andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-12 17:15:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
* fix: respect lockout policy on password change (with old password)

* add tarpitting

* cleanup
This commit is contained in:
Livio Spring
2025-10-29 10:07:35 +01:00
committed by GitHub
parent 72a5c33e6a
commit b8db8cdf9c
17 changed files with 619 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/command/user_v2_human_test.go
+58 -3
View File
@@ -2207,6 +2207,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
checkPermission domain.PermissionCheck
defaultSecretGenerators *SecretGenerators
defaultEmailCodeURLTemplate func(ctx context.Context) string
tarpit Tarpit
}
type args struct {
ctx context.Context
@@ -2243,6 +2244,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
expectFilter(),
),
checkPermission: newMockPermissionCheckAllowed(),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2268,6 +2270,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
),
checkPermission: newMockPermissionCheckNotAllowed(),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2289,6 +2292,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
expectFilter(),
),
checkPermission: newMockPermissionCheckAllowed(),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2334,6 +2338,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
),
checkPermission: newMockPermissionCheckAllowed(),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2381,6 +2386,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
),
checkPermission: newMockPermissionCheckAllowed(),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2408,6 +2414,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
),
checkPermission: newMockPermissionCheckAllowed(),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2435,6 +2442,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
),
checkPermission: newMockPermissionCheckNotAllowed(),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2483,6 +2491,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
),
checkPermission: newMockPermissionCheckAllowed(),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2517,6 +2526,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
),
checkPermission: newMockPermissionCheckAllowed(),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2572,6 +2582,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
checkPermission: newMockPermissionCheckAllowed(),
newCode: mockEncryptedCode("emailCode", time.Hour),
defaultEmailCodeURLTemplate: func(ctx context.Context) string { return "http://example.com/{{.user}}/email/{{.code}}" },
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2602,6 +2613,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
),
checkPermission: newMockPermissionCheckAllowed(),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2631,6 +2643,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
),
checkPermission: newMockPermissionCheckNotAllowed(),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2668,6 +2681,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
),
checkPermission: newMockPermissionCheckAllowed(),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2703,6 +2717,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
),
checkPermission: newMockPermissionCheckAllowed(),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2753,6 +2768,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
checkPermission: newMockPermissionCheckAllowed(),
newCode: mockEncryptedCode("emailCode", time.Hour),
defaultEmailCodeURLTemplate: func(ctx context.Context) string { return "http://example.com/{{.user}}/email/{{.code}}" },
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2835,6 +2851,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
checkPermission: newMockPermissionCheckAllowed(),
newEncryptedCodeWithDefault: mockEncryptedCodeWithDefault("phoneCode", time.Hour),
defaultSecretGenerators: defaultGenerators,
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2910,6 +2927,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
checkPermission: newMockPermissionCheckAllowed(),
newEncryptedCodeWithDefault: mockEncryptedCodeWithDefault("phoneCode", time.Hour),
defaultSecretGenerators: defaultGenerators,
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2940,6 +2958,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
),
checkPermission: newMockPermissionCheckNotAllowed(),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -2977,6 +2996,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
),
checkPermission: newMockPermissionCheckAllowed(),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -3012,6 +3032,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
),
checkPermission: newMockPermissionCheckAllowed(),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -3091,6 +3112,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
checkPermission: newMockPermissionCheckAllowed(),
newEncryptedCodeWithDefault: mockEncryptedCodeWithDefault("phoneCode", time.Hour),
defaultSecretGenerators: defaultGenerators,
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -3118,6 +3140,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
eventstore: expectEventstore(),
checkPermission: newMockPermissionCheckAllowed(),
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -3151,6 +3174,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
checkPermission: newMockPermissionCheckAllowed(),
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -3183,6 +3207,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
),
),
expectFilter(), // recheck of user locking relevant events
expectFilter(
eventFromEventPusher(
org.NewPasswordComplexityPolicyAddedEvent(context.Background(),
@@ -3198,6 +3223,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
checkPermission: newMockPermissionCheckAllowed(),
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -3222,6 +3248,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
eventstore: expectEventstore(),
checkPermission: newMockPermissionCheckAllowed(),
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -3256,6 +3283,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
userPasswordHasher: mockPasswordHasher("x"),
checkPermission: newMockPermissionCheckNotAllowed(),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -3310,6 +3338,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
userPasswordHasher: mockPasswordHasher("x"),
checkPermission: newMockPermissionCheckAllowed(),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -3343,6 +3372,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
),
),
expectFilter(), // recheck of user locking relevant events
expectFilter(
eventFromEventPusher(
org.NewPasswordComplexityPolicyAddedEvent(context.Background(),
@@ -3366,6 +3396,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
checkPermission: newMockPermissionCheckAllowed(),
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -3400,9 +3431,27 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
),
),
expectFilter(), // recheck of user locking relevant events
expectFilter(
eventFromEventPusher(
org.NewLockoutPolicyAddedEvent(context.Background(),
&userAgg.Aggregate,
0,
0,
false,
),
),
),
expectPush(
user.NewHumanPasswordCheckFailedEvent(context.Background(),
&userAgg.Aggregate,
nil,
),
),
),
checkPermission: newMockPermissionCheckAllowed(),
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(1),
},
args: args{
ctx: context.Background(),
@@ -3474,6 +3523,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
checkPermission: newMockPermissionCheckAllowed(),
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -3528,6 +3578,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
checkPermission: newMockPermissionCheckAllowed(),
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -3592,6 +3643,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
checkPermission: newMockPermissionCheckAllowed(),
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -3650,6 +3702,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
checkPermission: newMockPermissionCheckAllowed(),
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
@@ -3672,7 +3725,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
},
},
{
name: "change human password and password encoded, password code, encoded used",
name: "change human password encoded, old password, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
@@ -3724,15 +3777,15 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
),
checkPermission: newMockPermissionCheckAllowed(),
userPasswordHasher: mockPasswordHasher("x"),
tarpit: expectTarpit(0),
},
args: args{
ctx: context.Background(),
orgID: "org1",
human: &ChangeHuman{
Password: &Password{
Password: "passwordnotused",
OldPassword: "password",
EncodedPasswordHash: "$plain$x$password2",
PasswordCode: "code",
ChangeRequired: true,
},
},
@@ -3758,6 +3811,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
defaultSecretGenerators: tt.fields.defaultSecretGenerators,
userEncryption: tt.args.codeAlg,
defaultEmailCodeURLTemplate: tt.fields.defaultEmailCodeURLTemplate,
tarpit: tt.fields.tarpit.tarpit,
}
err := r.ChangeUserHuman(tt.args.ctx, tt.args.human, tt.args.codeAlg)
if tt.res.err == nil {
@@ -3773,6 +3827,7 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
assert.Equal(t, tt.res.wantEmailCode, tt.args.human.EmailCode)
assert.Equal(t, tt.res.wantPhoneCode, tt.args.human.PhoneCode)
}
tt.fields.tarpit.metExpectedCalls(t)
})
}
}