andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-13 17:35:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
* fix: respect lockout policy on password change (with old password)

* add tarpitting

* cleanup
This commit is contained in:
Livio Spring
2025-10-29 10:07:35 +01:00
committed by GitHub
parent 72a5c33e6a
commit b8db8cdf9c
17 changed files with 619 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/command/user_human_password_test.go
+221 -9
View File
@@ -760,6 +760,7 @@ func TestCommandSide_SetPasswordWithVerifyCode(t *testing.T) {
func TestCommandSide_ChangePassword(t *testing.T) {
type fields struct {
userPasswordHasher *crypto.Hasher
tarpit Tarpit
}
type args struct {
ctx context.Context
@@ -782,8 +783,10 @@ func TestCommandSide_ChangePassword(t *testing.T) {
res res
}{
{
name: "userid missing, invalid argument error",
fields: fields{},
name: "userid missing, invalid argument error",
fields: fields{
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
oldPassword: "password",
@@ -796,8 +799,10 @@ func TestCommandSide_ChangePassword(t *testing.T) {
},
},
{
name: "old password missing, invalid argument error",
fields: fields{},
name: "old password missing, invalid argument error",
fields: fields{
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
userID: "user1",
@@ -810,8 +815,10 @@ func TestCommandSide_ChangePassword(t *testing.T) {
},
},
{
name: "new password missing, invalid argument error",
fields: fields{},
name: "new password missing, invalid argument error",
fields: fields{
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
userID: "user1",
@@ -824,8 +831,10 @@ func TestCommandSide_ChangePassword(t *testing.T) {
},
},
{
name: "user not existing, precondition error",
fields: fields{},
name: "user not existing, precondition error",
fields: fields{
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
userID: "user1",
@@ -844,6 +853,7 @@ func TestCommandSide_ChangePassword(t *testing.T) {
name: "existing password empty, precondition error",
fields: fields{
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -878,6 +888,7 @@ func TestCommandSide_ChangePassword(t *testing.T) {
name: "password not matching complexity policy, invalid argument error",
fields: fields{
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -914,6 +925,7 @@ func TestCommandSide_ChangePassword(t *testing.T) {
false,
"")),
),
expectFilter(), // recheck of user locking relevant events
expectFilter(
eventFromEventPusher(
org.NewPasswordComplexityPolicyAddedEvent(
@@ -936,6 +948,7 @@ func TestCommandSide_ChangePassword(t *testing.T) {
name: "password not matching, invalid argument error",
fields: fields{
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(1),
},
args: args{
ctx: context.Background(),
@@ -972,6 +985,89 @@ func TestCommandSide_ChangePassword(t *testing.T) {
false,
"")),
),
expectFilter(), // recheck of user locking relevant events
expectFilter(
eventFromEventPusher(
org.NewLockoutPolicyAddedEvent(context.Background(),
&org.NewAggregate("org1").Aggregate,
0,
0,
false,
),
),
),
expectPush(
user.NewHumanPasswordCheckFailedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
nil,
),
),
},
res: res{
err: zerrors.IsErrorInvalidArgument,
},
},
{
name: "password not matching, lockout policy active, invalid argument error",
fields: fields{
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(1),
},
args: args{
ctx: context.Background(),
userID: "user1",
oldPassword: "password-old",
newPassword: "password1",
resourceOwner: "org1",
},
expect: []expect{
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username",
"firstname",
"lastname",
"nickname",
"displayname",
language.German,
domain.GenderUnspecified,
"[email protected]",
true,
),
),
eventFromEventPusher(
user.NewHumanEmailVerifiedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
),
),
eventFromEventPusher(
user.NewHumanPasswordChangedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"$plain$x$password",
false,
"")),
),
expectFilter(), // recheck of user locking relevant events
expectFilter(
eventFromEventPusher(
org.NewLockoutPolicyAddedEvent(context.Background(),
&org.NewAggregate("org1").Aggregate,
1,
0,
false,
),
),
),
expectPush(
user.NewHumanPasswordCheckFailedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
nil,
),
user.NewUserLockedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
),
),
},
res: res{
err: zerrors.IsErrorInvalidArgument,
@@ -981,6 +1077,7 @@ func TestCommandSide_ChangePassword(t *testing.T) {
name: "change password, ok",
fields: fields{
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -1017,6 +1114,7 @@ func TestCommandSide_ChangePassword(t *testing.T) {
false,
"")),
),
expectFilter(), // recheck of user locking relevant events
expectFilter(
eventFromEventPusher(
org.NewPasswordComplexityPolicyAddedEvent(context.Background(),
@@ -1048,6 +1146,7 @@ func TestCommandSide_ChangePassword(t *testing.T) {
name: "change password with userAgentID, ok",
fields: fields{
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -1085,6 +1184,7 @@ func TestCommandSide_ChangePassword(t *testing.T) {
false,
"")),
),
expectFilter(), // recheck of user locking relevant events
expectFilter(
eventFromEventPusher(
org.NewPasswordComplexityPolicyAddedEvent(context.Background(),
@@ -1116,6 +1216,7 @@ func TestCommandSide_ChangePassword(t *testing.T) {
name: "change password with changeRequired, ok",
fields: fields{
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -1154,6 +1255,7 @@ func TestCommandSide_ChangePassword(t *testing.T) {
false,
"")),
),
expectFilter(), // recheck of user locking relevant events
expectFilter(
eventFromEventPusher(
org.NewPasswordComplexityPolicyAddedEvent(context.Background(),
@@ -1185,8 +1287,9 @@ func TestCommandSide_ChangePassword(t *testing.T) {
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
r := &Commands{
eventstore: eventstoreExpect(t, tt.expect...),
eventstore: expectEventstore(tt.expect...)(t),
userPasswordHasher: tt.fields.userPasswordHasher,
tarpit: tt.fields.tarpit.tarpit,
}
got, err := r.ChangePassword(tt.args.ctx, tt.args.resourceOwner, tt.args.userID, tt.args.oldPassword, tt.args.newPassword, tt.args.userAgentID, tt.args.changeRequired)
if tt.res.err == nil {
@@ -1198,6 +1301,7 @@ func TestCommandSide_ChangePassword(t *testing.T) {
if tt.res.err == nil {
assertObjectDetails(t, tt.res.want, got)
}
tt.fields.tarpit.metExpectedCalls(t)
})
}
}
@@ -1597,6 +1701,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
type fields struct {
eventstore func(*testing.T) *eventstore.Eventstore
userPasswordHasher *crypto.Hasher
tarpit Tarpit
}
type args struct {
ctx context.Context
@@ -1618,6 +1723,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
name: "userid missing, invalid argument error",
fields: fields{
eventstore: expectEventstore(),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -1632,6 +1738,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
name: "password missing, invalid argument error",
fields: fields{
eventstore: expectEventstore(),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -1649,6 +1756,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
expectFilter(),
expectFilter(),
),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -1689,6 +1797,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
),
),
),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -1730,6 +1839,8 @@ func TestCommandSide_CheckPassword(t *testing.T) {
),
expectFilter(),
),
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -1791,6 +1902,8 @@ func TestCommandSide_CheckPassword(t *testing.T) {
),
),
),
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -1848,6 +1961,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
),
),
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -1933,6 +2047,97 @@ func TestCommandSide_CheckPassword(t *testing.T) {
),
),
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(1),
},
args: args{
ctx: context.Background(),
userID: "user1",
password: "password1",
resourceOwner: "org1",
authReq: &domain.AuthRequest{
ID: "request1",
AgentID: "agent1",
},
},
res: res{
err: zerrors.IsErrorInvalidArgument,
},
},
{
name: "password not matching, ignore unknow usernames (no tarpit), precondition error",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
org.NewLoginPolicyAddedEvent(context.Background(),
&org.NewAggregate("org1").Aggregate,
true,
false,
false,
false,
false,
false,
true,
false,
false,
false,
domain.PasswordlessTypeNotAllowed,
"",
time.Hour*1,
time.Hour*2,
time.Hour*3,
time.Hour*4,
time.Hour*5,
),
),
),
expectFilter(
eventFromEventPusher(
user.NewHumanAddedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"username",
"firstname",
"lastname",
"nickname",
"displayname",
language.German,
domain.GenderUnspecified,
"[email protected]",
true,
),
),
eventFromEventPusher(
user.NewHumanEmailVerifiedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
),
),
eventFromEventPusher(
user.NewHumanPasswordChangedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
"$plain$x$password",
false,
"")),
),
expectFilter(),
expectFilter(
eventFromEventPusher(
org.NewLockoutPolicyAddedEvent(context.Background(),
&org.NewAggregate("org1").Aggregate,
0, 0, false,
)),
),
expectPush(
user.NewHumanPasswordCheckFailedEvent(context.Background(),
&user.NewAggregate("user1", "org1").Aggregate,
&user.AuthRequestInfo{
ID: "request1",
UserAgentID: "agent1",
},
),
),
),
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2026,6 +2231,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
),
),
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(1),
},
args: args{
ctx: context.Background(),
@@ -2108,6 +2314,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
),
),
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2193,6 +2400,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
),
),
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2270,6 +2478,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
),
),
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2366,6 +2575,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
),
),
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2385,6 +2595,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
r := &Commands{
eventstore: tt.fields.eventstore(t),
userPasswordHasher: tt.fields.userPasswordHasher,
tarpit: tt.fields.tarpit.tarpit,
}
err := r.HumanCheckPassword(tt.args.ctx, tt.args.resourceOwner, tt.args.userID, tt.args.password, tt.args.authReq)
if tt.res.err == nil {
@@ -2393,6 +2604,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
if tt.res.err != nil && !tt.res.err(err) {
t.Errorf("got wrong err: %v ", err)
}
tt.fields.tarpit.metExpectedCalls(t)
})
}
}