mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 13:52:51 +00:00
791d0587aa
# Which Problems Are Solved The payload in actions V2 is currently sent as JSON to the target endpoint. It might get exposed to intermediary infrastructure or logging systems. For these scenarios there needs to be an application-layer encryption, where the provider of the endpoint can define an key to be used for the encryption. # How the Problems Are Solved - Added an additional option to the target to specify the payload type: `JSON` (current and default), `JWT`, `JWE` (api and console) - added endpoints to upload and manage public keys (to be used for encryption) for a target - updated all action v2 executions (interceptors, oidc, saml, ...) to provide the `GetActiveSigningWebKey` from queries - implemented jwt and jwe in the exections incl. refactoring of code and tests - changes to the authn_keys table: - added a `fingerprint` column - dropped not null constraint on expiration - moved the `GetSignerOnce` into its own package to prevent circular dependencies # Additional Changes None # Additional Context closes #11061 --------- Co-authored-by: Marco A. <[email protected]> Co-authored-by: conblem <[email protected]> Co-authored-by: Silvan <[email protected]>
876 lines
24 KiB
Go
876 lines
24 KiB
Go
package middleware
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"crypto/rand"
|
|
"crypto/rsa"
|
|
"encoding/json"
|
|
"io"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/go-jose/go-jose/v4"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"google.golang.org/protobuf/encoding/protojson"
|
|
"google.golang.org/protobuf/proto"
|
|
"google.golang.org/protobuf/types/known/structpb"
|
|
|
|
"github.com/zitadel/zitadel/internal/crypto"
|
|
"github.com/zitadel/zitadel/internal/execution"
|
|
target_domain "github.com/zitadel/zitadel/internal/execution/target"
|
|
)
|
|
|
|
var (
|
|
privateKey = func() *rsa.PrivateKey {
|
|
privateKey, _ := rsa.GenerateKey(rand.Reader, 2048)
|
|
return privateKey
|
|
}()
|
|
encryptionKey = func() []byte {
|
|
data, _ := crypto.PublicKeyToBytes(&privateKey.PublicKey)
|
|
return data
|
|
}()
|
|
encryptionKeyID = "encryption-key-id"
|
|
signingAlgorithm = jose.RS256
|
|
)
|
|
|
|
func newMockContentRequest(content string) proto.Message {
|
|
return &structpb.Struct{
|
|
Fields: map[string]*structpb.Value{
|
|
"content": {
|
|
Kind: &structpb.Value_StringValue{StringValue: content},
|
|
},
|
|
},
|
|
}
|
|
}
|
|
|
|
func newMockContextInfoRequest(fullMethod, request string) *ContextInfoRequest {
|
|
return &ContextInfoRequest{
|
|
FullMethod: fullMethod,
|
|
Request: Message{Message: newMockContentRequest(request)},
|
|
}
|
|
}
|
|
|
|
func newMockContextInfoResponse(fullMethod, request, response string) *ContextInfoResponse {
|
|
return &ContextInfoResponse{
|
|
FullMethod: fullMethod,
|
|
Request: Message{Message: newMockContentRequest(request)},
|
|
Response: Message{Message: newMockContentRequest(response)},
|
|
}
|
|
}
|
|
|
|
func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
|
type target struct {
|
|
reqBody execution.ContextInfo
|
|
sleep time.Duration
|
|
statusCode int
|
|
respBody interface{}
|
|
requestVerification func(*testing.T) func([]byte, []byte) bool
|
|
}
|
|
type args struct {
|
|
ctx context.Context
|
|
|
|
executionTargets []target_domain.Target
|
|
targets []target
|
|
fullMethod string
|
|
req interface{}
|
|
getActiveSigningWebKey execution.GetActiveSigningWebKey
|
|
}
|
|
type res struct {
|
|
want interface{}
|
|
wantErr bool
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
args args
|
|
res res
|
|
}{
|
|
{
|
|
"target, executionTargets nil",
|
|
args{
|
|
ctx: context.Background(),
|
|
fullMethod: "/service/method",
|
|
executionTargets: nil,
|
|
req: newMockContentRequest("request"),
|
|
},
|
|
res{
|
|
want: newMockContentRequest("request"),
|
|
},
|
|
},
|
|
{
|
|
"target, executionTargets empty",
|
|
args{
|
|
ctx: context.Background(),
|
|
fullMethod: "/service/method",
|
|
executionTargets: []target_domain.Target{},
|
|
req: newMockContentRequest("request"),
|
|
},
|
|
res{
|
|
want: newMockContentRequest("request"),
|
|
},
|
|
},
|
|
{
|
|
"target, not reachable",
|
|
args{
|
|
ctx: context.Background(),
|
|
fullMethod: "/service/method",
|
|
executionTargets: []target_domain.Target{
|
|
{
|
|
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
|
TargetID: "target",
|
|
TargetType: target_domain.TargetTypeCall,
|
|
Timeout: time.Minute,
|
|
InterruptOnError: true,
|
|
},
|
|
},
|
|
targets: []target{},
|
|
req: newMockContentRequest("content"),
|
|
},
|
|
res{
|
|
wantErr: true,
|
|
},
|
|
},
|
|
{
|
|
"target, error without interrupt",
|
|
args{
|
|
ctx: context.Background(),
|
|
fullMethod: "/service/method",
|
|
executionTargets: []target_domain.Target{
|
|
{
|
|
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
|
TargetID: "target",
|
|
TargetType: target_domain.TargetTypeCall,
|
|
Timeout: time.Minute,
|
|
},
|
|
},
|
|
targets: []target{
|
|
{
|
|
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
|
respBody: newMockContentRequest("content1"),
|
|
sleep: 0,
|
|
statusCode: http.StatusBadRequest,
|
|
requestVerification: validateJSONPayload,
|
|
},
|
|
},
|
|
req: newMockContentRequest("content"),
|
|
},
|
|
res{
|
|
want: newMockContentRequest("content"),
|
|
},
|
|
},
|
|
{
|
|
"target, interruptOnError",
|
|
args{
|
|
ctx: context.Background(),
|
|
fullMethod: "/service/method",
|
|
executionTargets: []target_domain.Target{
|
|
{
|
|
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
|
TargetID: "target",
|
|
TargetType: target_domain.TargetTypeCall,
|
|
Timeout: time.Minute,
|
|
InterruptOnError: true,
|
|
},
|
|
},
|
|
|
|
targets: []target{
|
|
{
|
|
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
|
respBody: newMockContentRequest("content1"),
|
|
sleep: 0,
|
|
statusCode: http.StatusBadRequest,
|
|
requestVerification: validateJSONPayload,
|
|
},
|
|
},
|
|
req: newMockContentRequest("content"),
|
|
},
|
|
res{
|
|
wantErr: true,
|
|
},
|
|
},
|
|
{
|
|
"target, timeout",
|
|
args{
|
|
ctx: context.Background(),
|
|
fullMethod: "/service/method",
|
|
executionTargets: []target_domain.Target{
|
|
{
|
|
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
|
TargetID: "target",
|
|
TargetType: target_domain.TargetTypeCall,
|
|
Timeout: time.Second,
|
|
InterruptOnError: true,
|
|
},
|
|
},
|
|
targets: []target{
|
|
{
|
|
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
|
respBody: newMockContentRequest("content1"),
|
|
sleep: 5 * time.Second,
|
|
statusCode: http.StatusOK,
|
|
requestVerification: validateJSONPayload,
|
|
},
|
|
},
|
|
req: newMockContentRequest("content"),
|
|
},
|
|
res{
|
|
wantErr: true,
|
|
},
|
|
},
|
|
{
|
|
"target, wrong request",
|
|
args{
|
|
ctx: context.Background(),
|
|
fullMethod: "/service/method",
|
|
executionTargets: []target_domain.Target{
|
|
{
|
|
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
|
TargetID: "target",
|
|
TargetType: target_domain.TargetTypeCall,
|
|
Timeout: time.Second,
|
|
InterruptOnError: true,
|
|
},
|
|
},
|
|
targets: []target{
|
|
{
|
|
reqBody: newMockContextInfoRequest("/service/method", "wrong"),
|
|
requestVerification: validateJSONPayload,
|
|
},
|
|
},
|
|
req: newMockContentRequest("content"),
|
|
},
|
|
res{
|
|
wantErr: true,
|
|
},
|
|
},
|
|
{
|
|
"target, ok",
|
|
args{
|
|
ctx: context.Background(),
|
|
fullMethod: "/service/method",
|
|
executionTargets: []target_domain.Target{
|
|
{
|
|
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
|
TargetID: "target",
|
|
TargetType: target_domain.TargetTypeCall,
|
|
Timeout: time.Minute,
|
|
InterruptOnError: true,
|
|
},
|
|
},
|
|
targets: []target{
|
|
{
|
|
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
|
respBody: newMockContentRequest("content1"),
|
|
sleep: 0,
|
|
statusCode: http.StatusOK,
|
|
requestVerification: validateJSONPayload,
|
|
},
|
|
},
|
|
req: newMockContentRequest("content"),
|
|
},
|
|
res{
|
|
want: newMockContentRequest("content1"),
|
|
},
|
|
},
|
|
{
|
|
"target async, timeout",
|
|
args{
|
|
ctx: context.Background(),
|
|
fullMethod: "/service/method",
|
|
executionTargets: []target_domain.Target{
|
|
{
|
|
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
|
TargetID: "target",
|
|
TargetType: target_domain.TargetTypeAsync,
|
|
Timeout: time.Second,
|
|
},
|
|
},
|
|
targets: []target{
|
|
{
|
|
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
|
respBody: newMockContentRequest("content1"),
|
|
sleep: 5 * time.Second,
|
|
statusCode: http.StatusOK,
|
|
requestVerification: validateJSONPayload,
|
|
},
|
|
},
|
|
req: newMockContentRequest("content"),
|
|
},
|
|
res{
|
|
want: newMockContentRequest("content"),
|
|
},
|
|
},
|
|
{
|
|
"target async, ok",
|
|
args{
|
|
ctx: context.Background(),
|
|
fullMethod: "/service/method",
|
|
executionTargets: []target_domain.Target{
|
|
{
|
|
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
|
TargetID: "target",
|
|
TargetType: target_domain.TargetTypeAsync,
|
|
Timeout: time.Minute,
|
|
},
|
|
},
|
|
targets: []target{
|
|
{
|
|
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
|
respBody: newMockContentRequest("content1"),
|
|
sleep: 0,
|
|
statusCode: http.StatusOK,
|
|
requestVerification: validateJSONPayload,
|
|
},
|
|
},
|
|
req: newMockContentRequest("content"),
|
|
},
|
|
res{
|
|
want: newMockContentRequest("content"),
|
|
},
|
|
},
|
|
{
|
|
"webhook, error",
|
|
args{
|
|
ctx: context.Background(),
|
|
fullMethod: "/service/method",
|
|
executionTargets: []target_domain.Target{
|
|
{
|
|
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
|
TargetID: "target",
|
|
TargetType: target_domain.TargetTypeWebhook,
|
|
Timeout: time.Minute,
|
|
InterruptOnError: true,
|
|
},
|
|
},
|
|
targets: []target{
|
|
{
|
|
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
|
sleep: 0,
|
|
statusCode: http.StatusInternalServerError,
|
|
requestVerification: validateJSONPayload,
|
|
},
|
|
},
|
|
req: newMockContentRequest("content"),
|
|
},
|
|
res{
|
|
wantErr: true,
|
|
},
|
|
},
|
|
{
|
|
"webhook, timeout",
|
|
args{
|
|
ctx: context.Background(),
|
|
fullMethod: "/service/method",
|
|
executionTargets: []target_domain.Target{
|
|
{
|
|
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
|
TargetID: "target",
|
|
TargetType: target_domain.TargetTypeWebhook,
|
|
Timeout: time.Second,
|
|
InterruptOnError: true,
|
|
},
|
|
},
|
|
targets: []target{
|
|
{
|
|
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
|
respBody: newMockContentRequest("content1"),
|
|
sleep: 5 * time.Second,
|
|
statusCode: http.StatusOK,
|
|
requestVerification: validateJSONPayload,
|
|
},
|
|
},
|
|
req: newMockContentRequest("content"),
|
|
},
|
|
res{
|
|
wantErr: true,
|
|
},
|
|
},
|
|
{
|
|
"webhook, ok",
|
|
args{
|
|
ctx: context.Background(),
|
|
fullMethod: "/service/method",
|
|
executionTargets: []target_domain.Target{
|
|
{
|
|
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
|
TargetID: "target",
|
|
TargetType: target_domain.TargetTypeWebhook,
|
|
Timeout: time.Minute,
|
|
InterruptOnError: true,
|
|
},
|
|
},
|
|
targets: []target{
|
|
{
|
|
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
|
respBody: newMockContentRequest("content1"),
|
|
sleep: 0,
|
|
statusCode: http.StatusOK,
|
|
requestVerification: validateJSONPayload,
|
|
},
|
|
},
|
|
req: newMockContentRequest("content"),
|
|
},
|
|
res{
|
|
want: newMockContentRequest("content"),
|
|
},
|
|
},
|
|
{
|
|
"with includes, interruptOnError",
|
|
args{
|
|
ctx: context.Background(),
|
|
fullMethod: "/service/method",
|
|
executionTargets: []target_domain.Target{
|
|
{
|
|
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
|
TargetID: "target1",
|
|
TargetType: target_domain.TargetTypeCall,
|
|
Timeout: time.Minute,
|
|
InterruptOnError: true,
|
|
},
|
|
{
|
|
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
|
TargetID: "target2",
|
|
TargetType: target_domain.TargetTypeCall,
|
|
Timeout: time.Minute,
|
|
InterruptOnError: true,
|
|
},
|
|
{
|
|
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
|
TargetID: "target3",
|
|
TargetType: target_domain.TargetTypeCall,
|
|
Timeout: time.Minute,
|
|
InterruptOnError: true,
|
|
},
|
|
},
|
|
|
|
targets: []target{
|
|
{
|
|
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
|
respBody: newMockContentRequest("content1"),
|
|
sleep: 0,
|
|
statusCode: http.StatusOK,
|
|
requestVerification: validateJSONPayload,
|
|
},
|
|
{
|
|
reqBody: newMockContextInfoRequest("/service/method", "content1"),
|
|
respBody: newMockContentRequest("content2"),
|
|
sleep: 0,
|
|
statusCode: http.StatusBadRequest,
|
|
requestVerification: validateJSONPayload,
|
|
},
|
|
{
|
|
reqBody: newMockContextInfoRequest("/service/method", "content2"),
|
|
respBody: newMockContentRequest("content3"),
|
|
sleep: 0,
|
|
statusCode: http.StatusOK,
|
|
requestVerification: validateJSONPayload,
|
|
},
|
|
},
|
|
req: newMockContentRequest("content"),
|
|
},
|
|
res{
|
|
wantErr: true,
|
|
},
|
|
},
|
|
{
|
|
"with includes, timeout",
|
|
args{
|
|
ctx: context.Background(),
|
|
fullMethod: "/service/method",
|
|
executionTargets: []target_domain.Target{
|
|
{
|
|
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
|
TargetID: "target1",
|
|
TargetType: target_domain.TargetTypeCall,
|
|
Timeout: time.Minute,
|
|
InterruptOnError: true,
|
|
},
|
|
{
|
|
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
|
TargetID: "target2",
|
|
TargetType: target_domain.TargetTypeCall,
|
|
Timeout: time.Second,
|
|
InterruptOnError: true,
|
|
},
|
|
{
|
|
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
|
TargetID: "target3",
|
|
TargetType: target_domain.TargetTypeCall,
|
|
Timeout: time.Second,
|
|
InterruptOnError: true,
|
|
},
|
|
},
|
|
targets: []target{
|
|
{
|
|
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
|
respBody: newMockContentRequest("content1"),
|
|
sleep: 0,
|
|
statusCode: http.StatusOK,
|
|
requestVerification: validateJSONPayload,
|
|
},
|
|
{
|
|
reqBody: newMockContextInfoRequest("/service/method", "content1"),
|
|
respBody: newMockContentRequest("content2"),
|
|
sleep: 5 * time.Second,
|
|
statusCode: http.StatusBadRequest,
|
|
requestVerification: validateJSONPayload,
|
|
},
|
|
{
|
|
reqBody: newMockContextInfoRequest("/service/method", "content2"),
|
|
respBody: newMockContentRequest("content3"),
|
|
sleep: 5 * time.Second,
|
|
statusCode: http.StatusOK,
|
|
requestVerification: validateJSONPayload,
|
|
},
|
|
},
|
|
req: newMockContentRequest("content"),
|
|
},
|
|
res{
|
|
wantErr: true,
|
|
},
|
|
},
|
|
{
|
|
"payload JWT, ok",
|
|
args{
|
|
ctx: context.Background(),
|
|
fullMethod: "/service/method",
|
|
executionTargets: []target_domain.Target{
|
|
{
|
|
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
|
TargetID: "target",
|
|
TargetType: target_domain.TargetTypeWebhook,
|
|
Timeout: time.Minute,
|
|
InterruptOnError: true,
|
|
PayloadType: target_domain.PayloadTypeJWT,
|
|
},
|
|
},
|
|
targets: []target{
|
|
{
|
|
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
|
respBody: newMockContentRequest("content1"),
|
|
sleep: 0,
|
|
statusCode: http.StatusOK,
|
|
requestVerification: validateJWTPayload,
|
|
},
|
|
},
|
|
req: newMockContentRequest("content"),
|
|
getActiveSigningWebKey: mockGetActiveSigningWebKey(),
|
|
},
|
|
res{
|
|
want: newMockContentRequest("content"),
|
|
},
|
|
},
|
|
{
|
|
"payload JWE, ok",
|
|
args{
|
|
ctx: context.Background(),
|
|
fullMethod: "/service/method",
|
|
executionTargets: []target_domain.Target{
|
|
{
|
|
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
|
TargetID: "target",
|
|
TargetType: target_domain.TargetTypeWebhook,
|
|
Timeout: time.Minute,
|
|
InterruptOnError: true,
|
|
PayloadType: target_domain.PayloadTypeJWE,
|
|
EncryptionKey: encryptionKey,
|
|
EncryptionKeyID: encryptionKeyID,
|
|
},
|
|
},
|
|
targets: []target{
|
|
{
|
|
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
|
respBody: newMockContentRequest("content1"),
|
|
sleep: 0,
|
|
statusCode: http.StatusOK,
|
|
requestVerification: validateJWEPayload,
|
|
},
|
|
},
|
|
req: newMockContentRequest("content"),
|
|
getActiveSigningWebKey: mockGetActiveSigningWebKey(),
|
|
},
|
|
res{
|
|
want: newMockContentRequest("content"),
|
|
},
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
closeFuncs := make([]func(), len(tt.args.targets))
|
|
for i, target := range tt.args.targets {
|
|
url, closeF := testServerCall(
|
|
target.reqBody,
|
|
target.sleep,
|
|
target.statusCode,
|
|
target.respBody,
|
|
target.requestVerification(t),
|
|
)
|
|
|
|
tt.args.executionTargets[i].Endpoint = url
|
|
closeFuncs[i] = closeF
|
|
}
|
|
|
|
resp, err := executeTargetsForRequest(
|
|
tt.args.ctx,
|
|
tt.args.executionTargets,
|
|
tt.args.fullMethod,
|
|
tt.args.req,
|
|
nil,
|
|
tt.args.getActiveSigningWebKey,
|
|
)
|
|
|
|
if tt.res.wantErr {
|
|
assert.Error(t, err)
|
|
} else {
|
|
assert.NoError(t, err)
|
|
}
|
|
assert.EqualExportedValues(t, tt.res.want, resp)
|
|
|
|
for _, closeF := range closeFuncs {
|
|
closeF()
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func testServerCall(
|
|
reqBody interface{},
|
|
sleep time.Duration,
|
|
statusCode int,
|
|
respBody interface{},
|
|
requestVerification func(expected, sent []byte) bool,
|
|
) (string, func()) {
|
|
handler := func(w http.ResponseWriter, r *http.Request) {
|
|
data, err := json.Marshal(reqBody)
|
|
if err != nil {
|
|
http.Error(w, "error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
sentBody, err := io.ReadAll(r.Body)
|
|
if err != nil {
|
|
http.Error(w, "error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
if !requestVerification(data, sentBody) {
|
|
http.Error(w, "error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
if statusCode != http.StatusOK {
|
|
http.Error(w, "error", statusCode)
|
|
return
|
|
}
|
|
|
|
time.Sleep(sleep)
|
|
|
|
w.Header().Set("Content-Type", "application/json")
|
|
resp, err := protojson.Marshal(respBody.(proto.Message))
|
|
if err != nil {
|
|
http.Error(w, "error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
if _, err := w.Write(resp); err != nil {
|
|
http.Error(w, "error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
}
|
|
|
|
server := httptest.NewServer(http.HandlerFunc(handler))
|
|
|
|
return server.URL, server.Close
|
|
}
|
|
|
|
func mockGetActiveSigningWebKey() func(ctx context.Context) (*jose.JSONWebKey, error) {
|
|
return func(ctx context.Context) (*jose.JSONWebKey, error) {
|
|
return &jose.JSONWebKey{
|
|
Key: privateKey,
|
|
Algorithm: string(signingAlgorithm),
|
|
Use: "sig",
|
|
}, nil
|
|
}
|
|
}
|
|
|
|
func validateJSONPayload(t *testing.T) func(expected, sent []byte) bool {
|
|
return bytes.Equal
|
|
}
|
|
|
|
func validateJWTPayload(t *testing.T) func(expected, sent []byte) bool {
|
|
return func(expected, sent []byte) bool {
|
|
jws, err := jose.ParseSigned(string(sent), []jose.SignatureAlgorithm{jose.RS256})
|
|
require.NoError(t, err)
|
|
payload, err := jws.Verify(privateKey.Public())
|
|
require.NoError(t, err)
|
|
return bytes.Equal(expected, payload)
|
|
}
|
|
}
|
|
|
|
func validateJWEPayload(t *testing.T) func(expected, sent []byte) bool {
|
|
return func(expected, sent []byte) bool {
|
|
parsedJWE, err := jose.ParseEncrypted(string(sent), []jose.KeyAlgorithm{jose.RSA_OAEP_256, jose.ECDH_ES_A256KW}, []jose.ContentEncryption{jose.A256GCM})
|
|
if err != nil {
|
|
return false
|
|
}
|
|
require.Equal(t, encryptionKeyID, parsedJWE.Header.KeyID)
|
|
require.Equal(t, "JWT", parsedJWE.Header.ExtraHeaders[jose.HeaderContentType].(string))
|
|
|
|
decryptedJWS, err := parsedJWE.Decrypt(privateKey)
|
|
require.NoError(t, err)
|
|
return validateJWTPayload(t)(expected, decryptedJWS)
|
|
}
|
|
}
|
|
|
|
func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
|
|
type target struct {
|
|
reqBody execution.ContextInfo
|
|
sleep time.Duration
|
|
statusCode int
|
|
respBody interface{}
|
|
}
|
|
type args struct {
|
|
ctx context.Context
|
|
|
|
executionTargets []target_domain.Target
|
|
targets []target
|
|
fullMethod string
|
|
req interface{}
|
|
resp interface{}
|
|
}
|
|
type res struct {
|
|
want interface{}
|
|
wantErr bool
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
args args
|
|
res res
|
|
}{
|
|
{
|
|
"target, executionTargets nil",
|
|
args{
|
|
ctx: context.Background(),
|
|
fullMethod: "/service/method",
|
|
executionTargets: nil,
|
|
req: newMockContentRequest("request"),
|
|
resp: newMockContentRequest("response"),
|
|
},
|
|
res{
|
|
want: newMockContentRequest("response"),
|
|
},
|
|
},
|
|
{
|
|
"target, executionTargets empty",
|
|
args{
|
|
ctx: context.Background(),
|
|
fullMethod: "/service/method",
|
|
executionTargets: []target_domain.Target{},
|
|
req: newMockContentRequest("request"),
|
|
resp: newMockContentRequest("response"),
|
|
},
|
|
res{
|
|
want: newMockContentRequest("response"),
|
|
},
|
|
},
|
|
{
|
|
"target, empty response",
|
|
args{
|
|
ctx: context.Background(),
|
|
fullMethod: "/service/method",
|
|
executionTargets: []target_domain.Target{
|
|
{
|
|
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
|
TargetID: "target",
|
|
TargetType: target_domain.TargetTypeCall,
|
|
Timeout: time.Minute,
|
|
InterruptOnError: true,
|
|
},
|
|
},
|
|
targets: []target{
|
|
{
|
|
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
|
respBody: newMockContentRequest(""),
|
|
sleep: 0,
|
|
statusCode: http.StatusOK,
|
|
},
|
|
},
|
|
req: newMockContentRequest(""),
|
|
resp: newMockContentRequest(""),
|
|
},
|
|
res{
|
|
wantErr: true,
|
|
},
|
|
},
|
|
{
|
|
"target, ok",
|
|
args{
|
|
ctx: context.Background(),
|
|
fullMethod: "/service/method",
|
|
executionTargets: []target_domain.Target{
|
|
{
|
|
ExecutionID: "response./zitadel.session.v2.SessionService/SetSession",
|
|
TargetID: "target",
|
|
TargetType: target_domain.TargetTypeCall,
|
|
Timeout: time.Minute,
|
|
InterruptOnError: true,
|
|
},
|
|
},
|
|
targets: []target{
|
|
{
|
|
reqBody: newMockContextInfoResponse("/service/method", "request", "response"),
|
|
respBody: newMockContentRequest("response1"),
|
|
sleep: 0,
|
|
statusCode: http.StatusOK,
|
|
},
|
|
},
|
|
req: newMockContentRequest("request"),
|
|
resp: newMockContentRequest("response"),
|
|
},
|
|
res{
|
|
want: newMockContentRequest("response1"),
|
|
},
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
closeFuncs := make([]func(), len(tt.args.targets))
|
|
for i, target := range tt.args.targets {
|
|
url, closeF := testServerCall(
|
|
target.reqBody,
|
|
target.sleep,
|
|
target.statusCode,
|
|
target.respBody,
|
|
validateJSONPayload(t),
|
|
)
|
|
|
|
tt.args.executionTargets[i].Endpoint = url
|
|
closeFuncs[i] = closeF
|
|
}
|
|
|
|
resp, err := executeTargetsForResponse(
|
|
tt.args.ctx,
|
|
tt.args.executionTargets,
|
|
tt.args.fullMethod,
|
|
tt.args.req,
|
|
tt.args.resp,
|
|
nil,
|
|
mockGetActiveSigningWebKey(),
|
|
)
|
|
|
|
if tt.res.wantErr {
|
|
assert.Error(t, err)
|
|
} else {
|
|
assert.NoError(t, err)
|
|
}
|
|
assert.EqualExportedValues(t, tt.res.want, resp)
|
|
|
|
for _, closeF := range closeFuncs {
|
|
closeF()
|
|
}
|
|
})
|
|
}
|
|
}
|