andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-11 00:25:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(authorizations): flaky integration tests (#11215)

Browse Source 
# Which Problems Are Solved

Flaky integration tests related to authorizations RT.

# How the Problems Are Solved

By setting the `created_at` and `updated_at` timestamps based on event
timestamps while creating an authorization.

# Additional Changes
N/A
# Additional Context

https://cloud.nx.app/runs/ICj84SxEf0/task/%40zitadel%2Fapi%3Atest-integration
This commit is contained in:
Gayathri Vijayan
2025-12-22 09:41:01 +01:00
committed by GitHub
parent 7c01deb8ed
commit af8deb1145
3 changed files with 105 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/v3/storage/database/events_testing/authorization_test.go
+22 -36
View File
@@ -43,7 +43,6 @@ func TestServer_AuthorizationReduces(t *testing.T) {
role1, role2 := "role1", "role2"
projectID := prepareProjectAndProjectRoles(t, orgID, []string{role1, role2})
//beforeCreate := time.Now()
// create authorization
createdAuthorization, err := AuthorizationClient.CreateAuthorization(CTX, &authorization_v2.CreateAuthorizationRequest{
UserId: user.UserId,
@@ -52,7 +51,6 @@ func TestServer_AuthorizationReduces(t *testing.T) {
RoleKeys: []string{role1, role2},
})
require.NoError(t, err)
//afterCreate := time.Now().Add(500 * time.Millisecond)
// add a new role to the project
role3 := "role3"
@@ -64,14 +62,12 @@ func TestServer_AuthorizationReduces(t *testing.T) {
})
require.NoError(t, err)
//beforeUpdate := time.Now()
// update roles to [role1, role2, role3]
_, err = AuthorizationClient.UpdateAuthorization(CTX, &authorization_v2.UpdateAuthorizationRequest{
updated, err := AuthorizationClient.UpdateAuthorization(CTX, &authorization_v2.UpdateAuthorizationRequest{
Id: createdAuthorization.Id,
RoleKeys: []string{role1, role2, role3},
})
require.NoError(t, err)
//afterUpdate := time.Now().Add(500 * time.Millisecond)
require.EventuallyWithT(t, func(collect *assert.CollectT) {
az, err := authorizationRepo.Get(CTX, pool, database.WithCondition(
@@ -80,8 +76,8 @@ func TestServer_AuthorizationReduces(t *testing.T) {
require.NoError(collect, err)
require.Len(collect, az.Roles, 3)
assert.Equal(collect, []string{role1, role2, role3}, az.Roles)
//assert.WithinRange(collect, az.UpdatedAt, beforeUpdate, afterUpdate)
//assert.WithinRange(collect, az.CreatedAt, beforeCreate, afterCreate)
assert.Equal(collect, createdAuthorization.GetCreationDate().AsTime(), az.CreatedAt.UTC())
assert.Equal(collect, updated.GetChangeDate().AsTime(), az.UpdatedAt.UTC())
}, retryDuration, tick, "authorization not updated within %v: %v", retryDuration, err)
})
@@ -91,22 +87,18 @@ func TestServer_AuthorizationReduces(t *testing.T) {
// prepare project and project roles
projectID := prepareProjectAndProjectRoles(t, orgID, nil)
// create authorization
//beforeCreate := time.Now()
createdAuthorization, err := AuthorizationClient.CreateAuthorization(CTX, &authorization_v2.CreateAuthorizationRequest{
UserId: user.UserId,
ProjectId: projectID,
OrganizationId: orgID,
})
require.NoError(t, err)
//afterCreate := time.Now().Add(500 * time.Millisecond)
//before := time.Now()
// deactivate authorization
_, err = AuthorizationClient.DeactivateAuthorization(CTX, &authorization_v2.DeactivateAuthorizationRequest{
deactivated, err := AuthorizationClient.DeactivateAuthorization(CTX, &authorization_v2.DeactivateAuthorizationRequest{
Id: createdAuthorization.Id,
})
require.NoError(t, err)
//after := time.Now().Add(500 * time.Millisecond)
require.EventuallyWithT(t, func(collect *assert.CollectT) {
az, err := authorizationRepo.Get(CTX, pool, database.WithCondition(
@@ -114,8 +106,8 @@ func TestServer_AuthorizationReduces(t *testing.T) {
))
require.NoError(collect, err)
assert.Equal(collect, domain.AuthorizationStateInactive, az.State)
//assert.WithinRange(collect, az.UpdatedAt, before, after)
//assert.WithinRange(collect, az.CreatedAt, beforeCreate, afterCreate)
assert.Equal(collect, createdAuthorization.GetCreationDate().AsTime(), az.CreatedAt.UTC())
assert.Equal(collect, deactivated.GetChangeDate().AsTime(), az.UpdatedAt.UTC())
}, retryDuration, tick, "authorization not deactivated within %v: %v", retryDuration, err)
})
@@ -125,14 +117,12 @@ func TestServer_AuthorizationReduces(t *testing.T) {
// prepare project
projectID := prepareProjectAndProjectRoles(t, orgID, nil)
// create authorization
//beforeCreate := time.Now()
createdAuthorization, err := AuthorizationClient.CreateAuthorization(CTX, &authorization_v2.CreateAuthorizationRequest{
UserId: user.UserId,
ProjectId: projectID,
OrganizationId: orgID,
})
require.NoError(t, err)
//afterCreate := time.Now().Add(500 * time.Millisecond)
// deactivate authorization
_, err = AuthorizationClient.DeactivateAuthorization(CTX, &authorization_v2.DeactivateAuthorizationRequest{
@@ -140,13 +130,11 @@ func TestServer_AuthorizationReduces(t *testing.T) {
})
require.NoError(t, err)
//before := time.Now()
// re-activate authorization
_, err = AuthorizationClient.ActivateAuthorization(CTX, &authorization_v2.ActivateAuthorizationRequest{
reactivated, err := AuthorizationClient.ActivateAuthorization(CTX, &authorization_v2.ActivateAuthorizationRequest{
Id: createdAuthorization.Id,
})
require.NoError(t, err)
//after := time.Now().Add(500 * time.Millisecond)
require.EventuallyWithT(t, func(collect *assert.CollectT) {
az, err := authorizationRepo.Get(CTX, pool, database.WithCondition(
@@ -154,8 +142,8 @@ func TestServer_AuthorizationReduces(t *testing.T) {
))
require.NoError(collect, err)
assert.Equal(collect, domain.AuthorizationStateActive, az.State)
//assert.WithinRange(collect, az.UpdatedAt, before, after)
//assert.WithinRange(collect, az.CreatedAt, beforeCreate, afterCreate)
assert.Equal(collect, createdAuthorization.GetCreationDate().AsTime(), az.CreatedAt.UTC())
assert.Equal(collect, reactivated.GetChangeDate().AsTime(), az.UpdatedAt.UTC())
}, retryDuration, tick, "authorization not activated within %v: %v", retryDuration, err)
})
@@ -247,13 +235,11 @@ func TestServer_AuthorizationReduces(t *testing.T) {
// create authorization with roles
createdAuthorization := createAndEnsureAuthorization(t, instanceID, orgID, user.UserId, projectID, []string{role1, role2}, retryDuration, tick)
// delete a project role
//before := time.Now()
_, err := ProjectClient.RemoveProjectRole(CTX, &project_v2beta.RemoveProjectRoleRequest{
roleRemoved, err := ProjectClient.RemoveProjectRole(CTX, &project_v2beta.RemoveProjectRoleRequest{
ProjectId: projectID,
RoleKey: role2,
})
require.NoError(t, err)
//after := time.Now()
// ensure authorization is updated
require.EventuallyWithT(t, func(collect *assert.CollectT) {
@@ -263,7 +249,10 @@ func TestServer_AuthorizationReduces(t *testing.T) {
require.NoError(collect, err)
assert.Equal(collect, []string{role1}, az.Roles)
assert.Equal(collect, domain.AuthorizationStateActive, az.State)
//assert.WithinRange(collect, az.UpdatedAt, before, after)
assert.Equal(collect, createdAuthorization.GetCreationDate().AsTime(), az.CreatedAt.UTC())
// project role removal triggers a UserGrantCascadeChangedEvent,
// so the RT UpdatedAt should match the role removal time
assert.Equal(collect, roleRemoved.GetRemovalDate().AsTime(), az.UpdatedAt.UTC())
}, retryDuration, tick, "authorization not updated within %v: %v", retryDuration, err)
})
@@ -346,14 +335,12 @@ func TestServer_AuthorizationReduces(t *testing.T) {
// create authorization with roles
createdAuthorization := createAndEnsureAuthorization(t, instanceID, grantedOrganization.OrganizationId, user.UserId, projectID, []string{role1, role2}, retryDuration, tick)
// update project grant
//beforeUpdate := time.Now()
_, err = ProjectClient.UpdateProjectGrant(CTX, &project_v2beta.UpdateProjectGrantRequest{
ProjectId: projectID,
GrantedOrganizationId: grantedOrganization.OrganizationId,
RoleKeys: []string{role1},
})
require.NoError(t, err)
//afterUpdate := time.Now().Add(500 * time.Millisecond) // add some buffer for eventual consistency of cascading changes
// ensure authorization is updated
require.EventuallyWithT(t, func(collect *assert.CollectT) {
@@ -362,7 +349,10 @@ func TestServer_AuthorizationReduces(t *testing.T) {
))
require.NoError(collect, err)
assert.Equal(collect, []string{role1}, az.Roles)
//assert.WithinRange(collect, az.UpdatedAt, beforeUpdate, afterUpdate)
assert.Equal(collect, createdAuthorization.GetCreationDate().AsTime(), az.CreatedAt.UTC())
// (@grvijayan) todo: should we check the timestamp here?
// the authorization/authorization_roles RT is updated based on cascade deletions in the project_grant_roles table,
// so the project grant update time cannot be used here
}, retryDuration, tick, "authorization not updated within %v: %v", retryDuration, err)
})
@@ -407,7 +397,6 @@ func TestServer_AuthorizationReduces(t *testing.T) {
_ = instance.AddProjectRole(CTX, t, projectResp.Id, role2, "display", "")
// create authorization with roles
//beforeCreate := time.Now()
createdAuthorization, err := instance.Client.AuthorizationV2.CreateAuthorization(CTX, &authorization_v2.CreateAuthorizationRequest{
UserId: user.UserId,
ProjectId: projectResp.Id,
@@ -415,7 +404,6 @@ func TestServer_AuthorizationReduces(t *testing.T) {
OrganizationId: orgResp.OrganizationId,
})
require.NoError(t, err)
//afterCreate := time.Now().Add(500 * time.Millisecond)
// ensure authorization exists
require.EventuallyWithT(t, func(collect *assert.CollectT) {
@@ -425,8 +413,8 @@ func TestServer_AuthorizationReduces(t *testing.T) {
require.NoError(collect, err)
assert.Equal(collect, []string{role1, role2}, az.Roles)
assert.Equal(collect, domain.AuthorizationStateActive, az.State)
//assert.WithinRange(collect, az.CreatedAt, beforeCreate, afterCreate)
//assert.WithinRange(collect, az.UpdatedAt, beforeCreate, afterCreate)
assert.Equal(collect, createdAuthorization.GetCreationDate().AsTime(), az.CreatedAt.UTC())
assert.Equal(collect, createdAuthorization.GetCreationDate().AsTime(), az.UpdatedAt.UTC())
}, retryDuration, tick, "authorization not found within %v: %v", retryDuration, err)
// delete the instance
@@ -448,7 +436,6 @@ func TestServer_AuthorizationReduces(t *testing.T) {
func createAndEnsureAuthorization(t *testing.T, instanceID, orgID, userID, projectID string, roles []string, retryDuration time.Duration, tick time.Duration) *authorization_v2.CreateAuthorizationResponse {
// create authorization
//beforeCreate := time.Now()
createdAuthorization, err := AuthorizationClient.CreateAuthorization(CTX, &authorization_v2.CreateAuthorizationRequest{
UserId: userID,
ProjectId: projectID,
@@ -456,7 +443,6 @@ func createAndEnsureAuthorization(t *testing.T, instanceID, orgID, userID, proje
OrganizationId: orgID,
})
require.NoError(t, err)
//afterCreate := time.Now().Add(500 * time.Millisecond)
// ensure authorization exists
authzRepo := repository.AuthorizationRepository()
require.EventuallyWithT(t, func(collect *assert.CollectT) {
@@ -466,8 +452,8 @@ func createAndEnsureAuthorization(t *testing.T, instanceID, orgID, userID, proje
require.NoError(collect, err)
assert.Equal(collect, roles, az.Roles)
assert.Equal(collect, domain.AuthorizationStateActive, az.State)
//assert.WithinRange(collect, az.CreatedAt, beforeCreate, afterCreate)
//assert.WithinRange(collect, az.UpdatedAt, beforeCreate, afterCreate)
assert.Equal(collect, createdAuthorization.GetCreationDate().AsTime().UTC(), az.CreatedAt.UTC())
assert.Equal(collect, createdAuthorization.GetCreationDate().AsTime().UTC(), az.UpdatedAt.UTC())
}, retryDuration, tick, "authorization not found within %v: %v", retryDuration, err)
return createdAuthorization
}