Get(integration.UserTypeOrgOwner).ID, IdpLink: &user.IDPLink{ @@ -64,7 +64,7 @@ func TestServer_AddIDPLink(t *testing.T) { { name: "add link", args: args{ - CTX, + OrgCTX, &user.AddIDPLinkRequest{ UserId: Instance.Users.Get(integration.UserTypeOrgOwner).ID, IdpLink: &user.IDPLink{ @@ -149,7 +149,7 @@ func TestServer_ListIDPLinks(t *testing.T) { { name: "list links, no permission, org", args: args{ - CTX, + OrgCTX, &user.ListIDPLinksRequest{ UserId: userOrgResp.GetUserId(), }, @@ -230,7 +230,7 @@ func TestServer_ListIDPLinks(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - retryDuration, tick := integration.WaitForAndTickWithMaxDuration(CTX, time.Minute) + retryDuration, tick := integration.WaitForAndTickWithMaxDuration(OrgCTX, time.Minute) require.EventuallyWithT(t, func(ttt *assert.CollectT) { got, err := Client.ListIDPLinks(tt.args.ctx, tt.args.req) if tt.wantErr { @@ -291,7 +291,7 @@ func TestServer_RemoveIDPLink(t *testing.T) { { name: "remove link, no permission, org", args: args{ - CTX, + OrgCTX, &user.RemoveIDPLinkRequest{ UserId: userOrgResp.GetUserId(), IdpId: orgIdpResp.Id, diff --git a/internal/api/grpc/user/v2/integration_test/key_test.go b/internal/api/grpc/user/v2/integration_test/key_test.go index bce39c1b9..dee861c51 100644 --- a/internal/api/grpc/user/v2/integration_test/key_test.go +++ b/internal/api/grpc/user/v2/integration_test/key_test.go @@ -135,7 +135,7 @@ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 now := time.Now() err := tt.args.prepare(tt.args.req) require.NoError(t, err) - got, err := Client.AddKey(CTX, tt.args.req) + got, err := Client.AddKey(OrgCTX, tt.args.req) if tt.wantErr { require.Error(t, err) return @@ -155,7 +155,7 @@ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 } func TestServer_AddKey_Permission(t *testing.T) { - OrgCTX := CTX + OrgCTX := OrgCTX otherOrg := Instance.CreateOrganization(IamCTX, integration.OrganizationName(), integration.Email()) otherOrgUser, err := Client.CreateUser(IamCTX, &user.CreateUserRequest{ OrganizationId: otherOrg.OrganizationId, @@ -281,7 +281,7 @@ func TestServer_RemoveKey(t *testing.T) { now := time.Now() err := tt.args.prepare(tt.args.req) require.NoError(t, err) - got, err := Client.RemoveKey(CTX, tt.args.req) + got, err := Client.RemoveKey(OrgCTX, tt.args.req) if tt.wantErr { require.Error(t, err) return @@ -295,7 +295,7 @@ func TestServer_RemoveKey(t *testing.T) { } func TestServer_RemoveKey_Permission(t *testing.T) { - OrgCTX := CTX + OrgCTX := OrgCTX otherOrg := Instance.CreateOrganization(IamCTX, integration.OrganizationName(), integration.Email()) otherOrgUser, err := Client.CreateUser(IamCTX, &user.CreateUserRequest{ OrganizationId: otherOrg.OrganizationId, @@ -374,9 +374,9 @@ func TestServer_ListKeys(t *testing.T) { args args want *user.ListKeysResponse } - OrgCTX := CTX - otherOrg := Instance.CreateOrganization(SystemCTX, integration.OrganizationName(), integration.Email()) - otherOrgUser, err := Client.CreateUser(SystemCTX, &user.CreateUserRequest{ + OrgCTX := OrgCTX + otherOrg := Instance.CreateOrganization(IamCTX, integration.OrganizationName(), integration.Email()) + otherOrgUser, err := Client.CreateUser(IamCTX, &user.CreateUserRequest{ OrganizationId: otherOrg.OrganizationId, UserType: &user.CreateUserRequest_Machine_{ Machine: &user.CreateUserRequest_Machine{ @@ -386,7 +386,7 @@ func TestServer_ListKeys(t *testing.T) { }) require.NoError(t, err) otherOrgUserId := otherOrgUser.GetId() - otherUserId := Instance.CreateUserTypeMachine(SystemCTX, Instance.DefaultOrg.Id).GetId() + otherUserId := Instance.CreateUserTypeMachine(IamCTX, Instance.DefaultOrg.Id).GetId() onlySinceTestStartFilter := &user.KeysSearchFilter{Filter: &user.KeysSearchFilter_CreatedDateFilter{CreatedDateFilter: &filter.TimestampFilter{ Timestamp: timestamppb.Now(), Method: filter.TimestampFilterMethod_TIMESTAMP_FILTER_METHOD_AFTER_OR_EQUALS, @@ -394,12 +394,12 @@ func TestServer_ListKeys(t *testing.T) { myOrgId := Instance.DefaultOrg.GetId() myUserId := Instance.Users.Get(integration.UserTypeNoPermission).ID expiresInADay := time.Now().Truncate(time.Hour).Add(time.Hour * 24) - myDataPoint := setupKeyDataPoint(t, myUserId, myOrgId, expiresInADay) - otherUserDataPoint := setupKeyDataPoint(t, otherUserId, myOrgId, expiresInADay) - otherOrgDataPointExpiringSoon := setupKeyDataPoint(t, otherOrgUserId, otherOrg.OrganizationId, time.Now().Truncate(time.Hour).Add(time.Hour)) - otherOrgDataPointExpiringLate := setupKeyDataPoint(t, otherOrgUserId, otherOrg.OrganizationId, expiresInADay.Add(time.Hour*24*30)) + myDataPoint := setupKeyDataPoint(IamCTX, t, Instance, myUserId, myOrgId, expiresInADay) + otherUserDataPoint := setupKeyDataPoint(IamCTX, t, Instance, otherUserId, myOrgId, expiresInADay) + otherOrgDataPointExpiringSoon := setupKeyDataPoint(IamCTX, t, Instance, otherOrgUserId, otherOrg.OrganizationId, time.Now().Truncate(time.Hour).Add(time.Hour)) + otherOrgDataPointExpiringLate := setupKeyDataPoint(IamCTX, t, Instance, otherOrgUserId, otherOrg.OrganizationId, expiresInADay.Add(time.Hour*24*30)) sortingColumnExpirationDate := user.KeyFieldName_KEY_FIELD_NAME_KEY_EXPIRATION_DATE - awaitKeys(t, onlySinceTestStartFilter, + awaitKeys(IamCTX, t, Instance, onlySinceTestStartFilter, otherOrgDataPointExpiringSoon.GetId(), otherOrgDataPointExpiringLate.GetId(), otherUserDataPoint.GetId(), @@ -437,7 +437,7 @@ func TestServer_ListKeys(t *testing.T) { myDataPoint, }, Pagination: &filter.PaginationResponse{ - TotalResult: 2, + TotalResult: 4, AppliedLimit: 100, }, }, @@ -453,7 +453,7 @@ func TestServer_ListKeys(t *testing.T) { myDataPoint, }, Pagination: &filter.PaginationResponse{ - TotalResult: 1, + TotalResult: 4, AppliedLimit: 100, }, }, @@ -575,6 +575,245 @@ func TestServer_ListKeys(t *testing.T) { }, }, }, + want: &user.ListKeysResponse{ + Result: []*user.Key{}, + Pagination: &filter.PaginationResponse{ + TotalResult: 1, + AppliedLimit: 100, + }, + }, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + retryDuration, tick := integration.WaitForAndTickWithMaxDuration(tt.args.ctx, 20*time.Second) + require.EventuallyWithT(t, func(ttt *assert.CollectT) { + got, err := Client.ListKeys(tt.args.ctx, tt.args.req) + require.NoError(ttt, err) + if !assert.Len(ttt, got.Result, len(tt.want.Result)) { + return + } + if diff := cmp.Diff(tt.want, got, protocmp.Transform()); diff != "" { + ttt.Errorf("ListKeys() mismatch (-want +got):\n%s", diff) + } + }, retryDuration, tick, "timeout waiting for expected user result") + }) + } +} + +func TestServer_ListKeys_PermissionV2(t *testing.T) { + ensureFeaturePermissionV2Enabled(t, InstancePermissionV2) + iamOwnerCtx := InstancePermissionV2.WithAuthorizationToken(OrgCTX, integration.UserTypeIAMOwner) + + type args struct { + ctx context.Context + req *user.ListKeysRequest + } + type testCase struct { + name string + args args + want *user.ListKeysResponse + } + otherOrg := InstancePermissionV2.CreateOrganization(iamOwnerCtx, integration.OrganizationName(), integration.Email()) + otherOrgUser, err := InstancePermissionV2.Client.UserV2.CreateUser(iamOwnerCtx, &user.CreateUserRequest{ + OrganizationId: otherOrg.OrganizationId, + UserType: &user.CreateUserRequest_Machine_{ + Machine: &user.CreateUserRequest_Machine{ + Name: integration.Username(), + }, + }, + }) + require.NoError(t, err) + otherOrgUserId := otherOrgUser.GetId() + otherUserId := InstancePermissionV2.CreateUserTypeMachine(iamOwnerCtx, InstancePermissionV2.DefaultOrg.Id).GetId() + onlySinceTestStartFilter := &user.KeysSearchFilter{Filter: &user.KeysSearchFilter_CreatedDateFilter{CreatedDateFilter: &filter.TimestampFilter{ + Timestamp: timestamppb.Now(), + Method: filter.TimestampFilterMethod_TIMESTAMP_FILTER_METHOD_AFTER_OR_EQUALS, + }}} + myOrgId := InstancePermissionV2.DefaultOrg.GetId() + myUserId := InstancePermissionV2.Users.Get(integration.UserTypeNoPermission).ID + expiresInADay := time.Now().Truncate(time.Hour).Add(time.Hour * 24) + myDataPoint := setupKeyDataPoint(iamOwnerCtx, t, InstancePermissionV2, myUserId, myOrgId, expiresInADay) + otherUserDataPoint := setupKeyDataPoint(iamOwnerCtx, t, InstancePermissionV2, otherUserId, myOrgId, expiresInADay) + otherOrgDataPointExpiringSoon := setupKeyDataPoint(iamOwnerCtx, t, InstancePermissionV2, otherOrgUserId, otherOrg.OrganizationId, time.Now().Truncate(time.Hour).Add(time.Hour)) + otherOrgDataPointExpiringLate := setupKeyDataPoint(iamOwnerCtx, t, InstancePermissionV2, otherOrgUserId, otherOrg.OrganizationId, expiresInADay.Add(time.Hour*24*30)) + sortingColumnExpirationDate := user.KeyFieldName_KEY_FIELD_NAME_KEY_EXPIRATION_DATE + awaitKeys(iamOwnerCtx, t, InstancePermissionV2, onlySinceTestStartFilter, + otherOrgDataPointExpiringSoon.GetId(), + otherOrgDataPointExpiringLate.GetId(), + otherUserDataPoint.GetId(), + myDataPoint.GetId(), + ) + tests := []testCase{ + { + name: "list all, InstancePermissionV2", + args: args{ + iamOwnerCtx, + &user.ListKeysRequest{Filters: []*user.KeysSearchFilter{onlySinceTestStartFilter}}, + }, + want: &user.ListKeysResponse{ + Result: []*user.Key{ + otherOrgDataPointExpiringLate, + otherOrgDataPointExpiringSoon, + otherUserDataPoint, + myDataPoint, + }, + Pagination: &filter.PaginationResponse{ + TotalResult: 4, + AppliedLimit: 100, + }, + }, + }, + { + name: "list all, org", + args: args{ + InstancePermissionV2.WithAuthorizationToken(iamOwnerCtx, integration.UserTypeOrgOwner), + &user.ListKeysRequest{Filters: []*user.KeysSearchFilter{onlySinceTestStartFilter}}, + }, + want: &user.ListKeysResponse{ + Result: []*user.Key{ + otherUserDataPoint, + myDataPoint, + }, + Pagination: &filter.PaginationResponse{ + TotalResult: 2, + AppliedLimit: 100, + }, + }, + }, + { + name: "list all, user", + args: args{ + InstancePermissionV2.WithAuthorizationToken(iamOwnerCtx, integration.UserTypeNoPermission), + &user.ListKeysRequest{Filters: []*user.KeysSearchFilter{onlySinceTestStartFilter}}, + }, + want: &user.ListKeysResponse{ + Result: []*user.Key{ + myDataPoint, + }, + Pagination: &filter.PaginationResponse{ + TotalResult: 1, + AppliedLimit: 100, + }, + }, + }, + { + name: "list by id", + args: args{ + iamOwnerCtx, + &user.ListKeysRequest{ + Filters: []*user.KeysSearchFilter{ + onlySinceTestStartFilter, + { + Filter: &user.KeysSearchFilter_KeyIdFilter{ + KeyIdFilter: &filter.IDFilter{Id: otherOrgDataPointExpiringSoon.Id}, + }, + }, + }, + }, + }, + want: &user.ListKeysResponse{ + Result: []*user.Key{ + otherOrgDataPointExpiringSoon, + }, + Pagination: &filter.PaginationResponse{ + TotalResult: 1, + AppliedLimit: 100, + }, + }, + }, + { + name: "list all from other org", + args: args{ + iamOwnerCtx, + &user.ListKeysRequest{ + Filters: []*user.KeysSearchFilter{ + onlySinceTestStartFilter, + { + Filter: &user.KeysSearchFilter_OrganizationIdFilter{ + OrganizationIdFilter: &filter.IDFilter{Id: otherOrg.OrganizationId}, + }, + }, + }, + }, + }, + want: &user.ListKeysResponse{ + Result: []*user.Key{ + otherOrgDataPointExpiringLate, + otherOrgDataPointExpiringSoon, + }, + Pagination: &filter.PaginationResponse{ + TotalResult: 2, + AppliedLimit: 100, + }, + }, + }, + { + name: "sort by next expiration dates", + args: args{ + iamOwnerCtx, + &user.ListKeysRequest{ + Pagination: &filter.PaginationRequest{ + Asc: true, + }, + SortingColumn: &sortingColumnExpirationDate, + Filters: []*user.KeysSearchFilter{ + onlySinceTestStartFilter, + {Filter: &user.KeysSearchFilter_OrganizationIdFilter{OrganizationIdFilter: &filter.IDFilter{Id: otherOrg.OrganizationId}}}, + }, + }, + }, + want: &user.ListKeysResponse{ + Result: []*user.Key{ + otherOrgDataPointExpiringSoon, + otherOrgDataPointExpiringLate, + }, + Pagination: &filter.PaginationResponse{ + TotalResult: 2, + AppliedLimit: 100, + }, + }, + }, + { + name: "get page", + args: args{ + iamOwnerCtx, + &user.ListKeysRequest{ + Pagination: &filter.PaginationRequest{ + Offset: 2, + Limit: 2, + Asc: true, + }, + Filters: []*user.KeysSearchFilter{ + onlySinceTestStartFilter, + }, + }, + }, + want: &user.ListKeysResponse{ + Result: []*user.Key{ + otherOrgDataPointExpiringSoon, + otherOrgDataPointExpiringLate, + }, + Pagination: &filter.PaginationResponse{ + TotalResult: 4, + AppliedLimit: 2, + }, + }, + }, + { + name: "empty list", + args: args{ + InstancePermissionV2.WithAuthorizationToken(iamOwnerCtx, integration.UserTypeNoPermission), + &user.ListKeysRequest{ + Filters: []*user.KeysSearchFilter{ + { + Filter: &user.KeysSearchFilter_KeyIdFilter{ + KeyIdFilter: &filter.IDFilter{Id: otherUserDataPoint.Id}, + }, + }, + }, + }, + }, want: &user.ListKeysResponse{ Result: []*user.Key{}, Pagination: &filter.PaginationResponse{ @@ -584,41 +823,24 @@ func TestServer_ListKeys(t *testing.T) { }, }, } - t.Run("with permission flag v2", func(t *testing.T) { - setPermissionCheckV2Flag(t, true) - defer setPermissionCheckV2Flag(t, false) - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - got, err := Client.ListKeys(tt.args.ctx, tt.args.req) - require.NoError(t, err) - assert.Len(t, got.Result, len(tt.want.Result)) + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + retryDuration, tick := integration.WaitForAndTickWithMaxDuration(tt.args.ctx, 20*time.Second) + require.EventuallyWithT(t, func(ttt *assert.CollectT) { + got, err := InstancePermissionV2.Client.UserV2.ListKeys(tt.args.ctx, tt.args.req) + require.NoError(ttt, err) + assert.Len(ttt, got.Result, len(tt.want.Result)) if diff := cmp.Diff(tt.want, got, protocmp.Transform()); diff != "" { - t.Errorf("ListKeys() mismatch (-want +got):\n%s", diff) + ttt.Errorf("ListKeys() mismatch (-want +got):\n%s", diff) } - }) - } - }) - t.Run("without permission flag v2", func(t *testing.T) { - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - got, err := Client.ListKeys(tt.args.ctx, tt.args.req) - require.NoError(t, err) - assert.Len(t, got.Result, len(tt.want.Result)) - // ignore the total result, as this is a known bug with the in-memory permission checks. - // The command can't know how many keys exist in the system if the SQL statement has a limit. - // This is fixed, once the in-memory permission checks are removed with https://github.com/zitadel/zitadel/issues/9188 - tt.want.Pagination.TotalResult = got.Pagination.TotalResult - if diff := cmp.Diff(tt.want, got, protocmp.Transform()); diff != "" { - t.Errorf("ListKeys() mismatch (-want +got):\n%s", diff) - } - }) - } - }) + }, retryDuration, tick, "timeout waiting for expected user result") + }) + } } -func setupKeyDataPoint(t *testing.T, userId, orgId string, expirationDate time.Time) *user.Key { +func setupKeyDataPoint(ctx context.Context, t *testing.T, instance *integration.Instance, userId, orgId string, expirationDate time.Time) *user.Key { expirationDatePb := timestamppb.New(expirationDate) - newKey, err := Client.AddKey(SystemCTX, &user.AddKeyRequest{ + newKey, err := instance.Client.UserV2.AddKey(ctx, &user.AddKeyRequest{ UserId: userId, ExpirationDate: expirationDatePb, PublicKey: nil, @@ -634,18 +856,20 @@ func setupKeyDataPoint(t *testing.T, userId, orgId string, expirationDate time.T } } -func awaitKeys(t *testing.T, sinceTestStartFilter *user.KeysSearchFilter, keyIds ...string) { +func awaitKeys(ctx context.Context, t *testing.T, instance *integration.Instance, sinceTestStartFilter *user.KeysSearchFilter, keyIds ...string) { sortingColumn := user.KeyFieldName_KEY_FIELD_NAME_ID slices.Sort(keyIds) + + retryDuration, tick := integration.WaitForAndTickWithMaxDuration(ctx, time.Minute) require.EventuallyWithT(t, func(collect *assert.CollectT) { - result, err := Client.ListKeys(SystemCTX, &user.ListKeysRequest{ + result, err := instance.Client.UserV2.ListKeys(ctx, &user.ListKeysRequest{ Filters: []*user.KeysSearchFilter{sinceTestStartFilter}, SortingColumn: &sortingColumn, Pagination: &filter.PaginationRequest{ Asc: true, }, }) - require.NoError(t, err) + require.NoError(collect, err) if !assert.Len(collect, result.Result, len(keyIds)) { return } @@ -653,5 +877,5 @@ func awaitKeys(t *testing.T, sinceTestStartFilter *user.KeysSearchFilter, keyIds keyId := keyIds[i] require.Equal(collect, keyId, result.Result[i].GetId()) } - }, 5*time.Second, time.Second, "key not created in time") + }, retryDuration, tick, "key not created in time") } diff --git a/internal/api/grpc/user/v2/integration_test/metadata_test.go b/internal/api/grpc/user/v2/integration_test/metadata_test.go index 0d95beae0..31931fab8 100644 --- a/internal/api/grpc/user/v2/integration_test/metadata_test.go +++ b/internal/api/grpc/user/v2/integration_test/metadata_test.go @@ -18,7 +18,7 @@ import ( ) func TestServer_SetUserMetadata(t *testing.T) { - iamOwnerCTX := Instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner) + iamOwnerCTX := Instance.WithAuthorizationToken(OrgCTX, integration.UserTypeIAMOwner) tests := []struct { name string @@ -32,7 +32,7 @@ func TestServer_SetUserMetadata(t *testing.T) { name: "missing permission", ctx: Instance.WithAuthorizationToken(context.Background(), integration.UserTypeNoPermission), dep: func(req *user.SetUserMetadataRequest) { - req.UserId = Instance.CreateUserTypeHuman(CTX, integration.Email()).GetId() + req.UserId = Instance.CreateUserTypeHuman(OrgCTX, integration.Email()).GetId() }, req: &user.SetUserMetadataRequest{ Metadata: []*user.Metadata{{Key: "key1", Value: []byte(base64.StdEncoding.EncodeToString([]byte("value1")))}}, @@ -43,7 +43,7 @@ func TestServer_SetUserMetadata(t *testing.T) { name: "set user metadata", ctx: iamOwnerCTX, dep: func(req *user.SetUserMetadataRequest) { - req.UserId = Instance.CreateUserTypeHuman(CTX, integration.Email()).GetId() + req.UserId = Instance.CreateUserTypeHuman(OrgCTX, integration.Email()).GetId() }, req: &user.SetUserMetadataRequest{ Metadata: []*user.Metadata{{Key: "key1", Value: []byte(base64.StdEncoding.EncodeToString([]byte("value1")))}}, @@ -54,7 +54,7 @@ func TestServer_SetUserMetadata(t *testing.T) { name: "set user metadata, multiple", ctx: iamOwnerCTX, dep: func(req *user.SetUserMetadataRequest) { - req.UserId = Instance.CreateUserTypeHuman(CTX, integration.Email()).GetId() + req.UserId = Instance.CreateUserTypeHuman(OrgCTX, integration.Email()).GetId() }, req: &user.SetUserMetadataRequest{ Metadata: []*user.Metadata{ @@ -76,7 +76,7 @@ func TestServer_SetUserMetadata(t *testing.T) { }, { name: "update user metadata", - ctx: Instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner), + ctx: Instance.WithAuthorizationToken(OrgCTX, integration.UserTypeIAMOwner), dep: func(req *user.SetUserMetadataRequest) { req.UserId = Instance.CreateUserTypeHuman(iamOwnerCTX, integration.Email()).GetId() Instance.SetUserMetadata(iamOwnerCTX, req.UserId, "key1", "value1") @@ -88,7 +88,7 @@ func TestServer_SetUserMetadata(t *testing.T) { }, { name: "update user metadata with same value", - ctx: Instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner), + ctx: Instance.WithAuthorizationToken(OrgCTX, integration.UserTypeIAMOwner), dep: func(req *user.SetUserMetadataRequest) { req.UserId = Instance.CreateUserTypeHuman(iamOwnerCTX, integration.Email()).GetId() Instance.SetUserMetadata(iamOwnerCTX, req.UserId, "key1", "value1") @@ -131,7 +131,7 @@ func assertSetUserMetadataResponse(t *testing.T, creationDate, changeDate time.T } func TestServer_ListUserMetadata(t *testing.T) { - iamOwnerCTX := Instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner) + iamOwnerCTX := Instance.WithAuthorizationToken(OrgCTX, integration.UserTypeIAMOwner) type args struct { ctx context.Context @@ -280,7 +280,7 @@ func assertPaginationResponse(t *assert.CollectT, expected *filter.PaginationRes } func TestServer_DeleteUserMetadata(t *testing.T) { - iamOwnerCTX := Instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner) + iamOwnerCTX := Instance.WithAuthorizationToken(OrgCTX, integration.UserTypeIAMOwner) tests := []struct { name string diff --git a/internal/api/grpc/user/v2/integration_test/otp_test.go b/internal/api/grpc/user/v2/integration_test/otp_test.go index 4ec54b26b..ff6006760 100644 --- a/internal/api/grpc/user/v2/integration_test/otp_test.go +++ b/internal/api/grpc/user/v2/integration_test/otp_test.go @@ -15,25 +15,25 @@ import ( ) func TestServer_AddOTPSMS(t *testing.T) { - userID := Instance.CreateHumanUser(CTX).GetUserId() - Instance.RegisterUserPasskey(CTX, userID) + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() + Instance.RegisterUserPasskey(OrgCTX, userID) _, sessionToken, _, _ := Instance.CreateVerifiedWebAuthNSession(t, LoginCTX, userID) - otherUser := Instance.CreateHumanUser(CTX).GetUserId() - Instance.RegisterUserPasskey(CTX, otherUser) + otherUser := Instance.CreateHumanUser(OrgCTX).GetUserId() + Instance.RegisterUserPasskey(OrgCTX, otherUser) _, sessionTokenOtherUser, _, _ := Instance.CreateVerifiedWebAuthNSession(t, LoginCTX, otherUser) - userVerified := Instance.CreateHumanUser(CTX) - _, err := Instance.Client.UserV2.VerifyPhone(CTX, &user.VerifyPhoneRequest{ + userVerified := Instance.CreateHumanUser(OrgCTX) + _, err := Instance.Client.UserV2.VerifyPhone(OrgCTX, &user.VerifyPhoneRequest{ UserId: userVerified.GetUserId(), VerificationCode: userVerified.GetPhoneCode(), }) require.NoError(t, err) - Instance.RegisterUserPasskey(CTX, userVerified.GetUserId()) + Instance.RegisterUserPasskey(OrgCTX, userVerified.GetUserId()) _, sessionTokenVerified, _, _ := Instance.CreateVerifiedWebAuthNSession(t, LoginCTX, userVerified.GetUserId()) - userVerified2 := Instance.CreateHumanUser(CTX) - _, err = Instance.Client.UserV2.VerifyPhone(CTX, &user.VerifyPhoneRequest{ + userVerified2 := Instance.CreateHumanUser(OrgCTX) + _, err = Instance.Client.UserV2.VerifyPhone(OrgCTX, &user.VerifyPhoneRequest{ UserId: userVerified2.GetUserId(), VerificationCode: userVerified2.GetPhoneCode(), }) @@ -52,7 +52,7 @@ func TestServer_AddOTPSMS(t *testing.T) { { name: "missing user id", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.AddOTPSMSRequest{}, }, wantErr: true, @@ -94,7 +94,7 @@ func TestServer_AddOTPSMS(t *testing.T) { { name: "add success, admin", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.AddOTPSMSRequest{ UserId: userVerified2.GetUserId(), }, @@ -121,30 +121,30 @@ func TestServer_AddOTPSMS(t *testing.T) { } func TestServer_RemoveOTPSMS(t *testing.T) { - userID := Instance.CreateHumanUser(CTX).GetUserId() - Instance.RegisterUserPasskey(CTX, userID) + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() + Instance.RegisterUserPasskey(OrgCTX, userID) _, sessionToken, _, _ := Instance.CreateVerifiedWebAuthNSession(t, LoginCTX, userID) - userVerified := Instance.CreateHumanUser(CTX) - Instance.RegisterUserPasskey(CTX, userVerified.GetUserId()) - _, err := Instance.Client.UserV2.VerifyPhone(CTX, &user.VerifyPhoneRequest{ + userVerified := Instance.CreateHumanUser(OrgCTX) + Instance.RegisterUserPasskey(OrgCTX, userVerified.GetUserId()) + _, err := Instance.Client.UserV2.VerifyPhone(OrgCTX, &user.VerifyPhoneRequest{ UserId: userVerified.GetUserId(), VerificationCode: userVerified.GetPhoneCode(), }) require.NoError(t, err) - _, err = Instance.Client.UserV2.AddOTPSMS(CTX, &user.AddOTPSMSRequest{UserId: userVerified.GetUserId()}) + _, err = Instance.Client.UserV2.AddOTPSMS(OrgCTX, &user.AddOTPSMSRequest{UserId: userVerified.GetUserId()}) require.NoError(t, err) - userSelf := Instance.CreateHumanUser(CTX) - Instance.RegisterUserPasskey(CTX, userSelf.GetUserId()) + userSelf := Instance.CreateHumanUser(OrgCTX) + Instance.RegisterUserPasskey(OrgCTX, userSelf.GetUserId()) _, sessionTokenSelf, _, _ := Instance.CreateVerifiedWebAuthNSession(t, LoginCTX, userSelf.GetUserId()) userSelfCtx := integration.WithAuthorizationToken(context.Background(), sessionTokenSelf) - _, err = Instance.Client.UserV2.VerifyPhone(CTX, &user.VerifyPhoneRequest{ + _, err = Instance.Client.UserV2.VerifyPhone(OrgCTX, &user.VerifyPhoneRequest{ UserId: userSelf.GetUserId(), VerificationCode: userSelf.GetPhoneCode(), }) require.NoError(t, err) - _, err = Instance.Client.UserV2.AddOTPSMS(CTX, &user.AddOTPSMSRequest{UserId: userSelf.GetUserId()}) + _, err = Instance.Client.UserV2.AddOTPSMS(OrgCTX, &user.AddOTPSMSRequest{UserId: userSelf.GetUserId()}) require.NoError(t, err) type args struct { @@ -184,7 +184,7 @@ func TestServer_RemoveOTPSMS(t *testing.T) { { name: "success", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.RemoveOTPSMSRequest{ UserId: userVerified.GetUserId(), }, @@ -211,25 +211,25 @@ func TestServer_RemoveOTPSMS(t *testing.T) { } func TestServer_AddOTPEmail(t *testing.T) { - userID := Instance.CreateHumanUser(CTX).GetUserId() - Instance.RegisterUserPasskey(CTX, userID) + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() + Instance.RegisterUserPasskey(OrgCTX, userID) _, sessionToken, _, _ := Instance.CreateVerifiedWebAuthNSession(t, LoginCTX, userID) - otherUser := Instance.CreateHumanUser(CTX).GetUserId() - Instance.RegisterUserPasskey(CTX, otherUser) + otherUser := Instance.CreateHumanUser(OrgCTX).GetUserId() + Instance.RegisterUserPasskey(OrgCTX, otherUser) _, sessionTokenOtherUser, _, _ := Instance.CreateVerifiedWebAuthNSession(t, LoginCTX, otherUser) - userVerified := Instance.CreateHumanUser(CTX) - _, err := Instance.Client.UserV2.VerifyEmail(CTX, &user.VerifyEmailRequest{ + userVerified := Instance.CreateHumanUser(OrgCTX) + _, err := Instance.Client.UserV2.VerifyEmail(OrgCTX, &user.VerifyEmailRequest{ UserId: userVerified.GetUserId(), VerificationCode: userVerified.GetEmailCode(), }) require.NoError(t, err) - Instance.RegisterUserPasskey(CTX, userVerified.GetUserId()) + Instance.RegisterUserPasskey(OrgCTX, userVerified.GetUserId()) _, sessionTokenVerified, _, _ := Instance.CreateVerifiedWebAuthNSession(t, LoginCTX, userVerified.GetUserId()) - userVerified2 := Instance.CreateHumanUser(CTX) - _, err = Instance.Client.UserV2.VerifyEmail(CTX, &user.VerifyEmailRequest{ + userVerified2 := Instance.CreateHumanUser(OrgCTX) + _, err = Instance.Client.UserV2.VerifyEmail(OrgCTX, &user.VerifyEmailRequest{ UserId: userVerified2.GetUserId(), VerificationCode: userVerified2.GetEmailCode(), }) @@ -248,7 +248,7 @@ func TestServer_AddOTPEmail(t *testing.T) { { name: "missing user id", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.AddOTPEmailRequest{}, }, wantErr: true, @@ -291,7 +291,7 @@ func TestServer_AddOTPEmail(t *testing.T) { { name: "add success, admin", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.AddOTPEmailRequest{ UserId: userVerified2.GetUserId(), }, @@ -319,30 +319,30 @@ func TestServer_AddOTPEmail(t *testing.T) { } func TestServer_RemoveOTPEmail(t *testing.T) { - userID := Instance.CreateHumanUser(CTX).GetUserId() - Instance.RegisterUserPasskey(CTX, userID) + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() + Instance.RegisterUserPasskey(OrgCTX, userID) _, sessionToken, _, _ := Instance.CreateVerifiedWebAuthNSession(t, LoginCTX, userID) - userVerified := Instance.CreateHumanUser(CTX) - Instance.RegisterUserPasskey(CTX, userVerified.GetUserId()) - _, err := Instance.Client.UserV2.VerifyEmail(CTX, &user.VerifyEmailRequest{ + userVerified := Instance.CreateHumanUser(OrgCTX) + Instance.RegisterUserPasskey(OrgCTX, userVerified.GetUserId()) + _, err := Instance.Client.UserV2.VerifyEmail(OrgCTX, &user.VerifyEmailRequest{ UserId: userVerified.GetUserId(), VerificationCode: userVerified.GetEmailCode(), }) require.NoError(t, err) - _, err = Instance.Client.UserV2.AddOTPEmail(CTX, &user.AddOTPEmailRequest{UserId: userVerified.GetUserId()}) + _, err = Instance.Client.UserV2.AddOTPEmail(OrgCTX, &user.AddOTPEmailRequest{UserId: userVerified.GetUserId()}) require.NoError(t, err) - userSelf := Instance.CreateHumanUser(CTX) - Instance.RegisterUserPasskey(CTX, userSelf.GetUserId()) + userSelf := Instance.CreateHumanUser(OrgCTX) + Instance.RegisterUserPasskey(OrgCTX, userSelf.GetUserId()) _, sessionTokenSelf, _, _ := Instance.CreateVerifiedWebAuthNSession(t, LoginCTX, userSelf.GetUserId()) userSelfCtx := integration.WithAuthorizationToken(context.Background(), sessionTokenSelf) - _, err = Instance.Client.UserV2.VerifyEmail(CTX, &user.VerifyEmailRequest{ + _, err = Instance.Client.UserV2.VerifyEmail(OrgCTX, &user.VerifyEmailRequest{ UserId: userSelf.GetUserId(), VerificationCode: userSelf.GetEmailCode(), }) require.NoError(t, err) - _, err = Instance.Client.UserV2.AddOTPEmail(CTX, &user.AddOTPEmailRequest{UserId: userSelf.GetUserId()}) + _, err = Instance.Client.UserV2.AddOTPEmail(OrgCTX, &user.AddOTPEmailRequest{UserId: userSelf.GetUserId()}) require.NoError(t, err) type args struct { @@ -383,7 +383,7 @@ func TestServer_RemoveOTPEmail(t *testing.T) { { name: "success", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.RemoveOTPEmailRequest{ UserId: userVerified.GetUserId(), }, diff --git a/internal/api/grpc/user/v2/integration_test/passkey_test.go b/internal/api/grpc/user/v2/integration_test/passkey_test.go index 4a035869f..96dc394ed 100644 --- a/internal/api/grpc/user/v2/integration_test/passkey_test.go +++ b/internal/api/grpc/user/v2/integration_test/passkey_test.go @@ -19,15 +19,15 @@ import ( ) func TestServer_RegisterPasskey(t *testing.T) { - userID := Instance.CreateHumanUser(CTX).GetUserId() - reg, err := Client.CreatePasskeyRegistrationLink(CTX, &user.CreatePasskeyRegistrationLinkRequest{ + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() + reg, err := Client.CreatePasskeyRegistrationLink(OrgCTX, &user.CreatePasskeyRegistrationLinkRequest{ UserId: userID, Medium: &user.CreatePasskeyRegistrationLinkRequest_ReturnCode{}, }) require.NoError(t, err) // We also need a user session - Instance.RegisterUserPasskey(CTX, userID) + Instance.RegisterUserPasskey(OrgCTX, userID) _, sessionToken, _, _ := Instance.CreateVerifiedWebAuthNSession(t, LoginCTX, userID) type args struct { @@ -43,7 +43,7 @@ func TestServer_RegisterPasskey(t *testing.T) { { name: "missing user id", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.RegisterPasskeyRequest{}, }, wantErr: true, @@ -51,7 +51,7 @@ func TestServer_RegisterPasskey(t *testing.T) { { name: "register code", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.RegisterPasskeyRequest{ UserId: userID, Code: reg.GetCode(), @@ -68,7 +68,7 @@ func TestServer_RegisterPasskey(t *testing.T) { { name: "reuse code (not allowed)", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.RegisterPasskeyRequest{ UserId: userID, Code: reg.GetCode(), @@ -80,7 +80,7 @@ func TestServer_RegisterPasskey(t *testing.T) { { name: "wrong code", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.RegisterPasskeyRequest{ UserId: userID, Code: &user.PasskeyRegistrationCode{ @@ -120,7 +120,7 @@ func TestServer_RegisterPasskey(t *testing.T) { { name: "user setting its own passkey", args: args{ - ctx: integration.WithAuthorizationToken(CTX, sessionToken), + ctx: integration.WithAuthorizationToken(OrgCTX, sessionToken), req: &user.RegisterPasskeyRequest{ UserId: userID, }, @@ -172,7 +172,7 @@ func TestServer_VerifyPasskeyRegistration(t *testing.T) { { name: "missing user id", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.VerifyPasskeyRegistrationRequest{ PasskeyId: pkr.GetPasskeyId(), PublicKeyCredential: attestationResponse, @@ -184,7 +184,7 @@ func TestServer_VerifyPasskeyRegistration(t *testing.T) { { name: "success", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.VerifyPasskeyRegistrationRequest{ UserId: userID, PasskeyId: pkr.GetPasskeyId(), @@ -202,7 +202,7 @@ func TestServer_VerifyPasskeyRegistration(t *testing.T) { { name: "wrong credential", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.VerifyPasskeyRegistrationRequest{ UserId: userID, PasskeyId: pkr.GetPasskeyId(), @@ -230,7 +230,7 @@ func TestServer_VerifyPasskeyRegistration(t *testing.T) { } func TestServer_CreatePasskeyRegistrationLink(t *testing.T) { - userID := Instance.CreateHumanUser(CTX).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() type args struct { ctx context.Context @@ -246,7 +246,7 @@ func TestServer_CreatePasskeyRegistrationLink(t *testing.T) { { name: "missing user id", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.CreatePasskeyRegistrationLinkRequest{}, }, wantErr: true, @@ -254,7 +254,7 @@ func TestServer_CreatePasskeyRegistrationLink(t *testing.T) { { name: "send default mail", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.CreatePasskeyRegistrationLinkRequest{ UserId: userID, }, @@ -269,7 +269,7 @@ func TestServer_CreatePasskeyRegistrationLink(t *testing.T) { { name: "send custom url", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.CreatePasskeyRegistrationLinkRequest{ UserId: userID, Medium: &user.CreatePasskeyRegistrationLinkRequest_SendLink{ @@ -289,7 +289,7 @@ func TestServer_CreatePasskeyRegistrationLink(t *testing.T) { { name: "return code", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.CreatePasskeyRegistrationLinkRequest{ UserId: userID, Medium: &user.CreatePasskeyRegistrationLinkRequest_ReturnCode{}, @@ -323,7 +323,7 @@ func TestServer_CreatePasskeyRegistrationLink(t *testing.T) { } func userWithPasskeyRegistered(t *testing.T) (string, *user.RegisterPasskeyResponse) { - userID := Instance.CreateHumanUser(CTX).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() return userID, passkeyRegister(t, userID) } @@ -333,12 +333,12 @@ func userWithPasskeyVerified(t *testing.T) (string, string) { } func passkeyRegister(t *testing.T, userID string) *user.RegisterPasskeyResponse { - reg, err := Client.CreatePasskeyRegistrationLink(CTX, &user.CreatePasskeyRegistrationLinkRequest{ + reg, err := Client.CreatePasskeyRegistrationLink(OrgCTX, &user.CreatePasskeyRegistrationLinkRequest{ UserId: userID, Medium: &user.CreatePasskeyRegistrationLinkRequest_ReturnCode{}, }) require.NoError(t, err) - pkr, err := Client.RegisterPasskey(CTX, &user.RegisterPasskeyRequest{ + pkr, err := Client.RegisterPasskey(OrgCTX, &user.RegisterPasskeyRequest{ UserId: userID, Code: reg.GetCode(), }) @@ -352,7 +352,7 @@ func passkeyVerify(t *testing.T, userID string, pkr *user.RegisterPasskeyRespons attestationResponse, err := Instance.WebAuthN.CreateAttestationResponse(pkr.GetPublicKeyCredentialCreationOptions()) require.NoError(t, err) - _, err = Client.VerifyPasskeyRegistration(CTX, &user.VerifyPasskeyRegistrationRequest{ + _, err = Client.VerifyPasskeyRegistration(OrgCTX, &user.VerifyPasskeyRegistrationRequest{ UserId: userID, PasskeyId: pkr.GetPasskeyId(), PublicKeyCredential: attestationResponse, @@ -363,7 +363,7 @@ func passkeyVerify(t *testing.T, userID string, pkr *user.RegisterPasskeyRespons } func TestServer_RemovePasskey(t *testing.T) { - userIDWithout := Instance.CreateHumanUser(CTX).GetUserId() + userIDWithout := Instance.CreateHumanUser(OrgCTX).GetUserId() userIDRegistered, pkrRegistered := userWithPasskeyRegistered(t) userIDVerified, passkeyIDVerified := userWithPasskeyVerified(t) userIDVerifiedPermission, passkeyIDVerifiedPermission := userWithPasskeyVerified(t) @@ -468,7 +468,7 @@ func TestServer_RemovePasskey(t *testing.T) { } func TestServer_ListPasskeys(t *testing.T) { - userIDWithout := Instance.CreateHumanUser(CTX).GetUserId() + userIDWithout := Instance.CreateHumanUser(OrgCTX).GetUserId() userIDRegistered, _ := userWithPasskeyRegistered(t) userIDVerified, passkeyIDVerified := userWithPasskeyVerified(t) diff --git a/internal/api/grpc/user/v2/integration_test/password_test.go b/internal/api/grpc/user/v2/integration_test/password_test.go index 258cdaf78..16043912b 100644 --- a/internal/api/grpc/user/v2/integration_test/password_test.go +++ b/internal/api/grpc/user/v2/integration_test/password_test.go @@ -17,7 +17,7 @@ import ( ) func TestServer_RequestPasswordReset(t *testing.T) { - userID := Instance.CreateHumanUser(CTX).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() tests := []struct { name string @@ -89,7 +89,7 @@ func TestServer_RequestPasswordReset(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - got, err := Client.PasswordReset(CTX, tt.req) + got, err := Client.PasswordReset(OrgCTX, tt.req) if tt.wantErr { require.Error(t, err) return @@ -122,7 +122,7 @@ func TestServer_Deprecated_SetPassword(t *testing.T) { return nil }, args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.SetPasswordRequest{}, }, wantErr: true, @@ -130,12 +130,12 @@ func TestServer_Deprecated_SetPassword(t *testing.T) { { name: "set successful", prepare: func(request *user.SetPasswordRequest) error { - userID := Instance.CreateHumanUser(CTX).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() request.UserId = userID return nil }, args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.SetPasswordRequest{ NewPassword: &user.Password{ Password: "Secr3tP4ssw0rd!", @@ -152,9 +152,9 @@ func TestServer_Deprecated_SetPassword(t *testing.T) { { name: "change successful", prepare: func(request *user.SetPasswordRequest) error { - userID := Instance.CreateHumanUser(CTX).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() request.UserId = userID - _, err := Client.SetPassword(CTX, &user.SetPasswordRequest{ + _, err := Client.SetPassword(OrgCTX, &user.SetPasswordRequest{ UserId: userID, NewPassword: &user.Password{ Password: "InitialPassw0rd!", @@ -163,7 +163,7 @@ func TestServer_Deprecated_SetPassword(t *testing.T) { return err }, args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.SetPasswordRequest{ NewPassword: &user.Password{ Password: "Secr3tP4ssw0rd!", @@ -183,9 +183,9 @@ func TestServer_Deprecated_SetPassword(t *testing.T) { { name: "set with code successful", prepare: func(request *user.SetPasswordRequest) error { - userID := Instance.CreateHumanUser(CTX).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() request.UserId = userID - resp, err := Client.PasswordReset(CTX, &user.PasswordResetRequest{ + resp, err := Client.PasswordReset(OrgCTX, &user.PasswordResetRequest{ UserId: userID, Medium: &user.PasswordResetRequest_ReturnCode{ ReturnCode: &user.ReturnPasswordResetCode{}, @@ -200,7 +200,7 @@ func TestServer_Deprecated_SetPassword(t *testing.T) { return nil }, args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.SetPasswordRequest{ NewPassword: &user.Password{ Password: "Secr3tP4ssw0rd!", diff --git a/internal/api/grpc/user/v2/integration_test/pat_test.go b/internal/api/grpc/user/v2/integration_test/pat_test.go index 6fe8c3637..4177c4d74 100644 --- a/internal/api/grpc/user/v2/integration_test/pat_test.go +++ b/internal/api/grpc/user/v2/integration_test/pat_test.go @@ -91,7 +91,7 @@ func TestServer_AddPersonalAccessToken(t *testing.T) { now := time.Now() err := tt.args.prepare(tt.args.req) require.NoError(t, err) - got, err := Client.AddPersonalAccessToken(CTX, tt.args.req) + got, err := Client.AddPersonalAccessToken(OrgCTX, tt.args.req) if tt.wantErr { require.Error(t, err) return @@ -107,7 +107,7 @@ func TestServer_AddPersonalAccessToken(t *testing.T) { } func TestServer_AddPersonalAccessToken_Permission(t *testing.T) { - OrgCTX := CTX + OrgCTX := OrgCTX otherOrg := Instance.CreateOrganization(IamCTX, integration.OrganizationName(), integration.Email()) otherOrgUser, err := Client.CreateUser(IamCTX, &user.CreateUserRequest{ OrganizationId: otherOrg.OrganizationId, @@ -189,7 +189,7 @@ func TestServer_RemovePersonalAccessToken(t *testing.T) { UserId: "notexisting", }, func(request *user.RemovePersonalAccessTokenRequest) error { - pat, err := Client.AddPersonalAccessToken(CTX, &user.AddPersonalAccessTokenRequest{ + pat, err := Client.AddPersonalAccessToken(OrgCTX, &user.AddPersonalAccessTokenRequest{ ExpirationDate: expirationDate, UserId: userId, }) @@ -217,7 +217,7 @@ func TestServer_RemovePersonalAccessToken(t *testing.T) { args: args{ &user.RemovePersonalAccessTokenRequest{}, func(request *user.RemovePersonalAccessTokenRequest) error { - pat, err := Client.AddPersonalAccessToken(CTX, &user.AddPersonalAccessTokenRequest{ + pat, err := Client.AddPersonalAccessToken(OrgCTX, &user.AddPersonalAccessTokenRequest{ ExpirationDate: expirationDate, UserId: userId, }) @@ -233,7 +233,7 @@ func TestServer_RemovePersonalAccessToken(t *testing.T) { now := time.Now() err := tt.args.prepare(tt.args.req) require.NoError(t, err) - got, err := Client.RemovePersonalAccessToken(CTX, tt.args.req) + got, err := Client.RemovePersonalAccessToken(OrgCTX, tt.args.req) if tt.wantErr { require.Error(t, err) return @@ -288,7 +288,7 @@ func TestServer_RemovePersonalAccessToken_Permission(t *testing.T) { }, { name: "org, error", - args: args{CTX, request, prepare}, + args: args{OrgCTX, request, prepare}, wantErr: true, }, { @@ -325,7 +325,7 @@ func TestServer_ListPersonalAccessTokens(t *testing.T) { args args want *user.ListPersonalAccessTokensResponse } - OrgCTX := CTX + OrgCTX := OrgCTX otherOrg := Instance.CreateOrganization(SystemCTX, integration.OrganizationName(), integration.Email()) otherOrgUser, err := Client.CreateUser(SystemCTX, &user.CreateUserRequest{ OrganizationId: otherOrg.OrganizationId, @@ -345,12 +345,12 @@ func TestServer_ListPersonalAccessTokens(t *testing.T) { myOrgId := Instance.DefaultOrg.GetId() myUserId := Instance.Users.Get(integration.UserTypeNoPermission).ID expiresInADay := time.Now().Truncate(time.Hour).Add(time.Hour * 24) - myDataPoint := setupPATDataPoint(t, myUserId, myOrgId, expiresInADay) - otherUserDataPoint := setupPATDataPoint(t, otherUserId, myOrgId, expiresInADay) - otherOrgDataPointExpiringSoon := setupPATDataPoint(t, otherOrgUserId, otherOrg.OrganizationId, time.Now().Truncate(time.Hour).Add(time.Hour)) - otherOrgDataPointExpiringLate := setupPATDataPoint(t, otherOrgUserId, otherOrg.OrganizationId, expiresInADay.Add(time.Hour*24*30)) + myDataPoint := setupPATDataPoint(SystemCTX, t, Instance, myUserId, myOrgId, expiresInADay) + otherUserDataPoint := setupPATDataPoint(SystemCTX, t, Instance, otherUserId, myOrgId, expiresInADay) + otherOrgDataPointExpiringSoon := setupPATDataPoint(SystemCTX, t, Instance, otherOrgUserId, otherOrg.OrganizationId, time.Now().Truncate(time.Hour).Add(time.Hour)) + otherOrgDataPointExpiringLate := setupPATDataPoint(SystemCTX, t, Instance, otherOrgUserId, otherOrg.OrganizationId, expiresInADay.Add(time.Hour*24*30)) sortingColumnExpirationDate := user.PersonalAccessTokenFieldName_PERSONAL_ACCESS_TOKEN_FIELD_NAME_EXPIRATION_DATE - awaitPersonalAccessTokens(t, + awaitPersonalAccessTokens(SystemCTX, t, Instance, onlySinceTestStartFilter, otherOrgDataPointExpiringSoon.GetId(), otherOrgDataPointExpiringLate.GetId(), @@ -393,7 +393,7 @@ func TestServer_ListPersonalAccessTokens(t *testing.T) { myDataPoint, }, Pagination: &filter.PaginationResponse{ - TotalResult: 2, + TotalResult: 4, AppliedLimit: 100, }, }, @@ -411,7 +411,7 @@ func TestServer_ListPersonalAccessTokens(t *testing.T) { myDataPoint, }, Pagination: &filter.PaginationResponse{ - TotalResult: 1, + TotalResult: 4, AppliedLimit: 100, }, }, @@ -532,6 +532,249 @@ func TestServer_ListPersonalAccessTokens(t *testing.T) { }, }, }, + want: &user.ListPersonalAccessTokensResponse{ + Result: []*user.PersonalAccessToken{}, + Pagination: &filter.PaginationResponse{ + TotalResult: 1, + AppliedLimit: 100, + }, + }, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + retryDuration, tick := integration.WaitForAndTickWithMaxDuration(tt.args.ctx, 20*time.Second) + require.EventuallyWithT(t, func(ttt *assert.CollectT) { + got, err := Client.ListPersonalAccessTokens(tt.args.ctx, tt.args.req) + require.NoError(ttt, err) + assert.Len(ttt, got.Result, len(tt.want.Result)) + if diff := cmp.Diff(tt.want, got, protocmp.Transform()); diff != "" { + ttt.Errorf("ListPersonalAccessTokens() mismatch (-want +got):\n%s", diff) + } + }, retryDuration, tick, "timeout waiting for expected user result") + }) + } +} + +func TestServer_ListPersonalAccessTokens_PermissionV2(t *testing.T) { + ensureFeaturePermissionV2Enabled(t, InstancePermissionV2) + iamOwnerCtx := InstancePermissionV2.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner) + + type args struct { + ctx context.Context + req *user.ListPersonalAccessTokensRequest + } + type testCase struct { + name string + args args + want *user.ListPersonalAccessTokensResponse + } + otherOrg := InstancePermissionV2.CreateOrganization(iamOwnerCtx, integration.OrganizationName(), integration.Email()) + otherOrgUser, err := InstancePermissionV2.Client.UserV2.CreateUser(iamOwnerCtx, &user.CreateUserRequest{ + OrganizationId: otherOrg.OrganizationId, + UserType: &user.CreateUserRequest_Machine_{ + Machine: &user.CreateUserRequest_Machine{ + Name: integration.Username(), + }, + }, + }) + require.NoError(t, err) + otherOrgUserId := otherOrgUser.GetId() + otherUserId := InstancePermissionV2.CreateUserTypeMachine(SystemCTX, InstancePermissionV2.DefaultOrg.Id).GetId() + onlySinceTestStartFilter := &user.PersonalAccessTokensSearchFilter{Filter: &user.PersonalAccessTokensSearchFilter_CreatedDateFilter{CreatedDateFilter: &filter.TimestampFilter{ + Timestamp: timestamppb.Now(), + Method: filter.TimestampFilterMethod_TIMESTAMP_FILTER_METHOD_AFTER_OR_EQUALS, + }}} + myOrgId := InstancePermissionV2.DefaultOrg.GetId() + myUserId := InstancePermissionV2.Users.Get(integration.UserTypeNoPermission).ID + expiresInADay := time.Now().Truncate(time.Hour).Add(time.Hour * 24) + myDataPoint := setupPATDataPoint(iamOwnerCtx, t, InstancePermissionV2, myUserId, myOrgId, expiresInADay) + otherUserDataPoint := setupPATDataPoint(iamOwnerCtx, t, InstancePermissionV2, otherUserId, myOrgId, expiresInADay) + otherOrgDataPointExpiringSoon := setupPATDataPoint(iamOwnerCtx, t, InstancePermissionV2, otherOrgUserId, otherOrg.OrganizationId, time.Now().Truncate(time.Hour).Add(time.Hour)) + otherOrgDataPointExpiringLate := setupPATDataPoint(iamOwnerCtx, t, InstancePermissionV2, otherOrgUserId, otherOrg.OrganizationId, expiresInADay.Add(time.Hour*24*30)) + sortingColumnExpirationDate := user.PersonalAccessTokenFieldName_PERSONAL_ACCESS_TOKEN_FIELD_NAME_EXPIRATION_DATE + awaitPersonalAccessTokens(iamOwnerCtx, t, InstancePermissionV2, + onlySinceTestStartFilter, + otherOrgDataPointExpiringSoon.GetId(), + otherOrgDataPointExpiringLate.GetId(), + otherUserDataPoint.GetId(), + myDataPoint.GetId(), + ) + tests := []testCase{ + { + name: "list all, instance", + args: args{ + iamOwnerCtx, + &user.ListPersonalAccessTokensRequest{ + Filters: []*user.PersonalAccessTokensSearchFilter{onlySinceTestStartFilter}, + }, + }, + want: &user.ListPersonalAccessTokensResponse{ + Result: []*user.PersonalAccessToken{ + otherOrgDataPointExpiringLate, + otherOrgDataPointExpiringSoon, + otherUserDataPoint, + myDataPoint, + }, + Pagination: &filter.PaginationResponse{ + TotalResult: 4, + AppliedLimit: 100, + }, + }, + }, + { + name: "list all, org", + args: args{ + InstancePermissionV2.WithAuthorizationToken(iamOwnerCtx, integration.UserTypeOrgOwner), + &user.ListPersonalAccessTokensRequest{ + Filters: []*user.PersonalAccessTokensSearchFilter{onlySinceTestStartFilter}, + }, + }, + want: &user.ListPersonalAccessTokensResponse{ + Result: []*user.PersonalAccessToken{ + otherUserDataPoint, + myDataPoint, + }, + Pagination: &filter.PaginationResponse{ + TotalResult: 2, + AppliedLimit: 100, + }, + }, + }, + { + name: "list all, user", + args: args{ + InstancePermissionV2.WithAuthorizationToken(iamOwnerCtx, integration.UserTypeNoPermission), + &user.ListPersonalAccessTokensRequest{ + Filters: []*user.PersonalAccessTokensSearchFilter{onlySinceTestStartFilter}, + }, + }, + want: &user.ListPersonalAccessTokensResponse{ + Result: []*user.PersonalAccessToken{ + myDataPoint, + }, + Pagination: &filter.PaginationResponse{ + TotalResult: 1, + AppliedLimit: 100, + }, + }, + }, + { + name: "list by id", + args: args{ + iamOwnerCtx, + &user.ListPersonalAccessTokensRequest{ + Filters: []*user.PersonalAccessTokensSearchFilter{ + onlySinceTestStartFilter, + { + Filter: &user.PersonalAccessTokensSearchFilter_TokenIdFilter{ + TokenIdFilter: &filter.IDFilter{Id: otherOrgDataPointExpiringSoon.Id}, + }, + }, + }, + }, + }, + want: &user.ListPersonalAccessTokensResponse{ + Result: []*user.PersonalAccessToken{ + otherOrgDataPointExpiringSoon, + }, + Pagination: &filter.PaginationResponse{ + TotalResult: 1, + AppliedLimit: 100, + }, + }, + }, + { + name: "list all from other org", + args: args{ + iamOwnerCtx, + &user.ListPersonalAccessTokensRequest{ + Filters: []*user.PersonalAccessTokensSearchFilter{ + onlySinceTestStartFilter, + { + Filter: &user.PersonalAccessTokensSearchFilter_OrganizationIdFilter{ + OrganizationIdFilter: &filter.IDFilter{Id: otherOrg.OrganizationId}, + }, + }}, + }, + }, + want: &user.ListPersonalAccessTokensResponse{ + Result: []*user.PersonalAccessToken{ + otherOrgDataPointExpiringLate, + otherOrgDataPointExpiringSoon, + }, + Pagination: &filter.PaginationResponse{ + TotalResult: 2, + AppliedLimit: 100, + }, + }, + }, + { + name: "sort by next expiration dates", + args: args{ + iamOwnerCtx, + &user.ListPersonalAccessTokensRequest{ + Pagination: &filter.PaginationRequest{ + Asc: true, + }, + SortingColumn: &sortingColumnExpirationDate, + Filters: []*user.PersonalAccessTokensSearchFilter{ + onlySinceTestStartFilter, + {Filter: &user.PersonalAccessTokensSearchFilter_OrganizationIdFilter{OrganizationIdFilter: &filter.IDFilter{Id: otherOrg.OrganizationId}}}, + }, + }, + }, + want: &user.ListPersonalAccessTokensResponse{ + Result: []*user.PersonalAccessToken{ + otherOrgDataPointExpiringSoon, + otherOrgDataPointExpiringLate, + }, + Pagination: &filter.PaginationResponse{ + TotalResult: 2, + AppliedLimit: 100, + }, + }, + }, + { + name: "get page", + args: args{ + iamOwnerCtx, + &user.ListPersonalAccessTokensRequest{ + Pagination: &filter.PaginationRequest{ + Offset: 2, + Limit: 2, + Asc: true, + }, + Filters: []*user.PersonalAccessTokensSearchFilter{ + onlySinceTestStartFilter, + }, + }, + }, + want: &user.ListPersonalAccessTokensResponse{ + Result: []*user.PersonalAccessToken{ + otherOrgDataPointExpiringSoon, + otherOrgDataPointExpiringLate, + }, + Pagination: &filter.PaginationResponse{ + TotalResult: 4, + AppliedLimit: 2, + }, + }, + }, + { + name: "empty list", + args: args{ + InstancePermissionV2.WithAuthorizationToken(iamOwnerCtx, integration.UserTypeNoPermission), + &user.ListPersonalAccessTokensRequest{ + Filters: []*user.PersonalAccessTokensSearchFilter{ + { + Filter: &user.PersonalAccessTokensSearchFilter_TokenIdFilter{ + TokenIdFilter: &filter.IDFilter{Id: otherUserDataPoint.Id}, + }, + }, + }, + }, + }, want: &user.ListPersonalAccessTokensResponse{ Result: []*user.PersonalAccessToken{}, Pagination: &filter.PaginationResponse{ @@ -541,41 +784,24 @@ func TestServer_ListPersonalAccessTokens(t *testing.T) { }, }, } - t.Run("with permission flag v2", func(t *testing.T) { - setPermissionCheckV2Flag(t, true) - defer setPermissionCheckV2Flag(t, false) - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - got, err := Client.ListPersonalAccessTokens(tt.args.ctx, tt.args.req) - require.NoError(t, err) - assert.Len(t, got.Result, len(tt.want.Result)) + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + retryDuration, tick := integration.WaitForAndTickWithMaxDuration(tt.args.ctx, 20*time.Second) + require.EventuallyWithT(t, func(ttt *assert.CollectT) { + got, err := InstancePermissionV2.Client.UserV2.ListPersonalAccessTokens(tt.args.ctx, tt.args.req) + require.NoError(ttt, err) + assert.Len(ttt, got.Result, len(tt.want.Result)) if diff := cmp.Diff(tt.want, got, protocmp.Transform()); diff != "" { - t.Errorf("ListPersonalAccessTokens() mismatch (-want +got):\n%s", diff) + ttt.Errorf("ListPersonalAccessTokens() mismatch (-want +got):\n%s", diff) } - }) - } - }) - t.Run("without permission flag v2", func(t *testing.T) { - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - got, err := Client.ListPersonalAccessTokens(tt.args.ctx, tt.args.req) - require.NoError(t, err) - assert.Len(t, got.Result, len(tt.want.Result)) - // ignore the total result, as this is a known bug with the in-memory permission checks. - // The command can't know how many keys exist in the system if the SQL statement has a limit. - // This is fixed, once the in-memory permission checks are removed with https://github.com/zitadel/zitadel/issues/9188 - tt.want.Pagination.TotalResult = got.Pagination.TotalResult - if diff := cmp.Diff(tt.want, got, protocmp.Transform()); diff != "" { - t.Errorf("ListPersonalAccessTokens() mismatch (-want +got):\n%s", diff) - } - }) - } - }) + }, retryDuration, tick, "timeout waiting for expected user result") + }) + } } -func setupPATDataPoint(t *testing.T, userId, orgId string, expirationDate time.Time) *user.PersonalAccessToken { +func setupPATDataPoint(ctx context.Context, t *testing.T, instance *integration.Instance, userId, orgId string, expirationDate time.Time) *user.PersonalAccessToken { expirationDatePb := timestamppb.New(expirationDate) - newPersonalAccessToken, err := Client.AddPersonalAccessToken(SystemCTX, &user.AddPersonalAccessTokenRequest{ + newPersonalAccessToken, err := instance.Client.UserV2.AddPersonalAccessToken(ctx, &user.AddPersonalAccessTokenRequest{ UserId: userId, ExpirationDate: expirationDatePb, }) @@ -590,18 +816,19 @@ func setupPATDataPoint(t *testing.T, userId, orgId string, expirationDate time.T } } -func awaitPersonalAccessTokens(t *testing.T, sinceTestStartFilter *user.PersonalAccessTokensSearchFilter, patIds ...string) { +func awaitPersonalAccessTokens(ctx context.Context, t *testing.T, instance *integration.Instance, sinceTestStartFilter *user.PersonalAccessTokensSearchFilter, patIds ...string) { sortingColumn := user.PersonalAccessTokenFieldName_PERSONAL_ACCESS_TOKEN_FIELD_NAME_ID slices.Sort(patIds) + retryDuration, tick := integration.WaitForAndTickWithMaxDuration(ctx, time.Minute) require.EventuallyWithT(t, func(collect *assert.CollectT) { - result, err := Client.ListPersonalAccessTokens(SystemCTX, &user.ListPersonalAccessTokensRequest{ + result, err := instance.Client.UserV2.ListPersonalAccessTokens(ctx, &user.ListPersonalAccessTokensRequest{ Filters: []*user.PersonalAccessTokensSearchFilter{sinceTestStartFilter}, SortingColumn: &sortingColumn, Pagination: &filter.PaginationRequest{ Asc: true, }, }) - require.NoError(t, err) + require.NoError(collect, err) if !assert.Len(collect, result.Result, len(patIds)) { return } @@ -609,5 +836,5 @@ func awaitPersonalAccessTokens(t *testing.T, sinceTestStartFilter *user.Personal patId := patIds[i] require.Equal(collect, patId, result.Result[i].GetId()) } - }, 5*time.Second, time.Second, "pat not created in time") + }, retryDuration, tick, "pat not created in time") } diff --git a/internal/api/grpc/user/v2/integration_test/phone_test.go b/internal/api/grpc/user/v2/integration_test/phone_test.go index 94d162934..90bdf10a8 100644 --- a/internal/api/grpc/user/v2/integration_test/phone_test.go +++ b/internal/api/grpc/user/v2/integration_test/phone_test.go @@ -17,7 +17,7 @@ import ( ) func TestServer_Deprecated_SetPhone(t *testing.T) { - userID := Instance.CreateHumanUser(CTX).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() tests := []struct { name string @@ -105,7 +105,7 @@ func TestServer_Deprecated_SetPhone(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - got, err := Client.SetPhone(CTX, tt.req) + got, err := Client.SetPhone(OrgCTX, tt.req) if tt.wantErr { require.Error(t, err) return @@ -121,8 +121,8 @@ func TestServer_Deprecated_SetPhone(t *testing.T) { } func TestServer_ResendPhoneCode(t *testing.T) { - userID := Instance.CreateHumanUser(CTX).GetUserId() - verifiedUserID := Instance.CreateHumanUserVerified(CTX, Instance.DefaultOrg.Id, integration.Email(), integration.Phone()).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() + verifiedUserID := Instance.CreateHumanUserVerified(OrgCTX, Instance.DefaultOrg.Id, integration.Email(), integration.Phone()).GetUserId() tests := []struct { name string @@ -180,7 +180,7 @@ func TestServer_ResendPhoneCode(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - got, err := Client.ResendPhoneCode(CTX, tt.req) + got, err := Client.ResendPhoneCode(OrgCTX, tt.req) if tt.wantErr { require.Error(t, err) return @@ -196,7 +196,7 @@ func TestServer_ResendPhoneCode(t *testing.T) { } func TestServer_VerifyPhone(t *testing.T) { - userResp := Instance.CreateHumanUser(CTX) + userResp := Instance.CreateHumanUser(OrgCTX) tests := []struct { name string req *user.VerifyPhoneRequest @@ -236,7 +236,7 @@ func TestServer_VerifyPhone(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - got, err := Client.VerifyPhone(CTX, tt.req) + got, err := Client.VerifyPhone(OrgCTX, tt.req) if tt.wantErr { require.Error(t, err) return @@ -249,12 +249,12 @@ func TestServer_VerifyPhone(t *testing.T) { } func TestServer_Deprecated_RemovePhone(t *testing.T) { - userResp := Instance.CreateHumanUser(CTX) - failResp := Instance.CreateHumanUserNoPhone(CTX) - otherUser := Instance.CreateHumanUser(CTX).GetUserId() - doubleRemoveUser := Instance.CreateHumanUser(CTX) + userResp := Instance.CreateHumanUser(OrgCTX) + failResp := Instance.CreateHumanUserNoPhone(OrgCTX) + otherUser := Instance.CreateHumanUser(OrgCTX).GetUserId() + doubleRemoveUser := Instance.CreateHumanUser(OrgCTX) - Instance.RegisterUserPasskey(CTX, otherUser) + Instance.RegisterUserPasskey(OrgCTX, otherUser) _, sessionTokenOtherUser, _, _ := Instance.CreateVerifiedWebAuthNSession(t, LoginCTX, otherUser) tests := []struct { @@ -267,7 +267,7 @@ func TestServer_Deprecated_RemovePhone(t *testing.T) { }{ { name: "remove phone", - ctx: CTX, + ctx: OrgCTX, req: &user.RemovePhoneRequest{ UserId: userResp.GetUserId(), }, @@ -284,7 +284,7 @@ func TestServer_Deprecated_RemovePhone(t *testing.T) { }, { name: "user without phone", - ctx: CTX, + ctx: OrgCTX, req: &user.RemovePhoneRequest{ UserId: failResp.GetUserId(), }, @@ -295,7 +295,7 @@ func TestServer_Deprecated_RemovePhone(t *testing.T) { }, { name: "remove previously deleted phone", - ctx: CTX, + ctx: OrgCTX, req: &user.RemovePhoneRequest{ UserId: doubleRemoveUser.GetUserId(), }, @@ -308,7 +308,7 @@ func TestServer_Deprecated_RemovePhone(t *testing.T) { }, { name: "no user id", - ctx: CTX, + ctx: OrgCTX, req: &user.RemovePhoneRequest{}, wantErr: true, dep: func(ctx context.Context, userID string) (*user.RemovePhoneResponse, error) { @@ -317,7 +317,7 @@ func TestServer_Deprecated_RemovePhone(t *testing.T) { }, { name: "other user, no permission", - ctx: integration.WithAuthorizationToken(CTX, sessionTokenOtherUser), + ctx: integration.WithAuthorizationToken(OrgCTX, sessionTokenOtherUser), req: &user.RemovePhoneRequest{ UserId: userResp.GetUserId(), }, diff --git a/internal/api/grpc/user/v2/integration_test/query_test.go b/internal/api/grpc/user/v2/integration_test/query_test.go index e0958f4f1..077fb3453 100644 --- a/internal/api/grpc/user/v2/integration_test/query_test.go +++ b/internal/api/grpc/user/v2/integration_test/query_test.go @@ -5,7 +5,6 @@ package user_test import ( "context" "encoding/base64" - "errors" "fmt" "slices" "testing" @@ -17,7 +16,6 @@ import ( "google.golang.org/protobuf/types/known/timestamppb" "github.com/zitadel/zitadel/internal/integration" - "github.com/zitadel/zitadel/pkg/grpc/feature/v2" "github.com/zitadel/zitadel/pkg/grpc/filter/v2" v2 "github.com/zitadel/zitadel/pkg/grpc/metadata/v2" "github.com/zitadel/zitadel/pkg/grpc/object/v2" @@ -25,55 +23,6 @@ import ( "github.com/zitadel/zitadel/pkg/grpc/user/v2" ) -var ( - permissionCheckV2SetFlagInital bool - permissionCheckV2SetFlag bool -) - -type permissionCheckV2SettingsStruct struct { - TestNamePrependString string - SetFlag bool -} - -var permissionCheckV2Settings []permissionCheckV2SettingsStruct = []permissionCheckV2SettingsStruct{ - { - SetFlag: false, - TestNamePrependString: "permission_check_v2 IS NOT SET" + " ", - }, - { - SetFlag: true, - TestNamePrependString: "permission_check_v2 IS SET" + " ", - }, -} - -func setPermissionCheckV2Flag(t *testing.T, setFlag bool) { - if permissionCheckV2SetFlagInital && permissionCheckV2SetFlag == setFlag { - return - } - - _, err := Instance.Client.FeatureV2.SetInstanceFeatures(IamCTX, &feature.SetInstanceFeaturesRequest{ - PermissionCheckV2: &setFlag, - }) - require.NoError(t, err) - - var flagSet bool - for i := 0; !flagSet || i < 6; i++ { - res, err := Instance.Client.FeatureV2.GetInstanceFeatures(IamCTX, &feature.GetInstanceFeaturesRequest{}) - require.NoError(t, err) - if res.PermissionCheckV2.Enabled == setFlag { - flagSet = true - continue - } - time.Sleep(10 * time.Second) - } - - if !flagSet { - require.NoError(t, errors.New("unable to set permission_check_v2 flag")) - } - permissionCheckV2SetFlagInital = true - permissionCheckV2SetFlag = setFlag -} - func TestServer_GetUserByID(t *testing.T) { orgResp := Instance.CreateOrganization(IamCTX, integration.OrganizationName(), integration.Email()) type args struct { @@ -119,7 +68,7 @@ func TestServer_GetUserByID(t *testing.T) { IamCTX, &user.GetUserByIDRequest{}, func(ctx context.Context, request *user.GetUserByIDRequest) *userAttr { - info := createUser(ctx, orgResp.OrganizationId, false) + info := createUser(ctx, Instance, orgResp.OrganizationId, false) request.UserId = info.UserID return &info }, @@ -163,7 +112,7 @@ func TestServer_GetUserByID(t *testing.T) { IamCTX, &user.GetUserByIDRequest{}, func(ctx context.Context, request *user.GetUserByIDRequest) *userAttr { - info := createUser(ctx, orgResp.OrganizationId, true) + info := createUser(ctx, Instance, orgResp.OrganizationId, true) request.UserId = info.UserID return &info }, @@ -333,7 +282,7 @@ func TestServer_GetUserByID_Permission(t *testing.T) { { name: "Org, error", args: args{ - CTX, + OrgCTX, &user.GetUserByIDRequest{ UserId: newUserID, }, @@ -406,40 +355,35 @@ type userAttr struct { Details *object.Details } -func createUsers(ctx context.Context, orgID string, count int, passwordChangeRequired bool) userAttrs { +func createUsers(ctx context.Context, instance *integration.Instance, orgID string, count int, passwordChangeRequired bool) userAttrs { infos := make([]userAttr, count) for i := 0; i < count; i++ { - infos[i] = createUser(ctx, orgID, passwordChangeRequired) + infos[i] = createUser(ctx, instance, orgID, passwordChangeRequired) } slices.Reverse(infos) return infos } -func createUser(ctx context.Context, orgID string, passwordChangeRequired bool) userAttr { +func createUser(ctx context.Context, instance *integration.Instance, orgID string, passwordChangeRequired bool) userAttr { username := integration.Email() - return createUserWithUserName(ctx, username, orgID, passwordChangeRequired) + return createUserWithUserName(ctx, instance, username, orgID, passwordChangeRequired) } -func createUserWithUserName(ctx context.Context, username string, orgID string, passwordChangeRequired bool) userAttr { +func createUserWithUserName(ctx context.Context, instance *integration.Instance, username string, orgID string, passwordChangeRequired bool) userAttr { // used as default country prefix phone := integration.Phone() - resp := Instance.CreateHumanUserVerified(ctx, orgID, username, phone) + resp := instance.CreateHumanUserVerified(ctx, orgID, username, phone) info := userAttr{resp.GetUserId(), username, phone, nil, resp.GetDetails()} // as the change date of the creation is the creation date resp.Details.CreationDate = resp.GetDetails().GetChangeDate() if passwordChangeRequired { - details := Instance.SetUserPassword(ctx, resp.GetUserId(), integration.UserPassword, true) + details := instance.SetUserPassword(ctx, resp.GetUserId(), integration.UserPassword, true) info.Changed = details.GetChangeDate() } return info } func TestServer_ListUsers(t *testing.T) { - t.Cleanup(func() { - _, err := Instance.Client.FeatureV2.ResetInstanceFeatures(IamCTX, &feature.ResetInstanceFeaturesRequest{}) - require.NoError(t, err) - }) - orgResp := Instance.CreateOrganization(IamCTX, integration.OrganizationName(), integration.Email()) type args struct { ctx context.Context @@ -458,7 +402,7 @@ func TestServer_ListUsers(t *testing.T) { UserCTX, &user.ListUsersRequest{}, func(ctx context.Context, request *user.ListUsersRequest) userAttrs { - info := createUser(ctx, orgResp.OrganizationId, false) + info := createUser(ctx, Instance, orgResp.OrganizationId, false) request.Queries = append(request.Queries, InUserIDsQuery([]string{info.UserID})) return []userAttr{} }, @@ -475,7 +419,7 @@ func TestServer_ListUsers(t *testing.T) { { name: "list user by id, no permission human user", args: func() args { - info := createUser(IamCTX, orgResp.OrganizationId, true) + info := createUser(IamCTX, Instance, orgResp.OrganizationId, true) // create session to get token userID := info.UserID createResp, err := Instance.Client.SessionV2.CreateSession(IamCTX, &session.CreateSessionRequest{ @@ -540,7 +484,7 @@ func TestServer_ListUsers(t *testing.T) { IamCTX, &user.ListUsersRequest{}, func(ctx context.Context, request *user.ListUsersRequest) userAttrs { - info := createUser(ctx, orgResp.OrganizationId, false) + info := createUser(ctx, Instance, orgResp.OrganizationId, false) request.Queries = []*user.SearchQuery{} request.Queries = append(request.Queries, OrganizationIdQuery(orgResp.OrganizationId)) request.Queries = append(request.Queries, InUserIDsQuery([]string{info.UserID})) @@ -584,7 +528,7 @@ func TestServer_ListUsers(t *testing.T) { IamCTX, &user.ListUsersRequest{}, func(ctx context.Context, request *user.ListUsersRequest) userAttrs { - info := createUser(ctx, orgResp.OrganizationId, true) + info := createUser(ctx, Instance, orgResp.OrganizationId, true) request.Queries = []*user.SearchQuery{} request.Queries = append(request.Queries, OrganizationIdQuery(orgResp.OrganizationId)) request.Queries = append(request.Queries, InUserIDsQuery([]string{info.UserID})) @@ -630,7 +574,7 @@ func TestServer_ListUsers(t *testing.T) { IamCTX, &user.ListUsersRequest{}, func(ctx context.Context, request *user.ListUsersRequest) userAttrs { - infos := createUsers(ctx, orgResp.OrganizationId, 3, false) + infos := createUsers(ctx, Instance, orgResp.OrganizationId, 3, false) request.Queries = []*user.SearchQuery{} request.Queries = append(request.Queries, OrganizationIdQuery(orgResp.OrganizationId)) request.Queries = append(request.Queries, InUserIDsQuery(infos.userIDs())) @@ -724,7 +668,7 @@ func TestServer_ListUsers(t *testing.T) { IamCTX, &user.ListUsersRequest{}, func(ctx context.Context, request *user.ListUsersRequest) userAttrs { - infos := createUsers(ctx, orgResp.OrganizationId, 3, false) + infos := createUsers(ctx, Instance, orgResp.OrganizationId, 3, false) request.Queries = []*user.SearchQuery{} request.Queries = append(request.Queries, OrganizationIdQuery(orgResp.OrganizationId)) request.Queries = append(request.Queries, InUserIDsQuery(infos.userIDs())) @@ -803,7 +747,7 @@ func TestServer_ListUsers(t *testing.T) { IamCTX, &user.ListUsersRequest{}, func(ctx context.Context, request *user.ListUsersRequest) userAttrs { - info := createUser(ctx, orgResp.OrganizationId, false) + info := createUser(ctx, Instance, orgResp.OrganizationId, false) request.Queries = []*user.SearchQuery{} request.Queries = append(request.Queries, OrganizationIdQuery(orgResp.OrganizationId)) request.Queries = append(request.Queries, UsernameQuery(info.Username)) @@ -849,7 +793,7 @@ func TestServer_ListUsers(t *testing.T) { IamCTX, &user.ListUsersRequest{}, func(ctx context.Context, request *user.ListUsersRequest) userAttrs { - info := createUser(ctx, orgResp.OrganizationId, false) + info := createUser(ctx, Instance, orgResp.OrganizationId, false) request.Queries = []*user.SearchQuery{} request.Queries = append(request.Queries, OrganizationIdQuery(orgResp.OrganizationId)) request.Queries = append(request.Queries, InUserEmailsQuery([]string{info.Username})) @@ -894,7 +838,7 @@ func TestServer_ListUsers(t *testing.T) { IamCTX, &user.ListUsersRequest{}, func(ctx context.Context, request *user.ListUsersRequest) userAttrs { - infos := createUsers(ctx, orgResp.OrganizationId, 3, false) + infos := createUsers(ctx, Instance, orgResp.OrganizationId, 3, false) request.Queries = []*user.SearchQuery{} request.Queries = append(request.Queries, OrganizationIdQuery(orgResp.OrganizationId)) request.Queries = append(request.Queries, InUserEmailsQuery(infos.emails())) @@ -988,7 +932,7 @@ func TestServer_ListUsers(t *testing.T) { IamCTX, &user.ListUsersRequest{}, func(ctx context.Context, request *user.ListUsersRequest) userAttrs { - infos := createUsers(ctx, orgResp.OrganizationId, 3, false) + infos := createUsers(ctx, Instance, orgResp.OrganizationId, 3, false) request.Queries = []*user.SearchQuery{} request.Queries = append(request.Queries, OrganizationIdQuery(orgResp.OrganizationId)) request.Queries = append(request.Queries, InUserEmailsQuery(infos.emails())) @@ -1089,7 +1033,7 @@ func TestServer_ListUsers(t *testing.T) { IamCTX, &user.ListUsersRequest{}, func(ctx context.Context, request *user.ListUsersRequest) userAttrs { - info := createUser(ctx, orgResp.OrganizationId, false) + info := createUser(ctx, Instance, orgResp.OrganizationId, false) request.Queries = []*user.SearchQuery{} request.Queries = append(request.Queries, OrganizationIdQuery(orgResp.OrganizationId)) request.Queries = append(request.Queries, PhoneQuery(info.Phone)) @@ -1158,7 +1102,7 @@ func TestServer_ListUsers(t *testing.T) { func(ctx context.Context, request *user.ListUsersRequest) userAttrs { orgResp := Instance.CreateOrganization(ctx, integration.OrganizationName(), integration.Email()) - infos := createUsers(ctx, orgResp.OrganizationId, 3, false) + infos := createUsers(ctx, Instance, orgResp.OrganizationId, 3, false) request.Queries = []*user.SearchQuery{} request.Queries = append(request.Queries, OrganizationIdQuery(orgResp.OrganizationId)) request.Queries = append(request.Queries, InUserEmailsQuery(infos.emails())) @@ -1244,7 +1188,7 @@ func TestServer_ListUsers(t *testing.T) { &user.ListUsersRequest{}, func(ctx context.Context, request *user.ListUsersRequest) userAttrs { orgRespForOrgTests := Instance.CreateOrganization(IamCTX, integration.OrganizationName(), integration.Email()) - info := createUser(ctx, orgRespForOrgTests.OrganizationId, false) + info := createUser(ctx, Instance, orgRespForOrgTests.OrganizationId, false) request.Queries = []*user.SearchQuery{} request.Queries = append(request.Queries, OrganizationIdQuery(orgRespForOrgTests.OrganizationId)) request.SortingColumn = user.UserFieldName_USER_FIELD_NAME_CREATION_DATE @@ -1292,7 +1236,7 @@ func TestServer_ListUsers(t *testing.T) { func(ctx context.Context, request *user.ListUsersRequest) userAttrs { orgRespForOrgTests := Instance.CreateOrganization(IamCTX, integration.OrganizationName(), integration.Email()) orgRespForOrgTests2 := Instance.CreateOrganization(IamCTX, integration.OrganizationName(), integration.Email()) - createUser(ctx, orgRespForOrgTests.OrganizationId, false) + createUser(ctx, Instance, orgRespForOrgTests.OrganizationId, false) request.Queries = []*user.SearchQuery{} request.Queries = append(request.Queries, OrganizationIdQuery(orgRespForOrgTests2.OrganizationId)) return []userAttr{{}} @@ -1316,7 +1260,7 @@ func TestServer_ListUsers(t *testing.T) { IamCTX, &user.ListUsersRequest{}, func(ctx context.Context, request *user.ListUsersRequest) userAttrs { - createUser(ctx, orgResp.OrganizationId, false) + createUser(ctx, Instance, orgResp.OrganizationId, false) request.Queries = []*user.SearchQuery{} request.Queries = append(request.Queries, OrganizationIdQuery(orgResp.OrganizationId)) request.Queries = append(request.Queries, MetadataKeyContainsQuery("some non-existent meta")) @@ -1335,70 +1279,852 @@ func TestServer_ListUsers(t *testing.T) { }, }, } - for _, f := range permissionCheckV2Settings { - for _, tc := range tt { - t.Run(f.TestNamePrependString+tc.name, func(t1 *testing.T) { - setPermissionCheckV2Flag(t, f.SetFlag) - infos := tc.args.dep(IamCTX, tc.args.req) + for _, tc := range tt { + t.Run(tc.name, func(t1 *testing.T) { + infos := tc.args.dep(IamCTX, tc.args.req) - retryDuration, tick := integration.WaitForAndTickWithMaxDuration(tc.args.ctx, time.Minute) - require.EventuallyWithT(t1, func(ttt *assert.CollectT) { - got, err := Client.ListUsers(tc.args.ctx, tc.args.req) - if tc.wantErr { - require.Error(ttt, err) - return - } - require.NoError(ttt, err) + retryDuration, tick := integration.WaitForAndTickWithMaxDuration(tc.args.ctx, time.Minute) + require.EventuallyWithT(t1, func(ttt *assert.CollectT) { + got, err := Client.ListUsers(tc.args.ctx, tc.args.req) + if tc.wantErr { + require.Error(ttt, err) + return + } + require.NoError(ttt, err) - // always only give back dependency infos which are required for the response - require.Len(ttt, tc.want.Result, len(infos)) - if assert.Len(ttt, got.Result, len(tc.want.Result)) { - tc.want.Details.TotalResult = got.Details.TotalResult + // always only give back dependency infos which are required for the response + require.Len(ttt, tc.want.Result, len(infos)) + if assert.Len(ttt, got.Result, len(tc.want.Result)) { + tc.want.Details.TotalResult = got.Details.TotalResult - // fill in userid and username as it is generated - for i := range infos { - if tc.want.Result[i] == nil { - continue - } - tc.want.Result[i].UserId = infos[i].UserID - tc.want.Result[i].Username = infos[i].Username - tc.want.Result[i].PreferredLoginName = infos[i].Username - tc.want.Result[i].LoginNames = []string{infos[i].Username} - if human := tc.want.Result[i].GetHuman(); human != nil { - human.Email.Email = infos[i].Username - human.Phone.Phone = infos[i].Phone - if tc.want.Result[i].GetHuman().GetPasswordChanged() != nil { - human.PasswordChanged = infos[i].Changed - } - } - tc.want.Result[i].Details = infos[i].Details + // fill in userid and username as it is generated + for i := range infos { + if tc.want.Result[i] == nil { + continue } - for i := range tc.want.Result { - if tc.want.Result[i] == nil { - continue + tc.want.Result[i].UserId = infos[i].UserID + tc.want.Result[i].Username = infos[i].Username + tc.want.Result[i].PreferredLoginName = infos[i].Username + tc.want.Result[i].LoginNames = []string{infos[i].Username} + if human := tc.want.Result[i].GetHuman(); human != nil { + human.Email.Email = infos[i].Username + human.Phone.Phone = infos[i].Phone + if tc.want.Result[i].GetHuman().GetPasswordChanged() != nil { + human.PasswordChanged = infos[i].Changed } - assert.EqualExportedValues(ttt, got.Result[i], tc.want.Result[i]) } + tc.want.Result[i].Details = infos[i].Details } - integration.AssertListDetails(ttt, tc.want, got) - }, retryDuration, tick, "timeout waiting for expected user result") - }) - } + for i := range tc.want.Result { + if tc.want.Result[i] == nil { + continue + } + assert.EqualExportedValues(ttt, got.Result[i], tc.want.Result[i]) + } + } + integration.AssertListDetails(ttt, tc.want, got) + }, retryDuration, tick, "timeout waiting for expected user result") + }) + } +} + +func TestServer_ListUsers_PermissionsV2(t *testing.T) { + ensureFeaturePermissionV2Enabled(t, InstancePermissionV2) + iamOwnerCtx := InstancePermissionV2.WithAuthorizationToken(OrgCTX, integration.UserTypeIAMOwner) + + orgResp := InstancePermissionV2.CreateOrganization(iamOwnerCtx, integration.OrganizationName(), integration.Email()) + type args struct { + ctx context.Context + req *user.ListUsersRequest + dep func(ctx context.Context, request *user.ListUsersRequest) userAttrs + } + tt := []struct { + name string + args args + want *user.ListUsersResponse + wantErr bool + }{ + { + name: "list user by id, no permission machine user", + args: args{ + InstancePermissionV2.WithAuthorizationToken(OrgCTX, integration.UserTypeNoPermission), + &user.ListUsersRequest{}, + func(ctx context.Context, request *user.ListUsersRequest) userAttrs { + info := createUser(ctx, InstancePermissionV2, orgResp.OrganizationId, false) + request.Queries = append(request.Queries, InUserIDsQuery([]string{info.UserID})) + return []userAttr{} + }, + }, + want: &user.ListUsersResponse{ + Details: &object.ListDetails{ + TotalResult: 0, + Timestamp: timestamppb.Now(), + }, + SortingColumn: 0, + Result: []*user.User{}, + }, + }, + { + name: "list user by id, no permission human user", + args: func() args { + info := createUser(iamOwnerCtx, InstancePermissionV2, orgResp.OrganizationId, true) + // create session to get token + userID := info.UserID + createResp, err := InstancePermissionV2.Client.SessionV2.CreateSession(iamOwnerCtx, &session.CreateSessionRequest{ + Checks: &session.Checks{ + User: &session.CheckUser{ + Search: &session.CheckUser_UserId{UserId: userID}, + }, + Password: &session.CheckPassword{ + Password: integration.UserPassword, + }, + }, + }) + if err != nil { + require.NoError(t, err) + } + // use token to get ctx + HumanCTX := integration.WithAuthorizationToken(iamOwnerCtx, createResp.GetSessionToken()) + return args{ + HumanCTX, + &user.ListUsersRequest{}, + func(ctx context.Context, request *user.ListUsersRequest) userAttrs { + return []userAttr{info} + }, + } + }(), + want: &user.ListUsersResponse{ // human user should return itself when calling ListUsers() even if it has no permissions + Details: &object.ListDetails{ + TotalResult: 1, + Timestamp: timestamppb.Now(), + }, + SortingColumn: 0, + Result: []*user.User{ + { + State: user.UserState_USER_STATE_ACTIVE, + Type: &user.User_Human{ + Human: &user.HumanUser{ + Profile: &user.HumanProfile{ + GivenName: "Mickey", + FamilyName: "Mouse", + NickName: gu.Ptr("Mickey"), + DisplayName: gu.Ptr("Mickey Mouse"), + PreferredLanguage: gu.Ptr("nl"), + Gender: user.Gender_GENDER_MALE.Enum(), + }, + Email: &user.HumanEmail{ + IsVerified: true, + }, + Phone: &user.HumanPhone{ + IsVerified: true, + }, + PasswordChangeRequired: true, + PasswordChanged: timestamppb.Now(), + }, + }, + }, + }, + }, + }, + { + name: "list user by id, ok", + args: args{ + iamOwnerCtx, + &user.ListUsersRequest{}, + func(ctx context.Context, request *user.ListUsersRequest) userAttrs { + info := createUser(ctx, InstancePermissionV2, orgResp.OrganizationId, false) + request.Queries = []*user.SearchQuery{} + request.Queries = append(request.Queries, OrganizationIdQuery(orgResp.OrganizationId)) + request.Queries = append(request.Queries, InUserIDsQuery([]string{info.UserID})) + return []userAttr{info} + }, + }, + want: &user.ListUsersResponse{ + Details: &object.ListDetails{ + TotalResult: 1, + Timestamp: timestamppb.Now(), + }, + SortingColumn: 0, + Result: []*user.User{ + { + State: user.UserState_USER_STATE_ACTIVE, + Type: &user.User_Human{ + Human: &user.HumanUser{ + Profile: &user.HumanProfile{ + GivenName: "Mickey", + FamilyName: "Mouse", + NickName: gu.Ptr("Mickey"), + DisplayName: gu.Ptr("Mickey Mouse"), + PreferredLanguage: gu.Ptr("nl"), + Gender: user.Gender_GENDER_MALE.Enum(), + }, + Email: &user.HumanEmail{ + IsVerified: true, + }, + Phone: &user.HumanPhone{ + IsVerified: true, + }, + }, + }, + }, + }, + }, + }, + { + name: "list user by id, passwordChangeRequired, ok", + args: args{ + iamOwnerCtx, + &user.ListUsersRequest{}, + func(ctx context.Context, request *user.ListUsersRequest) userAttrs { + info := createUser(ctx, InstancePermissionV2, orgResp.OrganizationId, true) + request.Queries = []*user.SearchQuery{} + request.Queries = append(request.Queries, OrganizationIdQuery(orgResp.OrganizationId)) + request.Queries = append(request.Queries, InUserIDsQuery([]string{info.UserID})) + return []userAttr{info} + }, + }, + want: &user.ListUsersResponse{ + Details: &object.ListDetails{ + TotalResult: 1, + Timestamp: timestamppb.Now(), + }, + SortingColumn: 0, + Result: []*user.User{ + { + State: user.UserState_USER_STATE_ACTIVE, + Type: &user.User_Human{ + Human: &user.HumanUser{ + Profile: &user.HumanProfile{ + GivenName: "Mickey", + FamilyName: "Mouse", + NickName: gu.Ptr("Mickey"), + DisplayName: gu.Ptr("Mickey Mouse"), + PreferredLanguage: gu.Ptr("nl"), + Gender: user.Gender_GENDER_MALE.Enum(), + }, + Email: &user.HumanEmail{ + IsVerified: true, + }, + Phone: &user.HumanPhone{ + IsVerified: true, + }, + PasswordChangeRequired: true, + PasswordChanged: timestamppb.Now(), + }, + }, + }, + }, + }, + }, + { + name: "list user by id and meta key multiple, ok", + args: args{ + iamOwnerCtx, + &user.ListUsersRequest{}, + func(ctx context.Context, request *user.ListUsersRequest) userAttrs { + infos := createUsers(ctx, InstancePermissionV2, orgResp.OrganizationId, 3, false) + request.Queries = []*user.SearchQuery{} + request.Queries = append(request.Queries, OrganizationIdQuery(orgResp.OrganizationId)) + request.Queries = append(request.Queries, InUserIDsQuery(infos.userIDs())) + + InstancePermissionV2.SetUserMetadata(ctx, infos[0].UserID, "my meta", "my value 1") + InstancePermissionV2.SetUserMetadata(ctx, infos[1].UserID, "my meta 2", "my value 3") + InstancePermissionV2.SetUserMetadata(ctx, infos[2].UserID, "my meta", "my value 2") + + request.Queries = append(request.Queries, MetadataKeyContainsQuery("my meta")) + request.SortingColumn = user.UserFieldName_USER_FIELD_NAME_CREATION_DATE + return infos + }, + }, + want: &user.ListUsersResponse{ + Details: &object.ListDetails{ + TotalResult: 3, + Timestamp: timestamppb.Now(), + }, + SortingColumn: user.UserFieldName_USER_FIELD_NAME_CREATION_DATE, + Result: []*user.User{ + { + State: user.UserState_USER_STATE_ACTIVE, + Type: &user.User_Human{ + Human: &user.HumanUser{ + Profile: &user.HumanProfile{ + GivenName: "Mickey", + FamilyName: "Mouse", + NickName: gu.Ptr("Mickey"), + DisplayName: gu.Ptr("Mickey Mouse"), + PreferredLanguage: gu.Ptr("nl"), + Gender: user.Gender_GENDER_MALE.Enum(), + }, + Email: &user.HumanEmail{ + IsVerified: true, + }, + Phone: &user.HumanPhone{ + IsVerified: true, + }, + }, + }, + }, + { + State: user.UserState_USER_STATE_ACTIVE, + Type: &user.User_Human{ + Human: &user.HumanUser{ + Profile: &user.HumanProfile{ + GivenName: "Mickey", + FamilyName: "Mouse", + NickName: gu.Ptr("Mickey"), + DisplayName: gu.Ptr("Mickey Mouse"), + PreferredLanguage: gu.Ptr("nl"), + Gender: user.Gender_GENDER_MALE.Enum(), + }, + Email: &user.HumanEmail{ + IsVerified: true, + }, + Phone: &user.HumanPhone{ + IsVerified: true, + }, + }, + }, + }, + { + State: user.UserState_USER_STATE_ACTIVE, + Type: &user.User_Human{ + Human: &user.HumanUser{ + Profile: &user.HumanProfile{ + GivenName: "Mickey", + FamilyName: "Mouse", + NickName: gu.Ptr("Mickey"), + DisplayName: gu.Ptr("Mickey Mouse"), + PreferredLanguage: gu.Ptr("nl"), + Gender: user.Gender_GENDER_MALE.Enum(), + }, + Email: &user.HumanEmail{ + IsVerified: true, + }, + Phone: &user.HumanPhone{ + IsVerified: true, + }, + }, + }, + }, + }, + }, + }, + { + name: "list user by username, ok", + args: args{ + iamOwnerCtx, + &user.ListUsersRequest{}, + func(ctx context.Context, request *user.ListUsersRequest) userAttrs { + info := createUser(ctx, InstancePermissionV2, orgResp.OrganizationId, false) + request.Queries = []*user.SearchQuery{} + request.Queries = append(request.Queries, OrganizationIdQuery(orgResp.OrganizationId)) + request.Queries = append(request.Queries, UsernameQuery(info.Username)) + + request.SortingColumn = user.UserFieldName_USER_FIELD_NAME_CREATION_DATE + return []userAttr{info} + }, + }, + want: &user.ListUsersResponse{ + Details: &object.ListDetails{ + TotalResult: 1, + Timestamp: timestamppb.Now(), + }, + SortingColumn: user.UserFieldName_USER_FIELD_NAME_CREATION_DATE, + Result: []*user.User{ + { + State: user.UserState_USER_STATE_ACTIVE, + Type: &user.User_Human{ + Human: &user.HumanUser{ + Profile: &user.HumanProfile{ + GivenName: "Mickey", + FamilyName: "Mouse", + NickName: gu.Ptr("Mickey"), + DisplayName: gu.Ptr("Mickey Mouse"), + PreferredLanguage: gu.Ptr("nl"), + Gender: user.Gender_GENDER_MALE.Enum(), + }, + Email: &user.HumanEmail{ + IsVerified: true, + }, + Phone: &user.HumanPhone{ + IsVerified: true, + }, + }, + }, + }, + }, + }, + }, + { + name: "list user in emails, ok", + args: args{ + iamOwnerCtx, + &user.ListUsersRequest{}, + func(ctx context.Context, request *user.ListUsersRequest) userAttrs { + info := createUser(ctx, InstancePermissionV2, orgResp.OrganizationId, false) + request.Queries = []*user.SearchQuery{} + request.Queries = append(request.Queries, OrganizationIdQuery(orgResp.OrganizationId)) + request.Queries = append(request.Queries, InUserEmailsQuery([]string{info.Username})) + request.SortingColumn = user.UserFieldName_USER_FIELD_NAME_CREATION_DATE + return []userAttr{info} + }, + }, + want: &user.ListUsersResponse{ + Details: &object.ListDetails{ + TotalResult: 1, + Timestamp: timestamppb.Now(), + }, + SortingColumn: user.UserFieldName_USER_FIELD_NAME_CREATION_DATE, + Result: []*user.User{ + { + State: user.UserState_USER_STATE_ACTIVE, + Type: &user.User_Human{ + Human: &user.HumanUser{ + Profile: &user.HumanProfile{ + GivenName: "Mickey", + FamilyName: "Mouse", + NickName: gu.Ptr("Mickey"), + DisplayName: gu.Ptr("Mickey Mouse"), + PreferredLanguage: gu.Ptr("nl"), + Gender: user.Gender_GENDER_MALE.Enum(), + }, + Email: &user.HumanEmail{ + IsVerified: true, + }, + Phone: &user.HumanPhone{ + IsVerified: true, + }, + }, + }, + }, + }, + }, + }, + { + name: "list user by emails and meta value multiple, ok", + args: args{ + iamOwnerCtx, + &user.ListUsersRequest{}, + func(ctx context.Context, request *user.ListUsersRequest) userAttrs { + infos := createUsers(ctx, InstancePermissionV2, orgResp.OrganizationId, 3, false) + request.Queries = []*user.SearchQuery{} + request.Queries = append(request.Queries, OrganizationIdQuery(orgResp.OrganizationId)) + request.Queries = append(request.Queries, InUserEmailsQuery(infos.emails())) + + InstancePermissionV2.SetUserMetadata(ctx, infos[0].UserID, "my meta 1", "my value") + InstancePermissionV2.SetUserMetadata(ctx, infos[0].UserID, "my meta 2", "my value") + InstancePermissionV2.SetUserMetadata(ctx, infos[1].UserID, "my meta 2", "my value") + InstancePermissionV2.SetUserMetadata(ctx, infos[2].UserID, "my meta", "my value") + + request.Queries = append(request.Queries, MetadataValueQuery("my value")) + request.SortingColumn = user.UserFieldName_USER_FIELD_NAME_CREATION_DATE + + return infos + }, + }, + want: &user.ListUsersResponse{ + Details: &object.ListDetails{ + TotalResult: 3, + Timestamp: timestamppb.Now(), + }, + SortingColumn: user.UserFieldName_USER_FIELD_NAME_CREATION_DATE, + Result: []*user.User{ + { + State: user.UserState_USER_STATE_ACTIVE, + Type: &user.User_Human{ + Human: &user.HumanUser{ + Profile: &user.HumanProfile{ + GivenName: "Mickey", + FamilyName: "Mouse", + NickName: gu.Ptr("Mickey"), + DisplayName: gu.Ptr("Mickey Mouse"), + PreferredLanguage: gu.Ptr("nl"), + Gender: user.Gender_GENDER_MALE.Enum(), + }, + Email: &user.HumanEmail{ + IsVerified: true, + }, + Phone: &user.HumanPhone{ + IsVerified: true, + }, + }, + }, + }, { + State: user.UserState_USER_STATE_ACTIVE, + Type: &user.User_Human{ + Human: &user.HumanUser{ + Profile: &user.HumanProfile{ + GivenName: "Mickey", + FamilyName: "Mouse", + NickName: gu.Ptr("Mickey"), + DisplayName: gu.Ptr("Mickey Mouse"), + PreferredLanguage: gu.Ptr("nl"), + Gender: user.Gender_GENDER_MALE.Enum(), + }, + Email: &user.HumanEmail{ + IsVerified: true, + }, + Phone: &user.HumanPhone{ + IsVerified: true, + }, + }, + }, + }, { + State: user.UserState_USER_STATE_ACTIVE, + Type: &user.User_Human{ + Human: &user.HumanUser{ + Profile: &user.HumanProfile{ + GivenName: "Mickey", + FamilyName: "Mouse", + NickName: gu.Ptr("Mickey"), + DisplayName: gu.Ptr("Mickey Mouse"), + PreferredLanguage: gu.Ptr("nl"), + Gender: user.Gender_GENDER_MALE.Enum(), + }, + Email: &user.HumanEmail{ + IsVerified: true, + }, + Phone: &user.HumanPhone{ + IsVerified: true, + }, + }, + }, + }, + }, + }, + }, + { + name: "list user in emails no found, ok", + args: args{ + iamOwnerCtx, + &user.ListUsersRequest{ + Queries: []*user.SearchQuery{ + OrganizationIdQuery(orgResp.OrganizationId), + InUserEmailsQuery([]string{"notfound"}), + }, + }, + func(ctx context.Context, request *user.ListUsersRequest) userAttrs { + return []userAttr{} + }, + }, + want: &user.ListUsersResponse{ + Details: &object.ListDetails{ + TotalResult: 0, + Timestamp: timestamppb.Now(), + }, + SortingColumn: 0, + Result: []*user.User{}, + }, + }, + { + name: "list user phone, ok", + args: args{ + iamOwnerCtx, + &user.ListUsersRequest{}, + func(ctx context.Context, request *user.ListUsersRequest) userAttrs { + info := createUser(ctx, InstancePermissionV2, orgResp.OrganizationId, false) + request.Queries = []*user.SearchQuery{} + request.Queries = append(request.Queries, OrganizationIdQuery(orgResp.OrganizationId)) + request.Queries = append(request.Queries, PhoneQuery(info.Phone)) + return []userAttr{info} + }, + }, + want: &user.ListUsersResponse{ + Details: &object.ListDetails{ + TotalResult: 1, + Timestamp: timestamppb.Now(), + }, + SortingColumn: 0, + Result: []*user.User{ + { + State: user.UserState_USER_STATE_ACTIVE, + Type: &user.User_Human{ + Human: &user.HumanUser{ + Profile: &user.HumanProfile{ + GivenName: "Mickey", + FamilyName: "Mouse", + NickName: gu.Ptr("Mickey"), + DisplayName: gu.Ptr("Mickey Mouse"), + PreferredLanguage: gu.Ptr("nl"), + Gender: user.Gender_GENDER_MALE.Enum(), + }, + Email: &user.HumanEmail{ + IsVerified: true, + }, + Phone: &user.HumanPhone{ + IsVerified: true, + }, + }, + }, + }, + }, + }, + }, + { + name: "list user in emails no found, ok", + args: args{ + iamOwnerCtx, + &user.ListUsersRequest{ + Queries: []*user.SearchQuery{ + OrganizationIdQuery(orgResp.OrganizationId), + InUserEmailsQuery([]string{"notfound"}), + }, + }, + func(ctx context.Context, request *user.ListUsersRequest) userAttrs { + return []userAttr{} + }, + }, + want: &user.ListUsersResponse{ + Details: &object.ListDetails{ + TotalResult: 0, + Timestamp: timestamppb.Now(), + }, + SortingColumn: 0, + Result: []*user.User{}, + }, + }, + { + name: "list user resourceowner multiple, ok", + args: args{ + iamOwnerCtx, + &user.ListUsersRequest{}, + func(ctx context.Context, request *user.ListUsersRequest) userAttrs { + orgResp := InstancePermissionV2.CreateOrganization(ctx, integration.OrganizationName(), integration.Email()) + + infos := createUsers(ctx, InstancePermissionV2, orgResp.OrganizationId, 3, false) + request.Queries = []*user.SearchQuery{} + request.Queries = append(request.Queries, OrganizationIdQuery(orgResp.OrganizationId)) + request.Queries = append(request.Queries, InUserEmailsQuery(infos.emails())) + request.SortingColumn = user.UserFieldName_USER_FIELD_NAME_CREATION_DATE + return infos + }, + }, + want: &user.ListUsersResponse{ + Details: &object.ListDetails{ + TotalResult: 3, + Timestamp: timestamppb.Now(), + }, + SortingColumn: user.UserFieldName_USER_FIELD_NAME_CREATION_DATE, + Result: []*user.User{ + { + State: user.UserState_USER_STATE_ACTIVE, + Type: &user.User_Human{ + Human: &user.HumanUser{ + Profile: &user.HumanProfile{ + GivenName: "Mickey", + FamilyName: "Mouse", + NickName: gu.Ptr("Mickey"), + DisplayName: gu.Ptr("Mickey Mouse"), + PreferredLanguage: gu.Ptr("nl"), + Gender: user.Gender_GENDER_MALE.Enum(), + }, + Email: &user.HumanEmail{ + IsVerified: true, + }, + Phone: &user.HumanPhone{ + IsVerified: true, + }, + }, + }, + }, { + State: user.UserState_USER_STATE_ACTIVE, + Type: &user.User_Human{ + Human: &user.HumanUser{ + Profile: &user.HumanProfile{ + GivenName: "Mickey", + FamilyName: "Mouse", + NickName: gu.Ptr("Mickey"), + DisplayName: gu.Ptr("Mickey Mouse"), + PreferredLanguage: gu.Ptr("nl"), + Gender: user.Gender_GENDER_MALE.Enum(), + }, + Email: &user.HumanEmail{ + IsVerified: true, + }, + Phone: &user.HumanPhone{ + IsVerified: true, + }, + }, + }, + }, { + State: user.UserState_USER_STATE_ACTIVE, + Type: &user.User_Human{ + Human: &user.HumanUser{ + Profile: &user.HumanProfile{ + GivenName: "Mickey", + FamilyName: "Mouse", + NickName: gu.Ptr("Mickey"), + DisplayName: gu.Ptr("Mickey Mouse"), + PreferredLanguage: gu.Ptr("nl"), + Gender: user.Gender_GENDER_MALE.Enum(), + }, + Email: &user.HumanEmail{ + IsVerified: true, + }, + Phone: &user.HumanPhone{ + IsVerified: true, + }, + }, + }, + }, + }, + }, + }, + { + name: "list user with org query", + args: args{ + iamOwnerCtx, + &user.ListUsersRequest{}, + func(ctx context.Context, request *user.ListUsersRequest) userAttrs { + orgRespForOrgTests := InstancePermissionV2.CreateOrganization(iamOwnerCtx, integration.OrganizationName(), integration.Email()) + info := createUser(ctx, InstancePermissionV2, orgRespForOrgTests.OrganizationId, false) + request.Queries = []*user.SearchQuery{} + request.Queries = append(request.Queries, OrganizationIdQuery(orgRespForOrgTests.OrganizationId)) + request.SortingColumn = user.UserFieldName_USER_FIELD_NAME_CREATION_DATE + return []userAttr{info, {}} + }, + }, + want: &user.ListUsersResponse{ + Details: &object.ListDetails{ + TotalResult: 2, + Timestamp: timestamppb.Now(), + }, + SortingColumn: user.UserFieldName_USER_FIELD_NAME_CREATION_DATE, + Result: []*user.User{ + { + State: user.UserState_USER_STATE_ACTIVE, + Type: &user.User_Human{ + Human: &user.HumanUser{ + Profile: &user.HumanProfile{ + GivenName: "Mickey", + FamilyName: "Mouse", + NickName: gu.Ptr("Mickey"), + DisplayName: gu.Ptr("Mickey Mouse"), + PreferredLanguage: gu.Ptr("nl"), + Gender: user.Gender_GENDER_MALE.Enum(), + }, + Email: &user.HumanEmail{ + IsVerified: true, + }, + Phone: &user.HumanPhone{ + IsVerified: true, + }, + }, + }, + }, + // this is the admin of the org craated in InstancePermissionV2.CreateOrganization() + nil, + }, + }, + }, + { + name: "list user with wrong org query", + args: args{ + iamOwnerCtx, + &user.ListUsersRequest{}, + func(ctx context.Context, request *user.ListUsersRequest) userAttrs { + orgRespForOrgTests := InstancePermissionV2.CreateOrganization(iamOwnerCtx, integration.OrganizationName(), integration.Email()) + orgRespForOrgTests2 := InstancePermissionV2.CreateOrganization(iamOwnerCtx, integration.OrganizationName(), integration.Email()) + createUser(ctx, InstancePermissionV2, orgRespForOrgTests.OrganizationId, false) + request.Queries = []*user.SearchQuery{} + request.Queries = append(request.Queries, OrganizationIdQuery(orgRespForOrgTests2.OrganizationId)) + return []userAttr{{}} + }, + }, + want: &user.ListUsersResponse{ + Details: &object.ListDetails{ + TotalResult: 0, + Timestamp: timestamppb.Now(), + }, + SortingColumn: 0, + Result: []*user.User{ + // this is the admin of the org craated in InstancePermissionV2.CreateOrganization() + nil, + }, + }, + }, + { + name: "when no users matching meta key should return empty list", + args: args{ + iamOwnerCtx, + &user.ListUsersRequest{}, + func(ctx context.Context, request *user.ListUsersRequest) userAttrs { + createUser(ctx, InstancePermissionV2, orgResp.OrganizationId, false) + request.Queries = []*user.SearchQuery{} + request.Queries = append(request.Queries, OrganizationIdQuery(orgResp.OrganizationId)) + request.Queries = append(request.Queries, MetadataKeyContainsQuery("some non-existent meta")) + + request.SortingColumn = user.UserFieldName_USER_FIELD_NAME_CREATION_DATE + return []userAttr{} + }, + }, + want: &user.ListUsersResponse{ + Details: &object.ListDetails{ + TotalResult: 0, + Timestamp: timestamppb.Now(), + }, + SortingColumn: user.UserFieldName_USER_FIELD_NAME_CREATION_DATE, + Result: []*user.User{}, + }, + }, + } + for _, tc := range tt { + t.Run(tc.name, func(t1 *testing.T) { + infos := tc.args.dep(iamOwnerCtx, tc.args.req) + + retryDuration, tick := integration.WaitForAndTickWithMaxDuration(tc.args.ctx, 20*time.Second) + require.EventuallyWithT(t1, func(ttt *assert.CollectT) { + got, err := InstancePermissionV2.Client.UserV2.ListUsers(tc.args.ctx, tc.args.req) + if tc.wantErr { + require.Error(ttt, err) + return + } + require.NoError(ttt, err) + + // always only give back dependency infos which are required for the response + require.Len(ttt, tc.want.Result, len(infos)) + if assert.Len(ttt, got.Result, len(tc.want.Result)) { + tc.want.Details.TotalResult = got.Details.TotalResult + + // fill in userid and username as it is generated + for i := range infos { + if tc.want.Result[i] == nil { + continue + } + tc.want.Result[i].UserId = infos[i].UserID + tc.want.Result[i].Username = infos[i].Username + tc.want.Result[i].PreferredLoginName = infos[i].Username + tc.want.Result[i].LoginNames = []string{infos[i].Username} + if human := tc.want.Result[i].GetHuman(); human != nil { + human.Email.Email = infos[i].Username + human.Phone.Phone = infos[i].Phone + if tc.want.Result[i].GetHuman().GetPasswordChanged() != nil { + human.PasswordChanged = infos[i].Changed + } + } + tc.want.Result[i].Details = infos[i].Details + } + for i := range tc.want.Result { + if tc.want.Result[i] == nil { + continue + } + assert.EqualExportedValues(ttt, got.Result[i], tc.want.Result[i]) + } + } + integration.AssertListDetails(ttt, tc.want, got) + }, retryDuration, tick, "timeout waiting for expected user result") + }) } } func TestServer_SystemUsers_ListUsers(t *testing.T) { - defer func() { - _, err := Instance.Client.FeatureV2.ResetInstanceFeatures(IamCTX, &feature.ResetInstanceFeaturesRequest{}) - require.NoError(t, err) - }() org1 := Instance.CreateOrganization(IamCTX, integration.OrganizationName(), integration.Email()) org2 := Instance.CreateOrganization(IamCTX, integration.OrganizationName(), "org2@zitadel.com") org3 := Instance.CreateOrganization(IamCTX, integration.OrganizationName(), integration.Email()) - _ = createUserWithUserName(IamCTX, "Test_SystemUsers_ListUser1@zitadel.com", org1.OrganizationId, false) - _ = createUserWithUserName(IamCTX, "Test_SystemUsers_ListUser2@zitadel.com", org2.OrganizationId, false) - _ = createUserWithUserName(IamCTX, "Test_SystemUsers_ListUser3@zitadel.com", org3.OrganizationId, false) + _ = createUserWithUserName(IamCTX, Instance, "Test_SystemUsers_ListUser1@zitadel.com", org1.OrganizationId, false) + _ = createUserWithUserName(IamCTX, Instance, "Test_SystemUsers_ListUser2@zitadel.com", org2.OrganizationId, false) + _ = createUserWithUserName(IamCTX, Instance, "Test_SystemUsers_ListUser3@zitadel.com", org3.OrganizationId, false) tests := []struct { name string @@ -1443,38 +2169,119 @@ func TestServer_SystemUsers_ListUsers(t *testing.T) { }, } - for _, f := range permissionCheckV2Settings { - f := f - for _, tt := range tests { - t.Run(f.TestNamePrependString+tt.name, func(t *testing.T) { - setPermissionCheckV2Flag(t, f.SetFlag) + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { - retryDuration, tick := integration.WaitForAndTickWithMaxDuration(tt.ctx, 1*time.Minute) - require.EventuallyWithT(t, func(ttt *assert.CollectT) { - got, err := Client.ListUsers(tt.ctx, tt.req) - require.NoError(ttt, err) + retryDuration, tick := integration.WaitForAndTickWithMaxDuration(tt.ctx, 1*time.Minute) + require.EventuallyWithT(t, func(ttt *assert.CollectT) { + got, err := Client.ListUsers(tt.ctx, tt.req) + require.NoError(ttt, err) - if tt.checkNumberOfUsersReturned { - require.Equal(t, len(tt.expectedFoundUsernames), len(got.Result)) - } + if tt.checkNumberOfUsersReturned { + require.Equal(t, len(tt.expectedFoundUsernames), len(got.Result)) + } - if tt.expectedFoundUsernames != nil { - for _, user := range got.Result { - for i, username := range tt.expectedFoundUsernames { - if username == user.Username { - tt.expectedFoundUsernames = tt.expectedFoundUsernames[i+1:] - break - } - } - if len(tt.expectedFoundUsernames) == 0 { - return + if tt.expectedFoundUsernames != nil { + for _, user := range got.Result { + for i, username := range tt.expectedFoundUsernames { + if username == user.Username { + tt.expectedFoundUsernames = tt.expectedFoundUsernames[i+1:] + break } } - require.FailNow(t, "unable to find all users with specified usernames") + if len(tt.expectedFoundUsernames) == 0 { + return + } } - }, retryDuration, tick, "timeout waiting for expected user result") - }) - } + require.FailNow(t, "unable to find all users with specified usernames") + } + }, retryDuration, tick, "timeout waiting for expected user result") + }) + } +} + +func TestServer_SystemUsers_ListUsers_PermissionsV2(t *testing.T) { + ensureFeaturePermissionV2Enabled(t, InstancePermissionV2) + iamOwnerCtx := InstancePermissionV2.WithAuthorizationToken(OrgCTX, integration.UserTypeIAMOwner) + + org1 := InstancePermissionV2.CreateOrganization(iamOwnerCtx, integration.OrganizationName(), integration.Email()) + org2 := InstancePermissionV2.CreateOrganization(iamOwnerCtx, integration.OrganizationName(), "org2@zitadel.com") + org3 := InstancePermissionV2.CreateOrganization(iamOwnerCtx, integration.OrganizationName(), integration.Email()) + _ = createUserWithUserName(iamOwnerCtx, InstancePermissionV2, "Test_SystemUsers_ListUser1@zitadel.com", org1.OrganizationId, false) + _ = createUserWithUserName(iamOwnerCtx, InstancePermissionV2, "Test_SystemUsers_ListUser2@zitadel.com", org2.OrganizationId, false) + _ = createUserWithUserName(iamOwnerCtx, InstancePermissionV2, "Test_SystemUsers_ListUser3@zitadel.com", org3.OrganizationId, false) + + tests := []struct { + name string + ctx context.Context + req *user.ListUsersRequest + expectedFoundUsernames []string + checkNumberOfUsersReturned bool + }{ + { + name: "list users with neccessary permissions", + ctx: SystemCTX, + req: &user.ListUsersRequest{}, + // the number of users returned will vary from test run to test run, + // so just check the system user gets back users from different orgs whcih it is not a memeber of + checkNumberOfUsersReturned: false, + expectedFoundUsernames: []string{"Test_SystemUsers_ListUser1@zitadel.com", "Test_SystemUsers_ListUser2@zitadel.com", "Test_SystemUsers_ListUser3@zitadel.com"}, + }, + { + name: "list users without neccessary permissions", + ctx: SystemUserWithNoPermissionsCTX, + req: &user.ListUsersRequest{}, + // check no users returned + checkNumberOfUsersReturned: true, + }, + { + name: "list users with neccessary permissions specifying org", + req: &user.ListUsersRequest{ + Queries: []*user.SearchQuery{OrganizationIdQuery(org2.OrganizationId)}, + }, + ctx: SystemCTX, + expectedFoundUsernames: []string{"Test_SystemUsers_ListUser2@zitadel.com", "org2@zitadel.com"}, + checkNumberOfUsersReturned: true, + }, + { + name: "list users without neccessary permissions specifying org", + req: &user.ListUsersRequest{ + Queries: []*user.SearchQuery{OrganizationIdQuery(org2.OrganizationId)}, + }, + ctx: SystemUserWithNoPermissionsCTX, + // check no users returned + checkNumberOfUsersReturned: true, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + + retryDuration, tick := integration.WaitForAndTickWithMaxDuration(tt.ctx, 1*time.Minute) + require.EventuallyWithT(t, func(ttt *assert.CollectT) { + got, err := InstancePermissionV2.Client.UserV2.ListUsers(tt.ctx, tt.req) + require.NoError(ttt, err) + + if tt.checkNumberOfUsersReturned { + require.Equal(t, len(tt.expectedFoundUsernames), len(got.Result)) + } + + if tt.expectedFoundUsernames != nil { + for _, user := range got.Result { + for i, username := range tt.expectedFoundUsernames { + if username == user.Username { + tt.expectedFoundUsernames = tt.expectedFoundUsernames[i+1:] + break + } + } + if len(tt.expectedFoundUsernames) == 0 { + return + } + } + require.FailNow(t, "unable to find all users with specified usernames") + } + }, retryDuration, tick, "timeout waiting for expected user result") + }) } } diff --git a/internal/api/grpc/user/v2/integration_test/secret_test.go b/internal/api/grpc/user/v2/integration_test/secret_test.go index 789d0eaf3..a891bc1b5 100644 --- a/internal/api/grpc/user/v2/integration_test/secret_test.go +++ b/internal/api/grpc/user/v2/integration_test/secret_test.go @@ -28,7 +28,7 @@ func TestServer_AddSecret(t *testing.T) { { name: "add secret, user not existing", args: args{ - CTX, + OrgCTX, &user.AddSecretRequest{ UserId: "notexisting", }, @@ -39,10 +39,10 @@ func TestServer_AddSecret(t *testing.T) { { name: "add secret, ok", args: args{ - CTX, + OrgCTX, &user.AddSecretRequest{}, func(request *user.AddSecretRequest) error { - resp := Instance.CreateUserTypeMachine(CTX, Instance.DefaultOrg.Id) + resp := Instance.CreateUserTypeMachine(OrgCTX, Instance.DefaultOrg.Id) request.UserId = resp.GetId() return nil }, @@ -51,10 +51,10 @@ func TestServer_AddSecret(t *testing.T) { { name: "add secret human, not ok", args: args{ - CTX, + OrgCTX, &user.AddSecretRequest{}, func(request *user.AddSecretRequest) error { - resp := Instance.CreateUserTypeMachine(CTX, Instance.DefaultOrg.Id) + resp := Instance.CreateUserTypeMachine(OrgCTX, Instance.DefaultOrg.Id) request.UserId = resp.GetId() return nil }, @@ -63,12 +63,12 @@ func TestServer_AddSecret(t *testing.T) { { name: "overwrite secret, ok", args: args{ - CTX, + OrgCTX, &user.AddSecretRequest{}, func(request *user.AddSecretRequest) error { - resp := Instance.CreateUserTypeMachine(CTX, Instance.DefaultOrg.Id) + resp := Instance.CreateUserTypeMachine(OrgCTX, Instance.DefaultOrg.Id) request.UserId = resp.GetId() - _, err := Client.AddSecret(CTX, &user.AddSecretRequest{ + _, err := Client.AddSecret(OrgCTX, &user.AddSecretRequest{ UserId: resp.GetId(), }) return err @@ -137,7 +137,7 @@ func TestServer_AddSecret_Permission(t *testing.T) { { name: "org, error", args: args{ - CTX, + OrgCTX, &user.AddSecretRequest{ UserId: otherOrgUser.GetId(), }, @@ -187,7 +187,7 @@ func TestServer_RemoveSecret(t *testing.T) { { name: "remove secret, user not existing", args: args{ - CTX, + OrgCTX, &user.RemoveSecretRequest{ UserId: "notexisting", }, @@ -198,10 +198,10 @@ func TestServer_RemoveSecret(t *testing.T) { { name: "remove secret, not existing", args: args{ - CTX, + OrgCTX, &user.RemoveSecretRequest{}, func(request *user.RemoveSecretRequest) error { - resp := Instance.CreateUserTypeMachine(CTX, Instance.DefaultOrg.Id) + resp := Instance.CreateUserTypeMachine(OrgCTX, Instance.DefaultOrg.Id) request.UserId = resp.GetId() return nil }, @@ -211,12 +211,12 @@ func TestServer_RemoveSecret(t *testing.T) { { name: "remove secret, ok", args: args{ - CTX, + OrgCTX, &user.RemoveSecretRequest{}, func(request *user.RemoveSecretRequest) error { - resp := Instance.CreateUserTypeMachine(CTX, Instance.DefaultOrg.Id) + resp := Instance.CreateUserTypeMachine(OrgCTX, Instance.DefaultOrg.Id) request.UserId = resp.GetId() - _, err := Instance.Client.UserV2.AddSecret(CTX, &user.AddSecretRequest{ + _, err := Instance.Client.UserV2.AddSecret(OrgCTX, &user.AddSecretRequest{ UserId: resp.GetId(), }) return err @@ -297,7 +297,7 @@ func TestServer_RemoveSecret_Permission(t *testing.T) { { name: "org, error", args: args{ - CTX, + OrgCTX, &user.RemoveSecretRequest{ UserId: otherOrgUser.GetId(), }, diff --git a/internal/api/grpc/user/v2/integration_test/server_test.go b/internal/api/grpc/user/v2/integration_test/server_test.go new file mode 100644 index 000000000..4801b1848 --- /dev/null +++ b/internal/api/grpc/user/v2/integration_test/server_test.go @@ -0,0 +1,80 @@ +//go:build integration + +package user_test + +import ( + "context" + "os" + "testing" + "time" + + "github.com/muhlemmer/gu" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + "github.com/zitadel/zitadel/internal/integration" + "github.com/zitadel/zitadel/pkg/grpc/feature/v2" + "github.com/zitadel/zitadel/pkg/grpc/user/v2" +) + +var ( + CTX context.Context + OrgCTX context.Context + IamCTX context.Context + LoginCTX context.Context + UserCTX context.Context + SystemCTX context.Context + SystemUserWithNoPermissionsCTX context.Context + Instance *integration.Instance + InstancePermissionV2 *integration.Instance + Client user.UserServiceClient +) + +func TestMain(m *testing.M) { + os.Exit(func() int { + ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute) + defer cancel() + CTX = ctx + + Instance = integration.NewInstance(ctx) + InstancePermissionV2 = integration.NewInstance(ctx) + + SystemUserWithNoPermissionsCTX = integration.WithSystemUserWithNoPermissionsAuthorization(ctx) + UserCTX = Instance.WithAuthorizationToken(ctx, integration.UserTypeNoPermission) + IamCTX = Instance.WithAuthorizationToken(ctx, integration.UserTypeIAMOwner) + LoginCTX = Instance.WithAuthorizationToken(ctx, integration.UserTypeLogin) + SystemCTX = integration.WithSystemAuthorization(ctx) + OrgCTX = Instance.WithAuthorizationToken(ctx, integration.UserTypeOrgOwner) + Client = Instance.Client.UserV2 + return m.Run() + }()) +} + +func ensureFeaturePermissionV2Enabled(t *testing.T, instance *integration.Instance) { + ctx := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner) + f, err := instance.Client.FeatureV2.GetInstanceFeatures(ctx, &feature.GetInstanceFeaturesRequest{ + Inheritance: true, + }) + require.NoError(t, err) + if f.PermissionCheckV2.GetEnabled() { + return + } + _, err = instance.Client.FeatureV2.SetInstanceFeatures(ctx, &feature.SetInstanceFeaturesRequest{ + PermissionCheckV2: gu.Ptr(true), + }) + require.NoError(t, err) + retryDuration, tick := integration.WaitForAndTickWithMaxDuration(ctx, 5*time.Minute) + require.EventuallyWithT(t, + func(ttt *assert.CollectT) { + f, err := instance.Client.FeatureV2.GetInstanceFeatures(ctx, &feature.GetInstanceFeaturesRequest{ + Inheritance: true, + }) + assert.NoError(ttt, err) + if f.PermissionCheckV2.GetEnabled() { + return + } + }, + retryDuration, + tick, + "timed out waiting for ensuring instance feature") +} diff --git a/internal/api/grpc/user/v2/integration_test/totp_test.go b/internal/api/grpc/user/v2/integration_test/totp_test.go index 65d1003c3..6db4a9b39 100644 --- a/internal/api/grpc/user/v2/integration_test/totp_test.go +++ b/internal/api/grpc/user/v2/integration_test/totp_test.go @@ -18,15 +18,15 @@ import ( ) func TestServer_RegisterTOTP(t *testing.T) { - userID := Instance.CreateHumanUser(CTX).GetUserId() - Instance.RegisterUserPasskey(CTX, userID) + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() + Instance.RegisterUserPasskey(OrgCTX, userID) _, sessionToken, _, _ := Instance.CreateVerifiedWebAuthNSession(t, LoginCTX, userID) - ctx := integration.WithAuthorizationToken(CTX, sessionToken) + ctx := integration.WithAuthorizationToken(OrgCTX, sessionToken) - otherUser := Instance.CreateHumanUser(CTX).GetUserId() - Instance.RegisterUserPasskey(CTX, otherUser) + otherUser := Instance.CreateHumanUser(OrgCTX).GetUserId() + Instance.RegisterUserPasskey(OrgCTX, otherUser) _, sessionTokenOtherUser, _, _ := Instance.CreateVerifiedWebAuthNSession(t, LoginCTX, otherUser) - ctxOtherUser := integration.WithAuthorizationToken(CTX, sessionTokenOtherUser) + ctxOtherUser := integration.WithAuthorizationToken(OrgCTX, sessionTokenOtherUser) type args struct { ctx context.Context @@ -59,7 +59,7 @@ func TestServer_RegisterTOTP(t *testing.T) { { name: "admin", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.RegisterTOTPRequest{ UserId: userID, }, @@ -104,10 +104,10 @@ func TestServer_RegisterTOTP(t *testing.T) { } func TestServer_VerifyTOTPRegistration(t *testing.T) { - userID := Instance.CreateHumanUser(CTX).GetUserId() - Instance.RegisterUserPasskey(CTX, userID) + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() + Instance.RegisterUserPasskey(OrgCTX, userID) _, sessionToken, _, _ := Instance.CreateVerifiedWebAuthNSession(t, LoginCTX, userID) - ctx := integration.WithAuthorizationToken(CTX, sessionToken) + ctx := integration.WithAuthorizationToken(OrgCTX, sessionToken) reg, err := Client.RegisterTOTP(ctx, &user.RegisterTOTPRequest{ UserId: userID, @@ -116,12 +116,12 @@ func TestServer_VerifyTOTPRegistration(t *testing.T) { code, err := totp.GenerateCode(reg.Secret, time.Now()) require.NoError(t, err) - otherUser := Instance.CreateHumanUser(CTX).GetUserId() - Instance.RegisterUserPasskey(CTX, otherUser) + otherUser := Instance.CreateHumanUser(OrgCTX).GetUserId() + Instance.RegisterUserPasskey(OrgCTX, otherUser) _, sessionTokenOtherUser, _, _ := Instance.CreateVerifiedWebAuthNSession(t, LoginCTX, otherUser) - ctxOtherUser := integration.WithAuthorizationToken(CTX, sessionTokenOtherUser) + ctxOtherUser := integration.WithAuthorizationToken(OrgCTX, sessionTokenOtherUser) - regOtherUser, err := Client.RegisterTOTP(CTX, &user.RegisterTOTPRequest{ + regOtherUser, err := Client.RegisterTOTP(OrgCTX, &user.RegisterTOTPRequest{ UserId: otherUser, }) require.NoError(t, err) @@ -178,7 +178,7 @@ func TestServer_VerifyTOTPRegistration(t *testing.T) { { name: "success, admin", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.VerifyTOTPRegistrationRequest{ UserId: otherUser, Code: codeOtherUser, @@ -207,12 +207,12 @@ func TestServer_VerifyTOTPRegistration(t *testing.T) { } func TestServer_RemoveTOTP(t *testing.T) { - userID := Instance.CreateHumanUser(CTX).GetUserId() - Instance.RegisterUserPasskey(CTX, userID) + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() + Instance.RegisterUserPasskey(OrgCTX, userID) _, sessionToken, _, _ := Instance.CreateVerifiedWebAuthNSession(t, LoginCTX, userID) - userVerified := Instance.CreateHumanUser(CTX) - Instance.RegisterUserPasskey(CTX, userVerified.GetUserId()) + userVerified := Instance.CreateHumanUser(OrgCTX) + Instance.RegisterUserPasskey(OrgCTX, userVerified.GetUserId()) _, sessionTokenVerified, _, _ := Instance.CreateVerifiedWebAuthNSession(t, LoginCTX, userVerified.GetUserId()) userVerifiedCtx := integration.WithAuthorizationToken(context.Background(), sessionTokenVerified) _, err := Instance.Client.UserV2.VerifyPhone(userVerifiedCtx, &user.VerifyPhoneRequest{ @@ -221,7 +221,7 @@ func TestServer_RemoveTOTP(t *testing.T) { }) require.NoError(t, err) - regOtherUser, err := Client.RegisterTOTP(CTX, &user.RegisterTOTPRequest{ + regOtherUser, err := Client.RegisterTOTP(OrgCTX, &user.RegisterTOTPRequest{ UserId: userVerified.GetUserId(), }) require.NoError(t, err) diff --git a/internal/api/grpc/user/v2/integration_test/u2f_test.go b/internal/api/grpc/user/v2/integration_test/u2f_test.go index 962671d60..4378eff57 100644 --- a/internal/api/grpc/user/v2/integration_test/u2f_test.go +++ b/internal/api/grpc/user/v2/integration_test/u2f_test.go @@ -17,13 +17,13 @@ import ( ) func TestServer_RegisterU2F(t *testing.T) { - userID := Instance.CreateHumanUser(CTX).GetUserId() - otherUser := Instance.CreateHumanUser(CTX).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() + otherUser := Instance.CreateHumanUser(OrgCTX).GetUserId() // We also need a user session - Instance.RegisterUserPasskey(CTX, userID) + Instance.RegisterUserPasskey(OrgCTX, userID) _, sessionToken, _, _ := Instance.CreateVerifiedWebAuthNSession(t, LoginCTX, userID) - Instance.RegisterUserPasskey(CTX, otherUser) + Instance.RegisterUserPasskey(OrgCTX, otherUser) _, sessionTokenOtherUser, _, _ := Instance.CreateVerifiedWebAuthNSession(t, LoginCTX, otherUser) type args struct { @@ -39,7 +39,7 @@ func TestServer_RegisterU2F(t *testing.T) { { name: "missing user id", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.RegisterU2FRequest{}, }, wantErr: true, @@ -47,7 +47,7 @@ func TestServer_RegisterU2F(t *testing.T) { { name: "admin user", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.RegisterU2FRequest{ UserId: userID, }, @@ -62,7 +62,7 @@ func TestServer_RegisterU2F(t *testing.T) { { name: "other user, no permission", args: args{ - ctx: integration.WithAuthorizationToken(CTX, sessionTokenOtherUser), + ctx: integration.WithAuthorizationToken(OrgCTX, sessionTokenOtherUser), req: &user.RegisterU2FRequest{ UserId: userID, }, @@ -72,7 +72,7 @@ func TestServer_RegisterU2F(t *testing.T) { { name: "user setting its own passkey", args: args{ - ctx: integration.WithAuthorizationToken(CTX, sessionToken), + ctx: integration.WithAuthorizationToken(OrgCTX, sessionToken), req: &user.RegisterU2FRequest{ UserId: userID, }, @@ -181,10 +181,10 @@ func TestServer_VerifyU2FRegistration(t *testing.T) { } func ctxFromNewUserWithRegisteredU2F(t *testing.T) (context.Context, string, *user.RegisterU2FResponse) { - userID := Instance.CreateHumanUser(CTX).GetUserId() - Instance.RegisterUserPasskey(CTX, userID) + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() + Instance.RegisterUserPasskey(OrgCTX, userID) _, sessionToken, _, _ := Instance.CreateVerifiedWebAuthNSession(t, LoginCTX, userID) - ctx := integration.WithAuthorizationToken(CTX, sessionToken) + ctx := integration.WithAuthorizationToken(OrgCTX, sessionToken) pkr, err := Client.RegisterU2F(ctx, &user.RegisterU2FRequest{ UserId: userID, @@ -211,7 +211,7 @@ func ctxFromNewUserWithVerifiedU2F(t *testing.T) (context.Context, string, strin } func TestServer_RemoveU2F(t *testing.T) { - userIDWithout := Instance.CreateHumanUser(CTX).GetUserId() + userIDWithout := Instance.CreateHumanUser(OrgCTX).GetUserId() ctxRegistered, userIDRegistered, pkrRegistered := ctxFromNewUserWithRegisteredU2F(t) _, userIDVerified, u2fVerified := ctxFromNewUserWithVerifiedU2F(t) _, userIDVerifiedPermission, u2fVerifiedPermission := ctxFromNewUserWithVerifiedU2F(t) diff --git a/internal/api/grpc/user/v2/integration_test/user_test.go b/internal/api/grpc/user/v2/integration_test/user_test.go index 4c6d757f6..b976045f1 100644 --- a/internal/api/grpc/user/v2/integration_test/user_test.go +++ b/internal/api/grpc/user/v2/integration_test/user_test.go @@ -7,7 +7,6 @@ import ( "encoding/base64" "fmt" "net/url" - "os" "testing" "time" @@ -30,35 +29,6 @@ import ( "github.com/zitadel/zitadel/pkg/grpc/user/v2" ) -var ( - CTX context.Context - IamCTX context.Context - LoginCTX context.Context - UserCTX context.Context - SystemCTX context.Context - SystemUserWithNoPermissionsCTX context.Context - Instance *integration.Instance - Client user.UserServiceClient -) - -func TestMain(m *testing.M) { - os.Exit(func() int { - ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute) - defer cancel() - - Instance = integration.NewInstance(ctx) - - SystemUserWithNoPermissionsCTX = integration.WithSystemUserWithNoPermissionsAuthorization(ctx) - UserCTX = Instance.WithAuthorization(ctx, integration.UserTypeNoPermission) - IamCTX = Instance.WithAuthorization(ctx, integration.UserTypeIAMOwner) - LoginCTX = Instance.WithAuthorization(ctx, integration.UserTypeLogin) - SystemCTX = integration.WithSystemAuthorization(ctx) - CTX = Instance.WithAuthorization(ctx, integration.UserTypeOrgOwner) - Client = Instance.Client.UserV2 - return m.Run() - }()) -} - func TestServer_Deprecated_AddHumanUser(t *testing.T) { idpResp := Instance.AddGenericOAuthProvider(IamCTX, Instance.DefaultOrg.Id) type args struct { @@ -74,7 +44,7 @@ func TestServer_Deprecated_AddHumanUser(t *testing.T) { { name: "default verification", args: args{ - CTX, + OrgCTX, &user.AddHumanUserRequest{ Organization: &object.Organization{ Org: &object.Organization_OrgId{ @@ -115,7 +85,7 @@ func TestServer_Deprecated_AddHumanUser(t *testing.T) { { name: "default verification (org domain ctx)", args: args{ - CTX, + OrgCTX, &user.AddHumanUserRequest{ Organization: &object.Organization{ Org: &object.Organization_OrgDomain{ @@ -156,7 +126,7 @@ func TestServer_Deprecated_AddHumanUser(t *testing.T) { { name: "return email verification code", args: args{ - CTX, + OrgCTX, &user.AddHumanUserRequest{ Organization: &object.Organization{ Org: &object.Organization_OrgId{ @@ -201,7 +171,7 @@ func TestServer_Deprecated_AddHumanUser(t *testing.T) { { name: "custom template", args: args{ - CTX, + OrgCTX, &user.AddHumanUserRequest{ Organization: &object.Organization{ Org: &object.Organization_OrgId{ @@ -247,7 +217,7 @@ func TestServer_Deprecated_AddHumanUser(t *testing.T) { { name: "return phone verification code", args: args{ - CTX, + OrgCTX, &user.AddHumanUserRequest{ Organization: &object.Organization{ Org: &object.Organization_OrgId{ @@ -294,7 +264,7 @@ func TestServer_Deprecated_AddHumanUser(t *testing.T) { { name: "custom template error", args: args{ - CTX, + OrgCTX, &user.AddHumanUserRequest{ Organization: &object.Organization{ Org: &object.Organization_OrgId{ @@ -335,7 +305,7 @@ func TestServer_Deprecated_AddHumanUser(t *testing.T) { { name: "missing REQUIRED profile", args: args{ - CTX, + OrgCTX, &user.AddHumanUserRequest{ Organization: &object.Organization{ Org: &object.Organization_OrgId{ @@ -366,7 +336,7 @@ func TestServer_Deprecated_AddHumanUser(t *testing.T) { { name: "missing REQUIRED email", args: args{ - CTX, + OrgCTX, &user.AddHumanUserRequest{ Organization: &object.Organization{ Org: &object.Organization_OrgId{ @@ -400,7 +370,7 @@ func TestServer_Deprecated_AddHumanUser(t *testing.T) { { name: "missing idp", args: args{ - CTX, + OrgCTX, &user.AddHumanUserRequest{ Organization: &object.Organization{ Org: &object.Organization_OrgId{ @@ -447,7 +417,7 @@ func TestServer_Deprecated_AddHumanUser(t *testing.T) { { name: "with idp", args: args{ - CTX, + OrgCTX, &user.AddHumanUserRequest{ Organization: &object.Organization{ Org: &object.Organization_OrgId{ @@ -499,7 +469,7 @@ func TestServer_Deprecated_AddHumanUser(t *testing.T) { { name: "with totp", args: args{ - CTX, + OrgCTX, &user.AddHumanUserRequest{ Organization: &object.Organization{ Org: &object.Organization_OrgId{ @@ -545,7 +515,7 @@ func TestServer_Deprecated_AddHumanUser(t *testing.T) { { name: "password not complexity conform", args: args{ - CTX, + OrgCTX, &user.AddHumanUserRequest{ Organization: &object.Organization{ Org: &object.Organization_OrgId{ @@ -579,7 +549,7 @@ func TestServer_Deprecated_AddHumanUser(t *testing.T) { { name: "hashed password", args: args{ - CTX, + OrgCTX, &user.AddHumanUserRequest{ Organization: &object.Organization{ Org: &object.Organization_OrgId{ @@ -618,7 +588,7 @@ func TestServer_Deprecated_AddHumanUser(t *testing.T) { { name: "unsupported hashed password", args: args{ - CTX, + OrgCTX, &user.AddHumanUserRequest{ Organization: &object.Organization{ Org: &object.Organization_OrgId{ @@ -783,7 +753,7 @@ func TestServer_Deprecated_AddHumanUser_Permission(t *testing.T) { { name: "Org, error", args: args{ - CTX, + OrgCTX, &user.AddHumanUserRequest{ Organization: &object.Organization{ Org: &object.Organization_OrgId{ @@ -897,7 +867,7 @@ func TestServer_Deprecated_UpdateHumanUser(t *testing.T) { return nil }, args: args{ - CTX, + OrgCTX, &user.UpdateHumanUserRequest{ Username: gu.Ptr("changed"), }, @@ -907,12 +877,12 @@ func TestServer_Deprecated_UpdateHumanUser(t *testing.T) { { name: "change username, ok", prepare: func(request *user.UpdateHumanUserRequest) error { - userID := Instance.CreateHumanUser(CTX).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() request.UserId = userID return nil }, args: args{ - CTX, + OrgCTX, &user.UpdateHumanUserRequest{ Username: gu.Ptr(integration.Username()), }, @@ -927,12 +897,12 @@ func TestServer_Deprecated_UpdateHumanUser(t *testing.T) { { name: "change profile, ok", prepare: func(request *user.UpdateHumanUserRequest) error { - userID := Instance.CreateHumanUser(CTX).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() request.UserId = userID return nil }, args: args{ - CTX, + OrgCTX, &user.UpdateHumanUserRequest{ Profile: &user.SetHumanProfile{ GivenName: "Donald", @@ -954,12 +924,12 @@ func TestServer_Deprecated_UpdateHumanUser(t *testing.T) { { name: "change email, ok", prepare: func(request *user.UpdateHumanUserRequest) error { - userID := Instance.CreateHumanUser(CTX).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() request.UserId = userID return nil }, args: args{ - CTX, + OrgCTX, &user.UpdateHumanUserRequest{ Email: &user.SetHumanEmail{ Email: "changed@test.com", @@ -977,12 +947,12 @@ func TestServer_Deprecated_UpdateHumanUser(t *testing.T) { { name: "change email, code, ok", prepare: func(request *user.UpdateHumanUserRequest) error { - userID := Instance.CreateHumanUser(CTX).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() request.UserId = userID return nil }, args: args{ - CTX, + OrgCTX, &user.UpdateHumanUserRequest{ Email: &user.SetHumanEmail{ Email: "changed@test.com", @@ -1001,12 +971,12 @@ func TestServer_Deprecated_UpdateHumanUser(t *testing.T) { { name: "change phone, ok", prepare: func(request *user.UpdateHumanUserRequest) error { - userID := Instance.CreateHumanUser(CTX).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() request.UserId = userID return nil }, args: args{ - CTX, + OrgCTX, &user.UpdateHumanUserRequest{ Phone: &user.SetHumanPhone{ Phone: "+41791234567", @@ -1024,12 +994,12 @@ func TestServer_Deprecated_UpdateHumanUser(t *testing.T) { { name: "change phone, code, ok", prepare: func(request *user.UpdateHumanUserRequest) error { - userID := Instance.CreateHumanUser(CTX).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() request.UserId = userID return nil }, args: args{ - CTX, + OrgCTX, &user.UpdateHumanUserRequest{ Phone: &user.SetHumanPhone{ Phone: "+41791234568", @@ -1048,9 +1018,9 @@ func TestServer_Deprecated_UpdateHumanUser(t *testing.T) { { name: "change password, code, ok", prepare: func(request *user.UpdateHumanUserRequest) error { - userID := Instance.CreateHumanUser(CTX).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() request.UserId = userID - resp, err := Client.PasswordReset(CTX, &user.PasswordResetRequest{ + resp, err := Client.PasswordReset(OrgCTX, &user.PasswordResetRequest{ UserId: userID, Medium: &user.PasswordResetRequest_ReturnCode{ ReturnCode: &user.ReturnPasswordResetCode{}, @@ -1065,7 +1035,7 @@ func TestServer_Deprecated_UpdateHumanUser(t *testing.T) { return nil }, args: args{ - CTX, + OrgCTX, &user.UpdateHumanUserRequest{ Password: &user.SetPassword{ PasswordType: &user.SetPassword_Password{ @@ -1087,9 +1057,9 @@ func TestServer_Deprecated_UpdateHumanUser(t *testing.T) { { name: "change hashed password, code, ok", prepare: func(request *user.UpdateHumanUserRequest) error { - userID := Instance.CreateHumanUser(CTX).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() request.UserId = userID - resp, err := Client.PasswordReset(CTX, &user.PasswordResetRequest{ + resp, err := Client.PasswordReset(OrgCTX, &user.PasswordResetRequest{ UserId: userID, Medium: &user.PasswordResetRequest_ReturnCode{ ReturnCode: &user.ReturnPasswordResetCode{}, @@ -1104,7 +1074,7 @@ func TestServer_Deprecated_UpdateHumanUser(t *testing.T) { return nil }, args: args{ - CTX, + OrgCTX, &user.UpdateHumanUserRequest{ Password: &user.SetPassword{ PasswordType: &user.SetPassword_HashedPassword{ @@ -1125,9 +1095,9 @@ func TestServer_Deprecated_UpdateHumanUser(t *testing.T) { { name: "change hashed password, code, not supported", prepare: func(request *user.UpdateHumanUserRequest) error { - userID := Instance.CreateHumanUser(CTX).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() request.UserId = userID - resp, err := Client.PasswordReset(CTX, &user.PasswordResetRequest{ + resp, err := Client.PasswordReset(OrgCTX, &user.PasswordResetRequest{ UserId: userID, Medium: &user.PasswordResetRequest_ReturnCode{ ReturnCode: &user.ReturnPasswordResetCode{}, @@ -1144,7 +1114,7 @@ func TestServer_Deprecated_UpdateHumanUser(t *testing.T) { return nil }, args: args{ - CTX, + OrgCTX, &user.UpdateHumanUserRequest{ Password: &user.SetPassword{ PasswordType: &user.SetPassword_HashedPassword{ @@ -1160,10 +1130,10 @@ func TestServer_Deprecated_UpdateHumanUser(t *testing.T) { { name: "change password, old password, ok", prepare: func(request *user.UpdateHumanUserRequest) error { - userID := Instance.CreateHumanUser(CTX).GetUserId() + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() request.UserId = userID - resp, err := Client.PasswordReset(CTX, &user.PasswordResetRequest{ + resp, err := Client.PasswordReset(OrgCTX, &user.PasswordResetRequest{ UserId: userID, Medium: &user.PasswordResetRequest_ReturnCode{ ReturnCode: &user.ReturnPasswordResetCode{}, @@ -1173,7 +1143,7 @@ func TestServer_Deprecated_UpdateHumanUser(t *testing.T) { return err } pw := "Password1." - _, err = Client.SetPassword(CTX, &user.SetPasswordRequest{ + _, err = Client.SetPassword(OrgCTX, &user.SetPasswordRequest{ UserId: userID, NewPassword: &user.Password{ Password: pw, @@ -1192,7 +1162,7 @@ func TestServer_Deprecated_UpdateHumanUser(t *testing.T) { return nil }, args: args{ - CTX, + OrgCTX, &user.UpdateHumanUserRequest{ Password: &user.SetPassword{ PasswordType: &user.SetPassword_Password{ @@ -1288,7 +1258,7 @@ func TestServer_Deprecated_UpdateHumanUser_Permission(t *testing.T) { { name: "org, error", args: args{ - CTX, + OrgCTX, &user.UpdateHumanUserRequest{ UserId: newUserID, Username: gu.Ptr(integration.Username()), @@ -1336,7 +1306,7 @@ func TestServer_LockUser(t *testing.T) { { name: "lock, not existing", args: args{ - CTX, + OrgCTX, &user.LockUserRequest{ UserId: "notexisting", }, @@ -1358,10 +1328,10 @@ func TestServer_LockUser(t *testing.T) { { name: "lock, ok", args: args{ - CTX, + OrgCTX, &user.LockUserRequest{}, func(request *user.LockUserRequest) error { - resp := Instance.CreateHumanUser(CTX) + resp := Instance.CreateHumanUser(OrgCTX) request.UserId = resp.GetUserId() return nil }, @@ -1376,10 +1346,10 @@ func TestServer_LockUser(t *testing.T) { { name: "lock machine, ok", args: args{ - CTX, + OrgCTX, &user.LockUserRequest{}, func(request *user.LockUserRequest) error { - resp := Instance.CreateMachineUser(CTX) + resp := Instance.CreateMachineUser(OrgCTX) request.UserId = resp.GetUserId() return nil }, @@ -1394,12 +1364,12 @@ func TestServer_LockUser(t *testing.T) { { name: "lock, already locked", args: args{ - CTX, + OrgCTX, &user.LockUserRequest{}, func(request *user.LockUserRequest) error { - resp := Instance.CreateHumanUser(CTX) + resp := Instance.CreateHumanUser(OrgCTX) request.UserId = resp.GetUserId() - _, err := Client.LockUser(CTX, &user.LockUserRequest{ + _, err := Client.LockUser(OrgCTX, &user.LockUserRequest{ UserId: resp.GetUserId(), }) return err @@ -1410,12 +1380,12 @@ func TestServer_LockUser(t *testing.T) { { name: "lock machine, already locked", args: args{ - CTX, + OrgCTX, &user.LockUserRequest{}, func(request *user.LockUserRequest) error { - resp := Instance.CreateMachineUser(CTX) + resp := Instance.CreateMachineUser(OrgCTX) request.UserId = resp.GetUserId() - _, err := Client.LockUser(CTX, &user.LockUserRequest{ + _, err := Client.LockUser(OrgCTX, &user.LockUserRequest{ UserId: resp.GetUserId(), }) return err @@ -1455,7 +1425,7 @@ func TestServer_UnLockUser(t *testing.T) { { name: "unlock, not existing", args: args{ - CTX, + OrgCTX, &user.UnlockUserRequest{ UserId: "notexisting", }, @@ -1477,10 +1447,10 @@ func TestServer_UnLockUser(t *testing.T) { { name: "unlock, not locked", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.UnlockUserRequest{}, prepare: func(request *user.UnlockUserRequest) error { - resp := Instance.CreateHumanUser(CTX) + resp := Instance.CreateHumanUser(OrgCTX) request.UserId = resp.GetUserId() return nil }, @@ -1490,10 +1460,10 @@ func TestServer_UnLockUser(t *testing.T) { { name: "unlock machine, not locked", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.UnlockUserRequest{}, prepare: func(request *user.UnlockUserRequest) error { - resp := Instance.CreateMachineUser(CTX) + resp := Instance.CreateMachineUser(OrgCTX) request.UserId = resp.GetUserId() return nil }, @@ -1503,12 +1473,12 @@ func TestServer_UnLockUser(t *testing.T) { { name: "unlock, ok", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.UnlockUserRequest{}, prepare: func(request *user.UnlockUserRequest) error { - resp := Instance.CreateHumanUser(CTX) + resp := Instance.CreateHumanUser(OrgCTX) request.UserId = resp.GetUserId() - _, err := Client.LockUser(CTX, &user.LockUserRequest{ + _, err := Client.LockUser(OrgCTX, &user.LockUserRequest{ UserId: resp.GetUserId(), }) return err @@ -1524,12 +1494,12 @@ func TestServer_UnLockUser(t *testing.T) { { name: "unlock machine, ok", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.UnlockUserRequest{}, prepare: func(request *user.UnlockUserRequest) error { - resp := Instance.CreateMachineUser(CTX) + resp := Instance.CreateMachineUser(OrgCTX) request.UserId = resp.GetUserId() - _, err := Client.LockUser(CTX, &user.LockUserRequest{ + _, err := Client.LockUser(OrgCTX, &user.LockUserRequest{ UserId: resp.GetUserId(), }) return err @@ -1574,7 +1544,7 @@ func TestServer_DeactivateUser(t *testing.T) { { name: "deactivate, not existing", args: args{ - CTX, + OrgCTX, &user.DeactivateUserRequest{ UserId: "notexisting", }, @@ -1596,10 +1566,10 @@ func TestServer_DeactivateUser(t *testing.T) { { name: "deactivate, ok", args: args{ - CTX, + OrgCTX, &user.DeactivateUserRequest{}, func(request *user.DeactivateUserRequest) error { - resp := Instance.CreateHumanUser(CTX) + resp := Instance.CreateHumanUser(OrgCTX) request.UserId = resp.GetUserId() return nil }, @@ -1614,10 +1584,10 @@ func TestServer_DeactivateUser(t *testing.T) { { name: "deactivate machine, ok", args: args{ - CTX, + OrgCTX, &user.DeactivateUserRequest{}, func(request *user.DeactivateUserRequest) error { - resp := Instance.CreateMachineUser(CTX) + resp := Instance.CreateMachineUser(OrgCTX) request.UserId = resp.GetUserId() return nil }, @@ -1632,12 +1602,12 @@ func TestServer_DeactivateUser(t *testing.T) { { name: "deactivate, already deactivated", args: args{ - CTX, + OrgCTX, &user.DeactivateUserRequest{}, func(request *user.DeactivateUserRequest) error { - resp := Instance.CreateHumanUser(CTX) + resp := Instance.CreateHumanUser(OrgCTX) request.UserId = resp.GetUserId() - _, err := Client.DeactivateUser(CTX, &user.DeactivateUserRequest{ + _, err := Client.DeactivateUser(OrgCTX, &user.DeactivateUserRequest{ UserId: resp.GetUserId(), }) return err @@ -1648,12 +1618,12 @@ func TestServer_DeactivateUser(t *testing.T) { { name: "deactivate machine, already deactivated", args: args{ - CTX, + OrgCTX, &user.DeactivateUserRequest{}, func(request *user.DeactivateUserRequest) error { - resp := Instance.CreateMachineUser(CTX) + resp := Instance.CreateMachineUser(OrgCTX) request.UserId = resp.GetUserId() - _, err := Client.DeactivateUser(CTX, &user.DeactivateUserRequest{ + _, err := Client.DeactivateUser(OrgCTX, &user.DeactivateUserRequest{ UserId: resp.GetUserId(), }) return err @@ -1694,7 +1664,7 @@ func TestServer_ReactivateUser(t *testing.T) { { name: "reactivate, not existing", args: args{ - CTX, + OrgCTX, &user.ReactivateUserRequest{ UserId: "notexisting", }, @@ -1716,10 +1686,10 @@ func TestServer_ReactivateUser(t *testing.T) { { name: "reactivate, not deactivated", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.ReactivateUserRequest{}, prepare: func(request *user.ReactivateUserRequest) error { - resp := Instance.CreateHumanUser(CTX) + resp := Instance.CreateHumanUser(OrgCTX) request.UserId = resp.GetUserId() return nil }, @@ -1729,10 +1699,10 @@ func TestServer_ReactivateUser(t *testing.T) { { name: "reactivate machine, not deactivated", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.ReactivateUserRequest{}, prepare: func(request *user.ReactivateUserRequest) error { - resp := Instance.CreateMachineUser(CTX) + resp := Instance.CreateMachineUser(OrgCTX) request.UserId = resp.GetUserId() return nil }, @@ -1742,12 +1712,12 @@ func TestServer_ReactivateUser(t *testing.T) { { name: "reactivate, ok", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.ReactivateUserRequest{}, prepare: func(request *user.ReactivateUserRequest) error { - resp := Instance.CreateHumanUser(CTX) + resp := Instance.CreateHumanUser(OrgCTX) request.UserId = resp.GetUserId() - _, err := Client.DeactivateUser(CTX, &user.DeactivateUserRequest{ + _, err := Client.DeactivateUser(OrgCTX, &user.DeactivateUserRequest{ UserId: resp.GetUserId(), }) return err @@ -1763,12 +1733,12 @@ func TestServer_ReactivateUser(t *testing.T) { { name: "reactivate machine, ok", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.ReactivateUserRequest{}, prepare: func(request *user.ReactivateUserRequest) error { - resp := Instance.CreateMachineUser(CTX) + resp := Instance.CreateMachineUser(OrgCTX) request.UserId = resp.GetUserId() - _, err := Client.DeactivateUser(CTX, &user.DeactivateUserRequest{ + _, err := Client.DeactivateUser(OrgCTX, &user.DeactivateUserRequest{ UserId: resp.GetUserId(), }) return err @@ -1799,7 +1769,7 @@ func TestServer_ReactivateUser(t *testing.T) { } func TestServer_DeleteUser(t *testing.T) { - projectResp := Instance.CreateProject(CTX, t, Instance.DefaultOrg.GetId(), integration.ProjectName(), false, false) + projectResp := Instance.CreateProject(OrgCTX, t, Instance.DefaultOrg.GetId(), integration.ProjectName(), false, false) type args struct { req *user.DeleteUserRequest @@ -1817,7 +1787,7 @@ func TestServer_DeleteUser(t *testing.T) { &user.DeleteUserRequest{ UserId: "notexisting", }, - func(*testing.T, *user.DeleteUserRequest) context.Context { return CTX }, + func(*testing.T, *user.DeleteUserRequest) context.Context { return OrgCTX }, }, wantErr: true, }, @@ -1826,9 +1796,9 @@ func TestServer_DeleteUser(t *testing.T) { args: args{ req: &user.DeleteUserRequest{}, prepare: func(_ *testing.T, request *user.DeleteUserRequest) context.Context { - resp := Instance.CreateHumanUser(CTX) + resp := Instance.CreateHumanUser(OrgCTX) request.UserId = resp.GetUserId() - return CTX + return OrgCTX }, }, want: &user.DeleteUserResponse{ @@ -1843,9 +1813,9 @@ func TestServer_DeleteUser(t *testing.T) { args: args{ req: &user.DeleteUserRequest{}, prepare: func(_ *testing.T, request *user.DeleteUserRequest) context.Context { - resp := Instance.CreateMachineUser(CTX) + resp := Instance.CreateMachineUser(OrgCTX) request.UserId = resp.GetUserId() - return CTX + return OrgCTX }, }, want: &user.DeleteUserResponse{ @@ -1860,12 +1830,12 @@ func TestServer_DeleteUser(t *testing.T) { args: args{ req: &user.DeleteUserRequest{}, prepare: func(_ *testing.T, request *user.DeleteUserRequest) context.Context { - resp := Instance.CreateHumanUser(CTX) + resp := Instance.CreateHumanUser(OrgCTX) request.UserId = resp.GetUserId() - Instance.CreateProjectUserGrant(t, CTX, Instance.DefaultOrg.GetId(), projectResp.GetId(), request.UserId) - Instance.CreateProjectMembership(t, CTX, projectResp.GetId(), request.UserId) - Instance.CreateOrgMembership(t, CTX, Instance.DefaultOrg.Id, request.UserId) - return CTX + Instance.CreateProjectUserGrant(t, OrgCTX, Instance.DefaultOrg.GetId(), projectResp.GetId(), request.UserId) + Instance.CreateProjectMembership(t, OrgCTX, projectResp.GetId(), request.UserId) + Instance.CreateOrgMembership(t, OrgCTX, Instance.DefaultOrg.Id, request.UserId) + return OrgCTX }, }, want: &user.DeleteUserResponse{ @@ -1880,7 +1850,7 @@ func TestServer_DeleteUser(t *testing.T) { args: args{ req: &user.DeleteUserRequest{}, prepare: func(t *testing.T, request *user.DeleteUserRequest) context.Context { - removeUser, err := Client.CreateUser(CTX, &user.CreateUserRequest{ + removeUser, err := Client.CreateUser(OrgCTX, &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, UserType: &user.CreateUserRequest_Human_{ Human: &user.CreateUserRequest_Human{ @@ -1898,10 +1868,10 @@ func TestServer_DeleteUser(t *testing.T) { require.NoError(t, err) // allow self management incl. deletion - Instance.CreateOrgMembership(t, CTX, Instance.DefaultOrg.Id, removeUser.Id, "ORG_USER_SELF_MANAGER") + Instance.CreateOrgMembership(t, OrgCTX, Instance.DefaultOrg.Id, removeUser.Id, "ORG_USER_SELF_MANAGER") request.UserId = removeUser.Id - Instance.RegisterUserPasskey(CTX, removeUser.Id) + Instance.RegisterUserPasskey(OrgCTX, removeUser.Id) token := createVerifiedWebAuthNSession(LoginCTX, t, removeUser.Id) return integration.WithAuthorizationToken(UserCTX, token) }, @@ -1930,7 +1900,7 @@ func TestServer_DeleteUser(t *testing.T) { func TestServer_StartIdentityProviderIntent(t *testing.T) { idpResp := Instance.AddGenericOAuthProvider(IamCTX, Instance.DefaultOrg.Id) - orgIdpResp := Instance.AddOrgGenericOAuthProvider(CTX, Instance.DefaultOrg.Id) + orgIdpResp := Instance.AddOrgGenericOAuthProvider(OrgCTX, Instance.DefaultOrg.Id) orgResp := Instance.CreateOrganization(IamCTX, integration.OrganizationName(), integration.Email()) notDefaultOrgIdpResp := Instance.AddOrgGenericOAuthProvider(IamCTX, orgResp.OrganizationId) samlIdpID := Instance.AddSAMLProvider(IamCTX) @@ -1957,7 +1927,7 @@ func TestServer_StartIdentityProviderIntent(t *testing.T) { { name: "missing urls", args: args{ - CTX, + OrgCTX, &user.StartIdentityProviderIntentRequest{ IdpId: idpResp.Id, }, @@ -1967,7 +1937,7 @@ func TestServer_StartIdentityProviderIntent(t *testing.T) { { name: "next step oauth auth url", args: args{ - CTX, + OrgCTX, &user.StartIdentityProviderIntentRequest{ IdpId: idpResp.Id, Content: &user.StartIdentityProviderIntentRequest_Urls{ @@ -1998,7 +1968,7 @@ func TestServer_StartIdentityProviderIntent(t *testing.T) { { name: "next step oauth auth url, default org", args: args{ - CTX, + OrgCTX, &user.StartIdentityProviderIntentRequest{ IdpId: orgIdpResp.Id, Content: &user.StartIdentityProviderIntentRequest_Urls{ @@ -2029,7 +1999,7 @@ func TestServer_StartIdentityProviderIntent(t *testing.T) { { name: "next step oauth auth url, default org", args: args{ - CTX, + OrgCTX, &user.StartIdentityProviderIntentRequest{ IdpId: notDefaultOrgIdpResp.Id, Content: &user.StartIdentityProviderIntentRequest_Urls{ @@ -2060,7 +2030,7 @@ func TestServer_StartIdentityProviderIntent(t *testing.T) { { name: "next step oauth auth url org", args: args{ - CTX, + OrgCTX, &user.StartIdentityProviderIntentRequest{ IdpId: orgIdpResp.Id, Content: &user.StartIdentityProviderIntentRequest_Urls{ @@ -2091,7 +2061,7 @@ func TestServer_StartIdentityProviderIntent(t *testing.T) { { name: "next step saml default", args: args{ - CTX, + OrgCTX, &user.StartIdentityProviderIntentRequest{ IdpId: samlIdpID, Content: &user.StartIdentityProviderIntentRequest_Urls{ @@ -2115,7 +2085,7 @@ func TestServer_StartIdentityProviderIntent(t *testing.T) { { name: "next step saml auth url", args: args{ - CTX, + OrgCTX, &user.StartIdentityProviderIntentRequest{ IdpId: samlRedirectIdpID, Content: &user.StartIdentityProviderIntentRequest_Urls{ @@ -2139,7 +2109,7 @@ func TestServer_StartIdentityProviderIntent(t *testing.T) { { name: "next step saml form", args: args{ - CTX, + OrgCTX, &user.StartIdentityProviderIntentRequest{ IdpId: samlPostIdpID, Content: &user.StartIdentityProviderIntentRequest_Urls{ @@ -2164,7 +2134,7 @@ func TestServer_StartIdentityProviderIntent(t *testing.T) { { name: "next step jwt idp", args: args{ - CTX, + OrgCTX, &user.StartIdentityProviderIntentRequest{ IdpId: jwtIdPID, Content: &user.StartIdentityProviderIntentRequest_Urls{ @@ -2246,7 +2216,7 @@ func TestServer_RetrieveIdentityProviderIntent(t *testing.T) { samlIdpID := Instance.AddSAMLPostProvider(IamCTX) ldapIdpID := Instance.AddLDAPProvider(IamCTX) jwtIdPID := Instance.AddJWTProvider(IamCTX) - authURL, err := url.Parse(Instance.CreateIntent(CTX, oauthIdpID).GetAuthUrl()) + authURL, err := url.Parse(Instance.CreateIntent(OrgCTX, oauthIdpID).GetAuthUrl()) require.NoError(t, err) intentID := authURL.Query().Get("state") expiry := time.Now().Add(1 * time.Hour) @@ -2307,7 +2277,7 @@ func TestServer_RetrieveIdentityProviderIntent(t *testing.T) { { name: "failed intent", args: args{ - CTX, + OrgCTX, &user.RetrieveIdentityProviderIntentRequest{ IdpIntentId: intentID, IdpIntentToken: "", @@ -2318,7 +2288,7 @@ func TestServer_RetrieveIdentityProviderIntent(t *testing.T) { { name: "wrong token", args: args{ - CTX, + OrgCTX, &user.RetrieveIdentityProviderIntentRequest{ IdpIntentId: successfulID, IdpIntentToken: "wrong token", @@ -2329,7 +2299,7 @@ func TestServer_RetrieveIdentityProviderIntent(t *testing.T) { { name: "retrieve successful oauth intent", args: args{ - CTX, + OrgCTX, &user.RetrieveIdentityProviderIntentRequest{ IdpIntentId: successfulID, IdpIntentToken: token, @@ -2379,7 +2349,7 @@ func TestServer_RetrieveIdentityProviderIntent(t *testing.T) { { name: "retrieve successful intent with linked user", args: args{ - CTX, + OrgCTX, &user.RetrieveIdentityProviderIntentRequest{ IdpIntentId: successfulWithUserID, IdpIntentToken: withUsertoken, @@ -2419,7 +2389,7 @@ func TestServer_RetrieveIdentityProviderIntent(t *testing.T) { { name: "retrieve successful expired intent", args: args{ - CTX, + OrgCTX, &user.RetrieveIdentityProviderIntentRequest{ IdpIntentId: successfulExpiredID, IdpIntentToken: expiredToken, @@ -2430,7 +2400,7 @@ func TestServer_RetrieveIdentityProviderIntent(t *testing.T) { { name: "retrieve successful consumed intent", args: args{ - CTX, + OrgCTX, &user.RetrieveIdentityProviderIntentRequest{ IdpIntentId: successfulConsumedID, IdpIntentToken: consumedToken, @@ -2441,7 +2411,7 @@ func TestServer_RetrieveIdentityProviderIntent(t *testing.T) { { name: "retrieve successful azure AD intent", args: args{ - CTX, + OrgCTX, &user.RetrieveIdentityProviderIntentRequest{ IdpIntentId: azureADSuccessful, IdpIntentToken: azureADToken, @@ -2498,7 +2468,7 @@ func TestServer_RetrieveIdentityProviderIntent(t *testing.T) { { name: "retrieve successful azure AD intent with user ID", args: args{ - CTX, + OrgCTX, &user.RetrieveIdentityProviderIntentRequest{ IdpIntentId: azureADSuccessfulWithUserID, IdpIntentToken: azureADWithUserIDToken, @@ -2540,7 +2510,7 @@ func TestServer_RetrieveIdentityProviderIntent(t *testing.T) { { name: "retrieve successful oidc intent", args: args{ - CTX, + OrgCTX, &user.RetrieveIdentityProviderIntentRequest{ IdpIntentId: oidcSuccessful, IdpIntentToken: oidcToken, @@ -2590,7 +2560,7 @@ func TestServer_RetrieveIdentityProviderIntent(t *testing.T) { { name: "retrieve successful oidc intent with linked user", args: args{ - CTX, + OrgCTX, &user.RetrieveIdentityProviderIntentRequest{ IdpIntentId: oidcSuccessfulWithUserID, IdpIntentToken: oidcWithUserIDToken, @@ -2628,7 +2598,7 @@ func TestServer_RetrieveIdentityProviderIntent(t *testing.T) { { name: "retrieve successful ldap intent", args: args{ - CTX, + OrgCTX, &user.RetrieveIdentityProviderIntentRequest{ IdpIntentId: ldapSuccessfulID, IdpIntentToken: ldapToken, @@ -2685,7 +2655,7 @@ func TestServer_RetrieveIdentityProviderIntent(t *testing.T) { { name: "retrieve successful ldap intent with linked user", args: args{ - CTX, + OrgCTX, &user.RetrieveIdentityProviderIntentRequest{ IdpIntentId: ldapSuccessfulWithUserID, IdpIntentToken: ldapWithUserToken, @@ -2731,7 +2701,7 @@ func TestServer_RetrieveIdentityProviderIntent(t *testing.T) { { name: "retrieve successful saml intent", args: args{ - CTX, + OrgCTX, &user.RetrieveIdentityProviderIntentRequest{ IdpIntentId: samlSuccessfulID, IdpIntentToken: samlToken, @@ -2780,7 +2750,7 @@ func TestServer_RetrieveIdentityProviderIntent(t *testing.T) { { name: "retrieve successful saml intent with linked user", args: args{ - CTX, + OrgCTX, &user.RetrieveIdentityProviderIntentRequest{ IdpIntentId: samlSuccessfulWithUserID, IdpIntentToken: samlWithUserToken, @@ -2819,7 +2789,7 @@ func TestServer_RetrieveIdentityProviderIntent(t *testing.T) { { name: "retrieve successful jwt intent", args: args{ - CTX, + OrgCTX, &user.RetrieveIdentityProviderIntentRequest{ IdpIntentId: jwtSuccessfulID, IdpIntentToken: jwtToken, @@ -2865,7 +2835,7 @@ func TestServer_RetrieveIdentityProviderIntent(t *testing.T) { { name: "retrieve successful jwt intent with linked user", args: args{ - CTX, + OrgCTX, &user.RetrieveIdentityProviderIntentRequest{ IdpIntentId: jwtSuccessfulWithUserID, IdpIntentToken: jwtWithUserToken, @@ -2914,10 +2884,10 @@ func TestServer_RetrieveIdentityProviderIntent(t *testing.T) { } func ctxFromNewUserWithRegisteredPasswordlessLegacy(t *testing.T) (context.Context, string, *auth.AddMyPasswordlessResponse) { - userID := Instance.CreateHumanUser(CTX).GetUserId() - Instance.RegisterUserPasskey(CTX, userID) + userID := Instance.CreateHumanUser(OrgCTX).GetUserId() + Instance.RegisterUserPasskey(OrgCTX, userID) sessionToken := createVerifiedWebAuthNSession(LoginCTX, t, userID) - ctx := integration.WithAuthorizationToken(CTX, sessionToken) + ctx := integration.WithAuthorizationToken(OrgCTX, sessionToken) pkr, err := Instance.Client.Auth.AddMyPasswordless(ctx, &auth.AddMyPasswordlessRequest{}) require.NoError(t, err) @@ -2942,38 +2912,38 @@ func ctxFromNewUserWithVerifiedPasswordlessLegacy(t *testing.T) (context.Context } func TestServer_ListAuthenticationMethodTypes(t *testing.T) { - userIDWithoutAuth := Instance.CreateHumanUser(CTX).GetUserId() + userIDWithoutAuth := Instance.CreateHumanUser(OrgCTX).GetUserId() - userIDWithPasskey := Instance.CreateHumanUser(CTX).GetUserId() - Instance.RegisterUserPasskey(CTX, userIDWithPasskey) + userIDWithPasskey := Instance.CreateHumanUser(OrgCTX).GetUserId() + Instance.RegisterUserPasskey(OrgCTX, userIDWithPasskey) - userMultipleAuth := Instance.CreateHumanUser(CTX).GetUserId() - Instance.RegisterUserPasskey(CTX, userMultipleAuth) - provider, err := Instance.Client.Mgmt.AddGenericOIDCProvider(CTX, &mgmt.AddGenericOIDCProviderRequest{ + userMultipleAuth := Instance.CreateHumanUser(OrgCTX).GetUserId() + Instance.RegisterUserPasskey(OrgCTX, userMultipleAuth) + provider, err := Instance.Client.Mgmt.AddGenericOIDCProvider(OrgCTX, &mgmt.AddGenericOIDCProviderRequest{ Name: "ListAuthenticationMethodTypes", Issuer: "https://example.com", ClientId: "client_id", ClientSecret: "client_secret", }) require.NoError(t, err) - _, err = Instance.Client.Mgmt.AddCustomLoginPolicy(CTX, &mgmt.AddCustomLoginPolicyRequest{}) + _, err = Instance.Client.Mgmt.AddCustomLoginPolicy(OrgCTX, &mgmt.AddCustomLoginPolicyRequest{}) require.Condition(t, func() bool { code := status.Convert(err).Code() return code == codes.AlreadyExists || code == codes.OK }) - _, err = Instance.Client.Mgmt.AddIDPToLoginPolicy(CTX, &mgmt.AddIDPToLoginPolicyRequest{ + _, err = Instance.Client.Mgmt.AddIDPToLoginPolicy(OrgCTX, &mgmt.AddIDPToLoginPolicyRequest{ IdpId: provider.GetId(), OwnerType: idp.IDPOwnerType_IDP_OWNER_TYPE_ORG, }) require.NoError(t, err) - _, err = Instance.Client.UserV2.AddIDPLink(CTX, &user.AddIDPLinkRequest{UserId: userMultipleAuth, IdpLink: &user.IDPLink{ + _, err = Instance.Client.UserV2.AddIDPLink(OrgCTX, &user.AddIDPLinkRequest{UserId: userMultipleAuth, IdpLink: &user.IDPLink{ IdpId: provider.GetId(), UserId: "external-id", UserName: "displayName", }}) require.NoError(t, err) // This should not remove the user IDP links - _, err = Instance.Client.Mgmt.RemoveIDPFromLoginPolicy(CTX, &mgmt.RemoveIDPFromLoginPolicyRequest{ + _, err = Instance.Client.Mgmt.RemoveIDPFromLoginPolicy(OrgCTX, &mgmt.RemoveIDPFromLoginPolicyRequest{ IdpId: provider.GetId(), }) require.NoError(t, err) @@ -2993,7 +2963,7 @@ func TestServer_ListAuthenticationMethodTypes(t *testing.T) { { name: "no auth", args: args{ - CTX, + OrgCTX, &user.ListAuthenticationMethodTypesRequest{ UserId: userIDWithoutAuth, }, @@ -3007,7 +2977,7 @@ func TestServer_ListAuthenticationMethodTypes(t *testing.T) { { name: "with auth (passkey)", args: args{ - CTX, + OrgCTX, &user.ListAuthenticationMethodTypesRequest{ UserId: userIDWithPasskey, }, @@ -3024,7 +2994,7 @@ func TestServer_ListAuthenticationMethodTypes(t *testing.T) { { name: "with auth (passkey) with domain", args: args{ - CTX, + OrgCTX, &user.ListAuthenticationMethodTypesRequest{ UserId: userIDWithPasskey, DomainQuery: &user.DomainQuery{ @@ -3044,7 +3014,7 @@ func TestServer_ListAuthenticationMethodTypes(t *testing.T) { { name: "with auth (passkey) with wrong domain", args: args{ - CTX, + OrgCTX, &user.ListAuthenticationMethodTypesRequest{ UserId: userIDWithPasskey, DomainQuery: &user.DomainQuery{ @@ -3061,7 +3031,7 @@ func TestServer_ListAuthenticationMethodTypes(t *testing.T) { { name: "with auth (passkey) with legacy", args: args{ - CTX, + OrgCTX, &user.ListAuthenticationMethodTypesRequest{ UserId: userLegacyID, DomainQuery: &user.DomainQuery{ @@ -3078,7 +3048,7 @@ func TestServer_ListAuthenticationMethodTypes(t *testing.T) { { name: "with auth (passkey) with legacy included", args: args{ - CTX, + OrgCTX, &user.ListAuthenticationMethodTypesRequest{ UserId: userLegacyID, DomainQuery: &user.DomainQuery{ @@ -3099,7 +3069,7 @@ func TestServer_ListAuthenticationMethodTypes(t *testing.T) { { name: "multiple auth", args: args{ - CTX, + OrgCTX, &user.ListAuthenticationMethodTypesRequest{ UserId: userMultipleAuth, }, @@ -3117,7 +3087,7 @@ func TestServer_ListAuthenticationMethodTypes(t *testing.T) { { name: "multiple auth with domain", args: args{ - CTX, + OrgCTX, &user.ListAuthenticationMethodTypesRequest{ UserId: userMultipleAuth, DomainQuery: &user.DomainQuery{ @@ -3138,7 +3108,7 @@ func TestServer_ListAuthenticationMethodTypes(t *testing.T) { { name: "multiple auth with wrong domain", args: args{ - CTX, + OrgCTX, &user.ListAuthenticationMethodTypesRequest{ UserId: userMultipleAuth, DomainQuery: &user.DomainQuery{ @@ -3188,10 +3158,10 @@ func TestServer_ListAuthenticationFactors(t *testing.T) { Result: nil, }, dep: func(args *user.ListAuthenticationFactorsRequest, want *user.ListAuthenticationFactorsResponse) { - userIDWithoutAuth := Instance.CreateHumanUser(CTX).GetUserId() + userIDWithoutAuth := Instance.CreateHumanUser(OrgCTX).GetUserId() args.UserId = userIDWithoutAuth }, - ctx: CTX, + ctx: OrgCTX, }, { name: "with u2f", @@ -3204,8 +3174,8 @@ func TestServer_ListAuthenticationFactors(t *testing.T) { }, }, dep: func(args *user.ListAuthenticationFactorsRequest, want *user.ListAuthenticationFactorsResponse) { - userWithU2F := Instance.CreateHumanUser(CTX).GetUserId() - U2FId := Instance.RegisterUserU2F(CTX, userWithU2F) + userWithU2F := Instance.CreateHumanUser(OrgCTX).GetUserId() + U2FId := Instance.RegisterUserU2F(OrgCTX, userWithU2F) args.UserId = userWithU2F want.Result[0].Type = &user.AuthFactor_U2F{ @@ -3215,7 +3185,7 @@ func TestServer_ListAuthenticationFactors(t *testing.T) { }, } }, - ctx: CTX, + ctx: OrgCTX, }, { name: "with totp, u2f", @@ -3234,8 +3204,8 @@ func TestServer_ListAuthenticationFactors(t *testing.T) { }, }, dep: func(args *user.ListAuthenticationFactorsRequest, want *user.ListAuthenticationFactorsResponse) { - userWithTOTP := Instance.CreateHumanUserWithTOTP(CTX, "secret").GetUserId() - U2FIdWithTOTP := Instance.RegisterUserU2F(CTX, userWithTOTP) + userWithTOTP := Instance.CreateHumanUserWithTOTP(OrgCTX, "secret").GetUserId() + U2FIdWithTOTP := Instance.RegisterUserU2F(OrgCTX, userWithTOTP) args.UserId = userWithTOTP want.Result[1].Type = &user.AuthFactor_U2F{ @@ -3245,7 +3215,7 @@ func TestServer_ListAuthenticationFactors(t *testing.T) { }, } }, - ctx: CTX, + ctx: OrgCTX, }, { name: "with totp, u2f filtered", @@ -3260,8 +3230,8 @@ func TestServer_ListAuthenticationFactors(t *testing.T) { }, }, dep: func(args *user.ListAuthenticationFactorsRequest, want *user.ListAuthenticationFactorsResponse) { - userWithTOTP := Instance.CreateHumanUserWithTOTP(CTX, "secret").GetUserId() - U2FIdWithTOTP := Instance.RegisterUserU2F(CTX, userWithTOTP) + userWithTOTP := Instance.CreateHumanUserWithTOTP(OrgCTX, "secret").GetUserId() + U2FIdWithTOTP := Instance.RegisterUserU2F(OrgCTX, userWithTOTP) args.UserId = userWithTOTP want.Result[0].Type = &user.AuthFactor_U2F{ @@ -3271,7 +3241,7 @@ func TestServer_ListAuthenticationFactors(t *testing.T) { }, } }, - ctx: CTX, + ctx: OrgCTX, }, { name: "with sms", @@ -3287,12 +3257,12 @@ func TestServer_ListAuthenticationFactors(t *testing.T) { }, }, dep: func(args *user.ListAuthenticationFactorsRequest, want *user.ListAuthenticationFactorsResponse) { - userWithSMS := Instance.CreateHumanUserVerified(CTX, Instance.DefaultOrg.GetId(), integration.Email(), integration.Phone()).GetUserId() - Instance.RegisterUserOTPSMS(CTX, userWithSMS) + userWithSMS := Instance.CreateHumanUserVerified(OrgCTX, Instance.DefaultOrg.GetId(), integration.Email(), integration.Phone()).GetUserId() + Instance.RegisterUserOTPSMS(OrgCTX, userWithSMS) args.UserId = userWithSMS }, - ctx: CTX, + ctx: OrgCTX, }, { name: "with email", @@ -3308,12 +3278,12 @@ func TestServer_ListAuthenticationFactors(t *testing.T) { }, }, dep: func(args *user.ListAuthenticationFactorsRequest, want *user.ListAuthenticationFactorsResponse) { - userWithEmail := Instance.CreateHumanUserVerified(CTX, Instance.DefaultOrg.GetId(), integration.Email(), integration.Phone()).GetUserId() - Instance.RegisterUserOTPEmail(CTX, userWithEmail) + userWithEmail := Instance.CreateHumanUserVerified(OrgCTX, Instance.DefaultOrg.GetId(), integration.Email(), integration.Phone()).GetUserId() + Instance.RegisterUserOTPEmail(OrgCTX, userWithEmail) args.UserId = userWithEmail }, - ctx: CTX, + ctx: OrgCTX, }, { name: "with not ready u2f", @@ -3322,8 +3292,8 @@ func TestServer_ListAuthenticationFactors(t *testing.T) { Result: []*user.AuthFactor{}, }, dep: func(args *user.ListAuthenticationFactorsRequest, want *user.ListAuthenticationFactorsResponse) { - userWithNotReadyU2F := Instance.CreateHumanUser(CTX).GetUserId() - _, err := Instance.Client.UserV2.RegisterU2F(CTX, &user.RegisterU2FRequest{ + userWithNotReadyU2F := Instance.CreateHumanUser(OrgCTX).GetUserId() + _, err := Instance.Client.UserV2.RegisterU2F(OrgCTX, &user.RegisterU2FRequest{ UserId: userWithNotReadyU2F, Domain: Instance.Domain, }) @@ -3331,7 +3301,7 @@ func TestServer_ListAuthenticationFactors(t *testing.T) { args.UserId = userWithNotReadyU2F }, - ctx: CTX, + ctx: OrgCTX, }, { name: "with not ready u2f state filtered", @@ -3346,8 +3316,8 @@ func TestServer_ListAuthenticationFactors(t *testing.T) { }, }, dep: func(args *user.ListAuthenticationFactorsRequest, want *user.ListAuthenticationFactorsResponse) { - userWithNotReadyU2F := Instance.CreateHumanUser(CTX).GetUserId() - U2FNotReady, err := Instance.Client.UserV2.RegisterU2F(CTX, &user.RegisterU2FRequest{ + userWithNotReadyU2F := Instance.CreateHumanUser(OrgCTX).GetUserId() + U2FNotReady, err := Instance.Client.UserV2.RegisterU2F(OrgCTX, &user.RegisterU2FRequest{ UserId: userWithNotReadyU2F, Domain: Instance.Domain, }) @@ -3361,21 +3331,21 @@ func TestServer_ListAuthenticationFactors(t *testing.T) { }, } }, - ctx: CTX, + ctx: OrgCTX, }, { name: "with no userId", args: &user.ListAuthenticationFactorsRequest{ UserId: "", }, - ctx: CTX, + ctx: OrgCTX, wantErr: true, }, { name: "with no permission", args: &user.ListAuthenticationFactorsRequest{}, dep: func(args *user.ListAuthenticationFactorsRequest, want *user.ListAuthenticationFactorsResponse) { - userWithTOTP := Instance.CreateHumanUserWithTOTP(CTX, "totp").GetUserId() + userWithTOTP := Instance.CreateHumanUserWithTOTP(OrgCTX, "totp").GetUserId() args.UserId = userWithTOTP }, @@ -3388,7 +3358,7 @@ func TestServer_ListAuthenticationFactors(t *testing.T) { UserId: "unknown", }, want: &user.ListAuthenticationFactorsResponse{}, - ctx: CTX, + ctx: OrgCTX, }, } for _, tt := range tests { @@ -3397,7 +3367,7 @@ func TestServer_ListAuthenticationFactors(t *testing.T) { tt.dep(tt.args, tt.want) } - retryDuration, tick := integration.WaitForAndTickWithMaxDuration(CTX, time.Minute) + retryDuration, tick := integration.WaitForAndTickWithMaxDuration(OrgCTX, time.Minute) require.EventuallyWithT(t, func(ttt *assert.CollectT) { got, err := Client.ListAuthenticationFactors(tt.ctx, tt.args) if tt.wantErr { @@ -3427,7 +3397,7 @@ func TestServer_CreateInviteCode(t *testing.T) { { name: "create, not existing", args: args{ - CTX, + OrgCTX, &user.CreateInviteCodeRequest{ UserId: "notexisting", }, @@ -3438,10 +3408,10 @@ func TestServer_CreateInviteCode(t *testing.T) { { name: "create, ok", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.CreateInviteCodeRequest{}, prepare: func(request *user.CreateInviteCodeRequest) error { - resp := Instance.CreateHumanUser(CTX) + resp := Instance.CreateHumanUser(OrgCTX) request.UserId = resp.GetUserId() return nil }, @@ -3456,7 +3426,7 @@ func TestServer_CreateInviteCode(t *testing.T) { { name: "create, invalid template", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.CreateInviteCodeRequest{ Verification: &user.CreateInviteCodeRequest_SendCode{ SendCode: &user.SendInviteCode{ @@ -3465,7 +3435,7 @@ func TestServer_CreateInviteCode(t *testing.T) { }, }, prepare: func(request *user.CreateInviteCodeRequest) error { - resp := Instance.CreateHumanUser(CTX) + resp := Instance.CreateHumanUser(OrgCTX) request.UserId = resp.GetUserId() return nil }, @@ -3475,7 +3445,7 @@ func TestServer_CreateInviteCode(t *testing.T) { { name: "create, valid template", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.CreateInviteCodeRequest{ Verification: &user.CreateInviteCodeRequest_SendCode{ SendCode: &user.SendInviteCode{ @@ -3485,7 +3455,7 @@ func TestServer_CreateInviteCode(t *testing.T) { }, }, prepare: func(request *user.CreateInviteCodeRequest) error { - resp := Instance.CreateHumanUser(CTX) + resp := Instance.CreateHumanUser(OrgCTX) request.UserId = resp.GetUserId() return nil }, @@ -3500,12 +3470,12 @@ func TestServer_CreateInviteCode(t *testing.T) { { name: "recreate", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.CreateInviteCodeRequest{}, prepare: func(request *user.CreateInviteCodeRequest) error { - resp := Instance.CreateHumanUser(CTX) + resp := Instance.CreateHumanUser(OrgCTX) request.UserId = resp.GetUserId() - _, err := Instance.Client.UserV2.CreateInviteCode(CTX, &user.CreateInviteCodeRequest{ + _, err := Instance.Client.UserV2.CreateInviteCode(OrgCTX, &user.CreateInviteCodeRequest{ UserId: resp.GetUserId(), Verification: &user.CreateInviteCodeRequest_SendCode{ SendCode: &user.SendInviteCode{ @@ -3527,14 +3497,14 @@ func TestServer_CreateInviteCode(t *testing.T) { { name: "create, return code, ok", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.CreateInviteCodeRequest{ Verification: &user.CreateInviteCodeRequest_ReturnCode{ ReturnCode: &user.ReturnInviteCode{}, }, }, prepare: func(request *user.CreateInviteCodeRequest) error { - resp := Instance.CreateHumanUser(CTX) + resp := Instance.CreateHumanUser(OrgCTX) request.UserId = resp.GetUserId() return nil }, @@ -3585,7 +3555,7 @@ func TestServer_ResendInviteCode(t *testing.T) { { name: "user not existing", args: args{ - CTX, + OrgCTX, &user.ResendInviteCodeRequest{ UserId: "notexisting", }, @@ -3596,10 +3566,10 @@ func TestServer_ResendInviteCode(t *testing.T) { { name: "code not existing", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.ResendInviteCodeRequest{}, prepare: func(request *user.ResendInviteCodeRequest) error { - resp := Instance.CreateHumanUser(CTX) + resp := Instance.CreateHumanUser(OrgCTX) request.UserId = resp.GetUserId() return nil }, @@ -3609,12 +3579,12 @@ func TestServer_ResendInviteCode(t *testing.T) { { name: "code not sent before", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.ResendInviteCodeRequest{}, prepare: func(request *user.ResendInviteCodeRequest) error { - userResp := Instance.CreateHumanUser(CTX) + userResp := Instance.CreateHumanUser(OrgCTX) request.UserId = userResp.GetUserId() - Instance.CreateInviteCode(CTX, userResp.GetUserId()) + Instance.CreateInviteCode(OrgCTX, userResp.GetUserId()) return nil }, }, @@ -3623,12 +3593,12 @@ func TestServer_ResendInviteCode(t *testing.T) { { name: "resend, ok", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.ResendInviteCodeRequest{}, prepare: func(request *user.ResendInviteCodeRequest) error { - resp := Instance.CreateHumanUser(CTX) + resp := Instance.CreateHumanUser(OrgCTX) request.UserId = resp.GetUserId() - _, err := Instance.Client.UserV2.CreateInviteCode(CTX, &user.CreateInviteCodeRequest{ + _, err := Instance.Client.UserV2.CreateInviteCode(OrgCTX, &user.CreateInviteCodeRequest{ UserId: resp.GetUserId(), }) return err @@ -3674,7 +3644,7 @@ func TestServer_VerifyInviteCode(t *testing.T) { { name: "user not existing", args: args{ - CTX, + OrgCTX, &user.VerifyInviteCodeRequest{ UserId: "notexisting", }, @@ -3685,10 +3655,10 @@ func TestServer_VerifyInviteCode(t *testing.T) { { name: "code not existing", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.VerifyInviteCodeRequest{}, prepare: func(request *user.VerifyInviteCodeRequest) error { - resp := Instance.CreateHumanUser(CTX) + resp := Instance.CreateHumanUser(OrgCTX) request.UserId = resp.GetUserId() return nil }, @@ -3698,14 +3668,14 @@ func TestServer_VerifyInviteCode(t *testing.T) { { name: "invalid code", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.VerifyInviteCodeRequest{ VerificationCode: "invalid", }, prepare: func(request *user.VerifyInviteCodeRequest) error { - userResp := Instance.CreateHumanUser(CTX) + userResp := Instance.CreateHumanUser(OrgCTX) request.UserId = userResp.GetUserId() - Instance.CreateInviteCode(CTX, userResp.GetUserId()) + Instance.CreateInviteCode(OrgCTX, userResp.GetUserId()) return nil }, }, @@ -3714,12 +3684,12 @@ func TestServer_VerifyInviteCode(t *testing.T) { { name: "verify, ok", args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.VerifyInviteCodeRequest{}, prepare: func(request *user.VerifyInviteCodeRequest) error { - userResp := Instance.CreateHumanUser(CTX) + userResp := Instance.CreateHumanUser(OrgCTX) request.UserId = userResp.GetUserId() - codeResp := Instance.CreateInviteCode(CTX, userResp.GetUserId()) + codeResp := Instance.CreateInviteCode(OrgCTX, userResp.GetUserId()) request.VerificationCode = codeResp.GetInviteCode() return nil }, @@ -3764,7 +3734,7 @@ func TestServer_HumanMFAInitSkipped(t *testing.T) { { name: "user not existing", args: args{ - CTX, + OrgCTX, &user.HumanMFAInitSkippedRequest{ UserId: "notexisting", }, @@ -3775,10 +3745,10 @@ func TestServer_HumanMFAInitSkipped(t *testing.T) { { name: "ok", args: args{ - CTX, + OrgCTX, &user.HumanMFAInitSkippedRequest{}, func(request *user.HumanMFAInitSkippedRequest) error { - resp := Instance.CreateHumanUser(CTX) + resp := Instance.CreateHumanUser(OrgCTX) request.UserId = resp.GetUserId() return nil }, @@ -3790,7 +3760,7 @@ func TestServer_HumanMFAInitSkipped(t *testing.T) { }, }, checkState: func(t *testing.T, userID string, resp *user.HumanMFAInitSkippedResponse) { - state, err := Client.GetUserByID(CTX, &user.GetUserByIDRequest{ + state, err := Client.GetUserByID(OrgCTX, &user.GetUserByIDRequest{ UserId: userID, }) require.NoError(t, err) @@ -3840,7 +3810,7 @@ func TestServer_CreateUser(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, Username: &username, @@ -3871,7 +3841,7 @@ func TestServer_CreateUser(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, Username: &username, @@ -3905,7 +3875,7 @@ func TestServer_CreateUser(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, Username: &username, @@ -3940,7 +3910,7 @@ func TestServer_CreateUser(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, Username: &username, @@ -3977,7 +3947,7 @@ func TestServer_CreateUser(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, Username: &username, @@ -4010,7 +3980,7 @@ func TestServer_CreateUser(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, Username: &username, @@ -4036,7 +4006,7 @@ func TestServer_CreateUser(t *testing.T) { username := fmt.Sprintf("donald.duck+%s", runId) return testCase{ args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, Username: &username, @@ -4060,7 +4030,7 @@ func TestServer_CreateUser(t *testing.T) { username := fmt.Sprintf("donald.duck+%s", runId) return testCase{ args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, Username: &username, @@ -4086,7 +4056,7 @@ func TestServer_CreateUser(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, Username: &username, @@ -4124,7 +4094,7 @@ func TestServer_CreateUser(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, Username: &username, @@ -4163,7 +4133,7 @@ func TestServer_CreateUser(t *testing.T) { idpResp := Instance.AddGenericOAuthProvider(IamCTX, Instance.DefaultOrg.Id) return testCase{ args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, Username: &username, @@ -4203,7 +4173,7 @@ func TestServer_CreateUser(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, Username: &username, @@ -4237,7 +4207,7 @@ func TestServer_CreateUser(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, Username: &username, @@ -4274,7 +4244,7 @@ func TestServer_CreateUser(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, Username: &username, @@ -4309,7 +4279,7 @@ func TestServer_CreateUser(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, Username: &username, @@ -4342,7 +4312,7 @@ func TestServer_CreateUser(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, UserType: &user.CreateUserRequest_Human_{ @@ -4370,7 +4340,7 @@ func TestServer_CreateUser(t *testing.T) { username := fmt.Sprintf("donald.duck+%s", runId) return testCase{ args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, Username: &username, @@ -4392,7 +4362,7 @@ func TestServer_CreateUser(t *testing.T) { testCase: func(runId string) testCase { return testCase{ args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, UserType: &user.CreateUserRequest_Machine_{ @@ -4413,7 +4383,7 @@ func TestServer_CreateUser(t *testing.T) { testCase: func(runId string) testCase { return testCase{ args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ UserId: &runId, OrganizationId: Instance.DefaultOrg.Id, @@ -4437,7 +4407,7 @@ func TestServer_CreateUser(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: "does not exist", Username: &username, @@ -4464,7 +4434,7 @@ func TestServer_CreateUser(t *testing.T) { username := fmt.Sprintf("donald.duck+%s", runId) return testCase{ args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: "does not exist", Username: &username, @@ -4533,7 +4503,7 @@ func TestServer_CreateUser_And_Compare(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, Username: &username, @@ -4562,7 +4532,7 @@ func TestServer_CreateUser_And_Compare(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, UserType: &user.CreateUserRequest_Human_{ @@ -4589,7 +4559,7 @@ func TestServer_CreateUser_And_Compare(t *testing.T) { username := fmt.Sprintf("donald.duck+%s", runId) return testCase{ args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, Username: &username, @@ -4610,7 +4580,7 @@ func TestServer_CreateUser_And_Compare(t *testing.T) { testCase: func(runId string) testCase { return testCase{ args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, UserType: &user.CreateUserRequest_Machine_{ @@ -4630,7 +4600,7 @@ func TestServer_CreateUser_And_Compare(t *testing.T) { testCase: func(runId string) testCase { return testCase{ args: args{ - ctx: CTX, + ctx: OrgCTX, req: &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, UserId: &runId, @@ -4719,7 +4689,7 @@ func TestServer_CreateUser_Permission(t *testing.T) { { name: "human org, error", args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: newOrg.GetOrganizationId(), UserType: &user.CreateUserRequest_Human_{ @@ -4789,7 +4759,7 @@ func TestServer_CreateUser_Permission(t *testing.T) { { name: "machine org, error", args: args{ - CTX, + OrgCTX, &user.CreateUserRequest{ OrganizationId: newOrg.GetOrganizationId(), UserType: &user.CreateUserRequest_Machine_{ @@ -4855,7 +4825,7 @@ func TestServer_UpdateUserTypeHuman(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - CTX, + OrgCTX, &user.UpdateUserRequest{ UserId: userId, UserType: &user.UpdateUserRequest_Human_{ @@ -4879,7 +4849,7 @@ func TestServer_UpdateUserTypeHuman(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - CTX, + OrgCTX, &user.UpdateUserRequest{ UserId: userId, UserType: &user.UpdateUserRequest_Human_{ @@ -4907,7 +4877,7 @@ func TestServer_UpdateUserTypeHuman(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - CTX, + OrgCTX, &user.UpdateUserRequest{ UserId: userId, UserType: &user.UpdateUserRequest_Human_{ @@ -4933,7 +4903,7 @@ func TestServer_UpdateUserTypeHuman(t *testing.T) { testCase: func(runId, userId string) testCase { return testCase{ args: args{ - CTX, + OrgCTX, &user.UpdateUserRequest{ UserId: userId, UserType: &user.UpdateUserRequest_Human_{ @@ -4961,7 +4931,7 @@ func TestServer_UpdateUserTypeHuman(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - CTX, + OrgCTX, &user.UpdateUserRequest{ UserId: userId, UserType: &user.UpdateUserRequest_Human_{ @@ -4987,7 +4957,7 @@ func TestServer_UpdateUserTypeHuman(t *testing.T) { testCase: func(runId, userId string) testCase { return testCase{ args: args{ - CTX, + OrgCTX, &user.UpdateUserRequest{ UserId: userId, UserType: &user.UpdateUserRequest_Human_{ @@ -5006,7 +4976,7 @@ func TestServer_UpdateUserTypeHuman(t *testing.T) { testCase: func(runId, userId string) testCase { return testCase{ args: args{ - CTX, + OrgCTX, &user.UpdateUserRequest{ UserId: userId, UserType: &user.UpdateUserRequest_Human_{ @@ -5031,7 +5001,7 @@ func TestServer_UpdateUserTypeHuman(t *testing.T) { testCase: func(runId, userId string) testCase { return testCase{ args: args{ - CTX, + OrgCTX, &user.UpdateUserRequest{ UserId: userId, UserType: &user.UpdateUserRequest_Human_{ @@ -5056,7 +5026,7 @@ func TestServer_UpdateUserTypeHuman(t *testing.T) { testCase: func(runId, userId string) testCase { return testCase{ args: args{ - CTX, + OrgCTX, &user.UpdateUserRequest{ UserId: userId, UserType: &user.UpdateUserRequest_Human_{ @@ -5081,7 +5051,7 @@ func TestServer_UpdateUserTypeHuman(t *testing.T) { testCase: func(runId, userId string) testCase { return testCase{ args: args{ - CTX, + OrgCTX, &user.UpdateUserRequest{ UserId: userId, UserType: &user.UpdateUserRequest_Machine_{ @@ -5100,7 +5070,7 @@ func TestServer_UpdateUserTypeHuman(t *testing.T) { t.Run(tt.name, func(t *testing.T) { now := time.Now() runId := fmt.Sprint(now.UnixNano() + int64(i)) - userId := Instance.CreateUserTypeHuman(CTX, integration.Email()).GetId() + userId := Instance.CreateUserTypeHuman(OrgCTX, integration.Email()).GetId() test := tt.testCase(runId, userId) got, err := Client.UpdateUser(test.args.ctx, test.args.req) if test.wantErr { @@ -5143,7 +5113,7 @@ func TestServer_UpdateUserTypeMachine(t *testing.T) { testCase: func(runId, userId string) testCase { return testCase{ args: args{ - CTX, + OrgCTX, &user.UpdateUserRequest{ UserId: userId, UserType: &user.UpdateUserRequest_Machine_{ @@ -5161,7 +5131,7 @@ func TestServer_UpdateUserTypeMachine(t *testing.T) { testCase: func(runId, userId string) testCase { return testCase{ args: args{ - CTX, + OrgCTX, &user.UpdateUserRequest{ UserId: userId, UserType: &user.UpdateUserRequest_Human_{ @@ -5182,7 +5152,7 @@ func TestServer_UpdateUserTypeMachine(t *testing.T) { t.Run(tt.name, func(t *testing.T) { now := time.Now() runId := fmt.Sprint(now.UnixNano() + int64(i)) - userId := Instance.CreateUserTypeMachine(CTX, Instance.DefaultOrg.Id).GetId() + userId := Instance.CreateUserTypeMachine(OrgCTX, Instance.DefaultOrg.Id).GetId() test := tt.testCase(runId, userId) got, err := Client.UpdateUser(test.args.ctx, test.args.req) if test.wantErr { @@ -5217,7 +5187,7 @@ func TestServer_UpdateUser_And_Compare(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - ctx: CTX, + ctx: OrgCTX, create: &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, UserId: &runId, @@ -5257,7 +5227,7 @@ func TestServer_UpdateUser_And_Compare(t *testing.T) { email := username + "@example.com" return testCase{ args: args{ - ctx: CTX, + ctx: OrgCTX, create: &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, UserId: &runId, @@ -5292,7 +5262,7 @@ func TestServer_UpdateUser_And_Compare(t *testing.T) { username := fmt.Sprintf("donald.duck+%s", runId) return testCase{ args: args{ - ctx: CTX, + ctx: OrgCTX, create: &user.CreateUserRequest{ OrganizationId: Instance.DefaultOrg.Id, UserId: &runId, @@ -5407,7 +5377,7 @@ func TestServer_UpdateUser_Permission(t *testing.T) { testCase: func() testCase { return testCase{ args: args{ - CTX, + OrgCTX, &user.UpdateUserRequest{ UserId: newHumanUserID, UserType: &user.UpdateUserRequest_Human_{ @@ -5485,7 +5455,7 @@ func TestServer_UpdateUser_Permission(t *testing.T) { testCase: func() testCase { return testCase{ args: args{ - CTX, + OrgCTX, &user.UpdateUserRequest{ UserId: newMachineUserID, UserType: &user.UpdateUserRequest_Machine_{