mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 05:52:51 +00:00
318bfc36d7
# Which Problems Are Solved - Native iOS/Android passkeys need OS trust files on the ZITADEL domain; without them, Associated Domains / App Links verification fails. - Operators could not configure iOS Team ID + Bundle ID or Android package name + SHA-256 fingerprints on OIDC apps. - `/.well-known/apple-app-site-association` and `/.well-known/assetlinks.json` were not served from application config. # How the Problems Are Solved - Add iOS/Android app-link fields on OIDC app create/update (Application API v2 + Management), with validation. - Persist and project those fields; query active app-link configs instance-wide. - Serve AASA (`webcredentials`) and Digital Asset Links (`get_login_creds`) from well-known paths, with configurable `Cache-Control` and fingerprint normalization at serve time. - Console UI to edit the fields, with links to the well-known endpoints. - Operator docs for configuration, endpoints, caching, and verification. # Additional Changes - Document on API fields that well-known responses may be HTTP-cached and platform verifiers may delay propagation. - Runtime config: `WellKnown.AppLinksCacheControlMaxAge` (default `5m`; `0` → `no-store`). # Additional Context - Closes #12497 - Implemented and reviewed as stack: - #12531 API contract - #12532 storage wiring - #12536 well-known endpoints - #12537 console - #12547 docs --------- Co-authored-by: Cursor <[email protected]>
1807 lines
58 KiB
Go
1807 lines
58 KiB
Go
package command
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"slices"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"go.uber.org/mock/gomock"
|
|
"golang.org/x/text/language"
|
|
|
|
"github.com/zitadel/zitadel/internal/api/authz"
|
|
"github.com/zitadel/zitadel/internal/cache/connector/noop"
|
|
"github.com/zitadel/zitadel/internal/command/preparation"
|
|
"github.com/zitadel/zitadel/internal/crypto"
|
|
"github.com/zitadel/zitadel/internal/domain"
|
|
"github.com/zitadel/zitadel/internal/eventstore"
|
|
"github.com/zitadel/zitadel/internal/id"
|
|
id_mock "github.com/zitadel/zitadel/internal/id/mock"
|
|
"github.com/zitadel/zitadel/internal/repository/instance"
|
|
"github.com/zitadel/zitadel/internal/repository/milestone"
|
|
"github.com/zitadel/zitadel/internal/repository/org"
|
|
"github.com/zitadel/zitadel/internal/repository/project"
|
|
"github.com/zitadel/zitadel/internal/repository/user"
|
|
"github.com/zitadel/zitadel/internal/zerrors"
|
|
)
|
|
|
|
func instanceSetupZitadelIDs() ZitadelConfig {
|
|
return ZitadelConfig{
|
|
instanceID: "INSTANCE",
|
|
orgID: "ORG",
|
|
projectID: "PROJECT",
|
|
managementConsoleAppID: "console-id",
|
|
authAppID: "auth-id",
|
|
mgmtAppID: "mgmt-id",
|
|
adminAppID: "admin-id",
|
|
}
|
|
}
|
|
|
|
func projectAddedEvents(ctx context.Context, instanceID, orgID, id string, externalSecure bool) []eventstore.Command {
|
|
events := []eventstore.Command{
|
|
project.NewProjectAddedEvent(ctx,
|
|
&project.NewAggregate(id, orgID).Aggregate,
|
|
"ZITADEL",
|
|
false,
|
|
false,
|
|
false,
|
|
domain.PrivateLabelingSettingUnspecified,
|
|
),
|
|
instance.NewIAMProjectSetEvent(ctx,
|
|
&instance.NewAggregate(instanceID).Aggregate,
|
|
id,
|
|
),
|
|
}
|
|
events = append(events, apiAppEvents(ctx, orgID, id, "mgmt-id", "Management-API")...)
|
|
events = append(events, apiAppEvents(ctx, orgID, id, "admin-id", "Admin-API")...)
|
|
events = append(events, apiAppEvents(ctx, orgID, id, "auth-id", "Auth-API")...)
|
|
|
|
managementConsoleAppID := "console-id"
|
|
managementConsoleClientID := "clientID"
|
|
events = append(events, oidcAppEvents(ctx, orgID, id, managementConsoleAppID, "Management Console", managementConsoleClientID, externalSecure)...)
|
|
events = append(events,
|
|
instance.NewIAMManagementConsoleSetEvent(ctx,
|
|
&instance.NewAggregate(instanceID).Aggregate,
|
|
&managementConsoleClientID,
|
|
&managementConsoleAppID,
|
|
),
|
|
)
|
|
return events
|
|
}
|
|
|
|
func projectClientIDs() []string {
|
|
return []string{"clientID", "clientID", "clientID", "clientID"}
|
|
}
|
|
|
|
func apiAppEvents(ctx context.Context, orgID, projectID, id, name string) []eventstore.Command {
|
|
return []eventstore.Command{
|
|
project.NewApplicationAddedEvent(
|
|
ctx,
|
|
&project.NewAggregate(projectID, orgID).Aggregate,
|
|
id,
|
|
name,
|
|
),
|
|
project.NewAPIConfigAddedEvent(ctx,
|
|
&project.NewAggregate(projectID, orgID).Aggregate,
|
|
id,
|
|
"clientID",
|
|
"",
|
|
domain.APIAuthMethodTypePrivateKeyJWT,
|
|
),
|
|
}
|
|
}
|
|
|
|
func oidcAppEvents(ctx context.Context, orgID, projectID, id, name, clientID string, externalSecure bool) []eventstore.Command {
|
|
return []eventstore.Command{
|
|
project.NewApplicationAddedEvent(
|
|
ctx,
|
|
&project.NewAggregate(projectID, orgID).Aggregate,
|
|
id,
|
|
name,
|
|
),
|
|
project.NewOIDCConfigAddedEvent(ctx,
|
|
&project.NewAggregate(projectID, orgID).Aggregate,
|
|
domain.OIDCVersionV1,
|
|
id,
|
|
clientID,
|
|
"",
|
|
[]string{},
|
|
[]domain.OIDCResponseType{domain.OIDCResponseTypeCode},
|
|
[]domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
|
|
domain.OIDCApplicationTypeUserAgent,
|
|
domain.OIDCAuthMethodTypeNone,
|
|
[]string{},
|
|
!externalSecure,
|
|
domain.OIDCTokenTypeBearer,
|
|
false,
|
|
false,
|
|
false,
|
|
0,
|
|
nil,
|
|
false,
|
|
"",
|
|
domain.LoginVersionUnspecified,
|
|
"",
|
|
"",
|
|
"",
|
|
"",
|
|
nil),
|
|
}
|
|
}
|
|
|
|
func orgFilters(orgID string, machine, human, loginClient bool) []expect {
|
|
filters := []expect{
|
|
expectFilter(),
|
|
expectFilter(
|
|
org.NewOrgAddedEvent(context.Background(), &org.NewAggregate(orgID).Aggregate, ""),
|
|
),
|
|
}
|
|
if machine {
|
|
filters = append(filters, machineFilters(orgID, true)...)
|
|
filters = append(filters, adminMemberFilters(orgID, "USER-MACHINE")...)
|
|
}
|
|
if human {
|
|
filters = append(filters, humanFilters(orgID)...)
|
|
filters = append(filters, adminMemberFilters(orgID, "USER")...)
|
|
}
|
|
if loginClient {
|
|
filters = append(filters, loginClientFilters(orgID, true)...)
|
|
filters = append(filters, instanceMemberFilters(orgID, "USER-LOGIN-CLIENT")...)
|
|
}
|
|
|
|
return append(filters,
|
|
projectFilters()...,
|
|
)
|
|
}
|
|
|
|
func orgEvents(ctx context.Context, instanceID, orgID, name, projectID, defaultDomain string, externalSecure bool, machine, human, loginClient bool) []eventstore.Command {
|
|
instanceAgg := instance.NewAggregate(instanceID)
|
|
orgAgg := org.NewAggregate(orgID)
|
|
domain := strings.ToLower(name + "." + defaultDomain)
|
|
events := []eventstore.Command{
|
|
org.NewOrgAddedEvent(ctx, &orgAgg.Aggregate, name),
|
|
org.NewDomainAddedEvent(ctx, &orgAgg.Aggregate, domain),
|
|
org.NewDomainVerifiedEvent(ctx, &orgAgg.Aggregate, domain),
|
|
org.NewDomainPrimarySetEvent(ctx, &orgAgg.Aggregate, domain),
|
|
instance.NewDefaultOrgSetEventEvent(ctx, &instanceAgg.Aggregate, orgID),
|
|
}
|
|
|
|
if machine {
|
|
machineID := "USER-MACHINE"
|
|
events = append(events, machineEvents(ctx, instanceID, orgID, machineID, "PAT")...)
|
|
}
|
|
if human {
|
|
userID := "USER"
|
|
events = append(events, humanEvents(ctx, instanceID, orgID, userID)...)
|
|
}
|
|
if loginClient {
|
|
userID := "USER-LOGIN-CLIENT"
|
|
events = append(events, loginClientEvents(ctx, instanceID, orgID, userID, "LOGIN-CLIENT-PAT")...)
|
|
}
|
|
|
|
events = append(events, projectAddedEvents(ctx, instanceID, orgID, projectID, externalSecure)...)
|
|
return events
|
|
}
|
|
|
|
func orgIDs() []string {
|
|
return slices.Concat([]string{"USER-MACHINE", "PAT", "USER", "USER-LOGIN-CLIENT", "LOGIN-CLIENT-PAT"}, projectClientIDs())
|
|
}
|
|
|
|
func instancePoliciesFilters(_ string) []expect {
|
|
return []expect{
|
|
expectFilter(),
|
|
expectFilter(),
|
|
expectFilter(),
|
|
expectFilter(),
|
|
expectFilter(),
|
|
expectFilter(),
|
|
expectFilter(),
|
|
expectFilter(),
|
|
expectFilter(),
|
|
expectFilter(),
|
|
expectFilter(),
|
|
}
|
|
}
|
|
|
|
func instancePoliciesEvents(ctx context.Context, instanceID string) []eventstore.Command {
|
|
instanceAgg := instance.NewAggregate(instanceID)
|
|
return []eventstore.Command{
|
|
instance.NewPasswordComplexityPolicyAddedEvent(ctx, &instanceAgg.Aggregate, 8, true, true, true, true),
|
|
instance.NewPasswordAgePolicyAddedEvent(ctx, &instanceAgg.Aggregate, 0, 0),
|
|
instance.NewDomainPolicyAddedEvent(ctx, &instanceAgg.Aggregate, false, false, false),
|
|
instance.NewLoginPolicyAddedEvent(ctx, &instanceAgg.Aggregate, true, true, true, false, false, false, false, true, false, false, domain.PasswordlessTypeAllowed, "", 240*time.Hour, 240*time.Hour, 720*time.Hour, 18*time.Hour, 12*time.Hour),
|
|
instance.NewLoginPolicySecondFactorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecondFactorTypeTOTP),
|
|
instance.NewLoginPolicySecondFactorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecondFactorTypeU2F),
|
|
instance.NewLoginPolicyMultiFactorAddedEvent(ctx, &instanceAgg.Aggregate, domain.MultiFactorTypeU2FWithPIN),
|
|
instance.NewPrivacyPolicyAddedEvent(ctx, &instanceAgg.Aggregate, "", "", "", "", "", "", ""),
|
|
instance.NewNotificationPolicyAddedEvent(ctx, &instanceAgg.Aggregate, true),
|
|
instance.NewLockoutPolicyAddedEvent(ctx, &instanceAgg.Aggregate, 0, 0, true),
|
|
instance.NewLabelPolicyAddedEvent(ctx, &instanceAgg.Aggregate, "#5469d4", "#fafafa", "#cd3d56", "#000000", "#2073c4", "#111827", "#ff3b5b", "#ffffff", false, false, false, domain.LabelPolicyThemeAuto),
|
|
instance.NewLabelPolicyActivatedEvent(ctx, &instanceAgg.Aggregate),
|
|
}
|
|
}
|
|
|
|
func instanceSetupPoliciesConfig() *InstanceSetup {
|
|
return &InstanceSetup{
|
|
PasswordComplexityPolicy: struct {
|
|
MinLength uint64
|
|
HasLowercase bool
|
|
HasUppercase bool
|
|
HasNumber bool
|
|
HasSymbol bool
|
|
}{8, true, true, true, true},
|
|
PasswordAgePolicy: struct {
|
|
ExpireWarnDays uint64
|
|
MaxAgeDays uint64
|
|
}{0, 0},
|
|
DomainPolicy: struct {
|
|
UserLoginMustBeDomain bool
|
|
ValidateOrgDomains bool
|
|
SMTPSenderAddressMatchesInstanceDomain bool
|
|
}{false, false, false},
|
|
LoginPolicy: struct {
|
|
AllowUsernamePassword bool
|
|
AllowRegister bool
|
|
AllowExternalIDP bool
|
|
ForceMFA bool
|
|
ForceMFALocalOnly bool
|
|
HidePasswordReset bool
|
|
IgnoreUnknownUsernames bool
|
|
AllowDomainDiscovery bool
|
|
DisableLoginWithEmail bool
|
|
DisableLoginWithPhone bool
|
|
PasswordlessType domain.PasswordlessType
|
|
DefaultRedirectURI string
|
|
PasswordCheckLifetime time.Duration
|
|
ExternalLoginCheckLifetime time.Duration
|
|
MfaInitSkipLifetime time.Duration
|
|
SecondFactorCheckLifetime time.Duration
|
|
MultiFactorCheckLifetime time.Duration
|
|
}{true, true, true, false, false, false, false, true, false, false, domain.PasswordlessTypeAllowed, "", 240 * time.Hour, 240 * time.Hour, 720 * time.Hour, 18 * time.Hour, 12 * time.Hour},
|
|
NotificationPolicy: struct {
|
|
PasswordChange bool
|
|
}{true},
|
|
PrivacyPolicy: struct {
|
|
TOSLink string
|
|
PrivacyLink string
|
|
HelpLink string
|
|
SupportEmail domain.EmailAddress
|
|
DocsLink string
|
|
CustomLink string
|
|
CustomLinkText string
|
|
}{"", "", "", "", "", "", ""},
|
|
LabelPolicy: struct {
|
|
PrimaryColor string
|
|
BackgroundColor string
|
|
WarnColor string
|
|
FontColor string
|
|
PrimaryColorDark string
|
|
BackgroundColorDark string
|
|
WarnColorDark string
|
|
FontColorDark string
|
|
HideLoginNameSuffix bool
|
|
ErrorMsgPopup bool
|
|
DisableWatermark bool
|
|
ThemeMode domain.LabelPolicyThemeMode
|
|
}{"#5469d4", "#fafafa", "#cd3d56", "#000000", "#2073c4", "#111827", "#ff3b5b", "#ffffff", false, false, false, domain.LabelPolicyThemeAuto},
|
|
LockoutPolicy: struct {
|
|
MaxPasswordAttempts uint64
|
|
MaxOTPAttempts uint64
|
|
ShouldShowLockoutFailure bool
|
|
}{0, 0, true},
|
|
}
|
|
}
|
|
|
|
func setupInstanceElementsFilters(instanceID string) []expect {
|
|
return slices.Concat(
|
|
instanceElementsFilters(),
|
|
instancePoliciesFilters(instanceID),
|
|
// email template
|
|
[]expect{expectFilter()},
|
|
)
|
|
}
|
|
|
|
func setupInstanceElementsConfig() *InstanceSetup {
|
|
conf := instanceSetupPoliciesConfig()
|
|
conf.InstanceName = "ZITADEL"
|
|
conf.DefaultLanguage = language.English
|
|
conf.zitadel = instanceSetupZitadelIDs()
|
|
conf.SecretGenerators = instanceElementsConfig()
|
|
conf.EmailTemplate = []byte("something")
|
|
return conf
|
|
}
|
|
|
|
func setupInstanceElementsEvents(ctx context.Context, instanceID, instanceName string, defaultLanguage language.Tag) []eventstore.Command {
|
|
instanceAgg := instance.NewAggregate(instanceID)
|
|
return slices.Concat(
|
|
instanceElementsEvents(ctx, instanceID, instanceName, defaultLanguage),
|
|
instancePoliciesEvents(ctx, instanceID),
|
|
[]eventstore.Command{instance.NewMailTemplateAddedEvent(ctx, &instanceAgg.Aggregate, []byte("something"))},
|
|
)
|
|
}
|
|
|
|
func instanceElementsFilters() []expect {
|
|
return []expect{
|
|
expectFilter(),
|
|
expectFilter(),
|
|
expectFilter(),
|
|
expectFilter(),
|
|
expectFilter(),
|
|
expectFilter(),
|
|
expectFilter(),
|
|
expectFilter(),
|
|
expectFilter(),
|
|
expectFilter(),
|
|
}
|
|
}
|
|
|
|
func instanceElementsEvents(ctx context.Context, instanceID, instanceName string, defaultLanguage language.Tag) []eventstore.Command {
|
|
instanceAgg := instance.NewAggregate(instanceID)
|
|
return []eventstore.Command{
|
|
instance.NewInstanceAddedEvent(ctx, &instanceAgg.Aggregate, instanceName),
|
|
instance.NewDefaultLanguageSetEvent(ctx, &instanceAgg.Aggregate, defaultLanguage),
|
|
instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeAppSecret, 64, 0, true, true, true, false),
|
|
instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeInitCode, 6, 72*time.Hour, false, true, true, false),
|
|
instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeVerifyEmailCode, 6, time.Hour, false, true, true, false),
|
|
instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeVerifyPhoneCode, 6, time.Hour, false, true, true, false),
|
|
instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypePasswordResetCode, 6, time.Hour, false, true, true, false),
|
|
instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypePasswordlessInitCode, 12, time.Hour, true, true, true, false),
|
|
instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeVerifyDomain, 32, 0, true, true, true, false),
|
|
instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeOTPSMS, 8, 5*time.Minute, false, false, true, false),
|
|
instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeOTPEmail, 8, 5*time.Minute, false, false, true, false),
|
|
instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeInviteCode, 6, 72*time.Hour, false, true, true, false),
|
|
}
|
|
}
|
|
|
|
func instanceElementsConfig() *SecretGenerators {
|
|
return &SecretGenerators{
|
|
ClientSecret: &crypto.GeneratorConfig{Length: 64, IncludeLowerLetters: true, IncludeUpperLetters: true, IncludeDigits: true},
|
|
InitializeUserCode: &crypto.GeneratorConfig{Length: 6, Expiry: 72 * time.Hour, IncludeUpperLetters: true, IncludeDigits: true},
|
|
EmailVerificationCode: &crypto.GeneratorConfig{Length: 6, Expiry: time.Hour, IncludeUpperLetters: true, IncludeDigits: true},
|
|
PhoneVerificationCode: &crypto.GeneratorConfig{Length: 6, Expiry: time.Hour, IncludeUpperLetters: true, IncludeDigits: true},
|
|
PasswordVerificationCode: &crypto.GeneratorConfig{Length: 6, Expiry: time.Hour, IncludeUpperLetters: true, IncludeDigits: true},
|
|
PasswordlessInitCode: &crypto.GeneratorConfig{Length: 12, Expiry: time.Hour, IncludeLowerLetters: true, IncludeUpperLetters: true, IncludeDigits: true},
|
|
DomainVerification: &crypto.GeneratorConfig{Length: 32, IncludeLowerLetters: true, IncludeUpperLetters: true, IncludeDigits: true},
|
|
OTPSMS: &crypto.GeneratorConfig{Length: 8, Expiry: 5 * time.Minute, IncludeDigits: true},
|
|
OTPEmail: &crypto.GeneratorConfig{Length: 8, Expiry: 5 * time.Minute, IncludeDigits: true},
|
|
InviteCode: &crypto.GeneratorConfig{Length: 6, Expiry: 72 * time.Hour, IncludeUpperLetters: true, IncludeDigits: true},
|
|
}
|
|
}
|
|
|
|
func setupInstanceFilters(instanceID, orgID, projectID, appID, domain string, trustedDomains []string) []expect {
|
|
return slices.Concat(
|
|
setupInstanceElementsFilters(instanceID),
|
|
orgFilters(orgID, true, true, true),
|
|
generatedDomainFilters(instanceID, orgID, projectID, appID, domain),
|
|
generatedTrustedDomainsFilters(trustedDomains),
|
|
)
|
|
}
|
|
|
|
func setupInstanceEvents(
|
|
ctx context.Context,
|
|
instanceID, orgID, projectID, appID, instanceName, orgName string,
|
|
defaultLanguage language.Tag,
|
|
domain string,
|
|
externalSecure bool,
|
|
trustedDomains []string,
|
|
) []eventstore.Command {
|
|
return slices.Concat(
|
|
setupInstanceElementsEvents(ctx, instanceID, instanceName, defaultLanguage),
|
|
orgEvents(ctx, instanceID, orgID, orgName, projectID, domain, externalSecure, true, true, true),
|
|
generatedDomainEvents(ctx, instanceID, orgID, projectID, appID, domain),
|
|
generatedTrustedDomainEvents(ctx, instanceID, trustedDomains),
|
|
instanceCreatedMilestoneEvent(ctx, instanceID),
|
|
)
|
|
}
|
|
|
|
func setupInstanceConfig() *InstanceSetup {
|
|
conf := setupInstanceElementsConfig()
|
|
conf.Org = InstanceOrgSetup{
|
|
Name: "ZITADEL",
|
|
Machine: instanceSetupMachineConfig(),
|
|
Human: instanceSetupHumanConfig(),
|
|
LoginClient: instanceSetupLoginClientConfig(),
|
|
}
|
|
conf.CustomDomain = ""
|
|
conf.TrustedDomains = []string{"trusted-domain.com", "another-trusted-domain.com"}
|
|
return conf
|
|
}
|
|
|
|
func generatedDomainEvents(ctx context.Context, instanceID, orgID, projectID, appID, defaultDomain string) []eventstore.Command {
|
|
instanceAgg := instance.NewAggregate(instanceID)
|
|
changed, _ := project.NewOIDCConfigChangedEvent(ctx, &project.NewAggregate(projectID, orgID).Aggregate, appID,
|
|
[]project.OIDCConfigChanges{
|
|
project.ChangeRedirectURIs([]string{"http://" + defaultDomain + "/ui/console/auth/callback"}),
|
|
project.ChangePostLogoutRedirectURIs([]string{"http://" + defaultDomain + "/ui/console/signedout"}),
|
|
},
|
|
)
|
|
return []eventstore.Command{
|
|
instance.NewDomainAddedEvent(ctx, &instanceAgg.Aggregate, defaultDomain, true),
|
|
changed,
|
|
instance.NewDomainPrimarySetEvent(ctx, &instanceAgg.Aggregate, defaultDomain),
|
|
}
|
|
}
|
|
|
|
func generatedTrustedDomainEvents(ctx context.Context, instanceID string, trustedDomains []string) []eventstore.Command {
|
|
commands := make([]eventstore.Command, len(trustedDomains))
|
|
for i, trustedDomain := range trustedDomains {
|
|
commands[i] = instance.NewTrustedDomainAddedEvent(ctx, &instance.NewAggregate(instanceID).Aggregate, trustedDomain)
|
|
}
|
|
return commands
|
|
}
|
|
|
|
func instanceCreatedMilestoneEvent(ctx context.Context, instanceID string) []eventstore.Command {
|
|
return []eventstore.Command{
|
|
milestone.NewReachedEvent(ctx, milestone.NewInstanceAggregate(instanceID), milestone.InstanceCreated),
|
|
}
|
|
}
|
|
|
|
func generatedDomainFilters(instanceID, orgID, projectID, appID, generatedDomain string) []expect {
|
|
return []expect{
|
|
expectFilter(),
|
|
expectFilter(
|
|
project.NewApplicationAddedEvent(context.Background(),
|
|
&project.NewAggregate(projectID, orgID).Aggregate,
|
|
appID,
|
|
"console",
|
|
),
|
|
project.NewOIDCConfigAddedEvent(context.Background(),
|
|
&project.NewAggregate(projectID, orgID).Aggregate,
|
|
domain.OIDCVersionV1,
|
|
appID,
|
|
"clientID",
|
|
"",
|
|
[]string{},
|
|
[]domain.OIDCResponseType{domain.OIDCResponseTypeCode},
|
|
[]domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
|
|
domain.OIDCApplicationTypeUserAgent,
|
|
domain.OIDCAuthMethodTypeNone,
|
|
[]string{},
|
|
true,
|
|
domain.OIDCTokenTypeBearer,
|
|
false,
|
|
false,
|
|
false,
|
|
0,
|
|
nil,
|
|
false,
|
|
"",
|
|
domain.LoginVersionUnspecified,
|
|
"",
|
|
"",
|
|
"",
|
|
"",
|
|
nil),
|
|
),
|
|
expectFilter(
|
|
func() eventstore.Event {
|
|
event := instance.NewDomainAddedEvent(context.Background(),
|
|
&instance.NewAggregate(instanceID).Aggregate,
|
|
generatedDomain,
|
|
true,
|
|
)
|
|
event.Data, _ = json.Marshal(event)
|
|
return event
|
|
}(),
|
|
),
|
|
}
|
|
}
|
|
|
|
func generatedTrustedDomainsFilters(trustedDomains []string) []expect {
|
|
filters := make([]expect, len(trustedDomains))
|
|
for i := range trustedDomains {
|
|
filters[i] = expectFilter()
|
|
}
|
|
return filters
|
|
}
|
|
|
|
func humanFilters(orgID string) []expect {
|
|
return []expect{
|
|
expectFilter(),
|
|
expectFilter(
|
|
org.NewDomainPolicyAddedEvent(
|
|
context.Background(),
|
|
&org.NewAggregate(orgID).Aggregate,
|
|
true,
|
|
true,
|
|
true,
|
|
),
|
|
),
|
|
expectFilterOrganizationSettings("org1", false, false),
|
|
expectFilter(
|
|
org.NewPasswordComplexityPolicyAddedEvent(
|
|
context.Background(),
|
|
&org.NewAggregate(orgID).Aggregate,
|
|
2,
|
|
false,
|
|
false,
|
|
false,
|
|
false,
|
|
),
|
|
),
|
|
}
|
|
}
|
|
|
|
func instanceSetupHumanConfig() *AddHuman {
|
|
return &AddHuman{
|
|
Username: "zitadel-admin",
|
|
FirstName: "ZITADEL",
|
|
LastName: "Admin",
|
|
Email: Email{
|
|
Address: domain.EmailAddress("[email protected]"),
|
|
Verified: true,
|
|
},
|
|
PreferredLanguage: language.English,
|
|
Password: "password",
|
|
PasswordChangeRequired: false,
|
|
}
|
|
}
|
|
|
|
func machineFilters(orgID string, pat bool) []expect {
|
|
filters := []expect{
|
|
expectFilter(),
|
|
expectFilter(
|
|
org.NewDomainPolicyAddedEvent(
|
|
context.Background(),
|
|
&org.NewAggregate(orgID).Aggregate,
|
|
true,
|
|
true,
|
|
true,
|
|
),
|
|
),
|
|
expectFilterOrganizationSettings("org1", false, false),
|
|
}
|
|
if pat {
|
|
filters = append(filters,
|
|
expectFilter(),
|
|
expectFilter(),
|
|
)
|
|
}
|
|
return filters
|
|
}
|
|
|
|
func instanceSetupMachineConfig() *AddMachine {
|
|
return &AddMachine{
|
|
Machine: &Machine{
|
|
Username: "zitadel-admin-machine",
|
|
Name: "ZITADEL-machine",
|
|
Description: "Admin",
|
|
AccessTokenType: domain.OIDCTokenTypeBearer,
|
|
},
|
|
Pat: &AddPat{
|
|
ExpirationDate: time.Time{},
|
|
Scopes: nil,
|
|
},
|
|
/* not predictable with the key value in the events
|
|
MachineKey: &AddMachineKey{
|
|
Type: domain.AuthNKeyTypeJSON,
|
|
ExpirationDate: time.Time{},
|
|
},
|
|
*/
|
|
}
|
|
}
|
|
|
|
func loginClientFilters(orgID string, pat bool) []expect {
|
|
filters := []expect{
|
|
expectFilter(),
|
|
expectFilter(
|
|
org.NewDomainPolicyAddedEvent(
|
|
context.Background(),
|
|
&org.NewAggregate(orgID).Aggregate,
|
|
true,
|
|
true,
|
|
true,
|
|
),
|
|
),
|
|
expectFilterOrganizationSettings("org1", false, false),
|
|
}
|
|
if pat {
|
|
filters = append(filters,
|
|
expectFilter(),
|
|
expectFilter(),
|
|
)
|
|
}
|
|
return filters
|
|
}
|
|
|
|
func instanceSetupLoginClientConfig() *AddLoginClient {
|
|
return &AddLoginClient{
|
|
Machine: &Machine{
|
|
Username: "zitadel-login-client",
|
|
Name: "ZITADEL-login-client",
|
|
Description: "Login Client",
|
|
AccessTokenType: domain.OIDCTokenTypeBearer,
|
|
},
|
|
Pat: &AddPat{
|
|
ExpirationDate: time.Time{},
|
|
Scopes: nil,
|
|
},
|
|
}
|
|
}
|
|
|
|
func projectFilters() []expect {
|
|
return []expect{
|
|
expectFilter(),
|
|
expectFilter(),
|
|
expectFilter(),
|
|
expectFilter(),
|
|
}
|
|
}
|
|
|
|
func adminMemberFilters(orgID, userID string) []expect {
|
|
filters := append(
|
|
orgMemberFilters(orgID, userID),
|
|
instanceMemberFilters(orgID, userID)...,
|
|
)
|
|
return filters
|
|
}
|
|
func orgMemberFilters(orgID, userID string) []expect {
|
|
return []expect{
|
|
expectFilter(
|
|
addHumanEvent(context.Background(), orgID, userID),
|
|
),
|
|
expectFilter(),
|
|
}
|
|
}
|
|
|
|
func instanceMemberFilters(orgID, userID string) []expect {
|
|
return []expect{
|
|
expectFilter(
|
|
addHumanEvent(context.Background(), orgID, userID),
|
|
),
|
|
expectFilter(),
|
|
}
|
|
}
|
|
|
|
func humanEvents(ctx context.Context, instanceID, orgID, userID string) []eventstore.Command {
|
|
agg := user.NewAggregate(userID, orgID)
|
|
instanceAgg := instance.NewAggregate(instanceID)
|
|
orgAgg := org.NewAggregate(orgID)
|
|
return []eventstore.Command{
|
|
addHumanEvent(ctx, orgID, userID),
|
|
user.NewHumanEmailVerifiedEvent(ctx, &agg.Aggregate),
|
|
org.NewMemberAddedEvent(ctx, &orgAgg.Aggregate, userID, domain.RoleOrgOwner),
|
|
instance.NewMemberAddedEvent(ctx, &instanceAgg.Aggregate, userID, domain.RoleIAMOwner),
|
|
}
|
|
}
|
|
|
|
func addHumanEvent(ctx context.Context, orgID, userID string) *user.HumanAddedEvent {
|
|
agg := user.NewAggregate(userID, orgID)
|
|
return func() *user.HumanAddedEvent {
|
|
event := user.NewHumanAddedEvent(
|
|
ctx,
|
|
&agg.Aggregate,
|
|
"zitadel-admin",
|
|
"ZITADEL",
|
|
"Admin",
|
|
"",
|
|
"ZITADEL Admin",
|
|
language.English,
|
|
0,
|
|
"[email protected]",
|
|
false,
|
|
)
|
|
event.AddPasswordData("$plain$x$password", false)
|
|
return event
|
|
}()
|
|
}
|
|
|
|
// machineEvents all events from setup to create the service account, machinekey can't be tested here, as the public key is not provided and as such the value in the event can't be expected
|
|
func machineEvents(ctx context.Context, instanceID, orgID, userID, patID string) []eventstore.Command {
|
|
agg := user.NewAggregate(userID, orgID)
|
|
instanceAgg := instance.NewAggregate(instanceID)
|
|
orgAgg := org.NewAggregate(orgID)
|
|
events := []eventstore.Command{addMachineEvent(ctx, orgID, userID)}
|
|
if patID != "" {
|
|
events = append(events,
|
|
user.NewPersonalAccessTokenAddedEvent(
|
|
ctx,
|
|
&agg.Aggregate,
|
|
patID,
|
|
time.Date(9999, time.December, 31, 23, 59, 59, 0, time.UTC),
|
|
nil,
|
|
),
|
|
)
|
|
}
|
|
return append(events,
|
|
org.NewMemberAddedEvent(ctx, &orgAgg.Aggregate, userID, domain.RoleOrgOwner),
|
|
instance.NewMemberAddedEvent(ctx, &instanceAgg.Aggregate, userID, domain.RoleIAMOwner),
|
|
)
|
|
}
|
|
|
|
func addMachineEvent(ctx context.Context, orgID, userID string) *user.MachineAddedEvent {
|
|
agg := user.NewAggregate(userID, orgID)
|
|
return user.NewMachineAddedEvent(ctx,
|
|
&agg.Aggregate,
|
|
"zitadel-admin-machine",
|
|
"ZITADEL-machine",
|
|
"Admin",
|
|
false,
|
|
domain.OIDCTokenTypeBearer,
|
|
)
|
|
}
|
|
|
|
// loginClientEvents all events from setup to create the login client user
|
|
func loginClientEvents(ctx context.Context, instanceID, orgID, userID, patID string) []eventstore.Command {
|
|
agg := user.NewAggregate(userID, orgID)
|
|
instanceAgg := instance.NewAggregate(instanceID)
|
|
events := []eventstore.Command{
|
|
addLoginClientEvent(ctx, orgID, userID),
|
|
instance.NewMemberAddedEvent(ctx, &instanceAgg.Aggregate, userID, domain.RoleIAMLoginClient),
|
|
}
|
|
if patID != "" {
|
|
events = append(events,
|
|
user.NewPersonalAccessTokenAddedEvent(
|
|
ctx,
|
|
&agg.Aggregate,
|
|
patID,
|
|
time.Date(9999, time.December, 31, 23, 59, 59, 0, time.UTC),
|
|
nil,
|
|
),
|
|
)
|
|
}
|
|
return events
|
|
}
|
|
|
|
func addLoginClientEvent(ctx context.Context, orgID, userID string) *user.MachineAddedEvent {
|
|
agg := user.NewAggregate(userID, orgID)
|
|
return user.NewMachineAddedEvent(ctx,
|
|
&agg.Aggregate,
|
|
"zitadel-login-client",
|
|
"ZITADEL-login-client",
|
|
"Login Client",
|
|
false,
|
|
domain.OIDCTokenTypeBearer,
|
|
)
|
|
}
|
|
|
|
func testSetup(ctx context.Context, c *Commands, validations []preparation.Validation) error {
|
|
//nolint:staticcheck
|
|
cmds, err := preparation.PrepareCommands(ctx, c.eventstore.Filter, validations...)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
_, err = c.eventstore.Push(ctx, cmds...)
|
|
return err
|
|
}
|
|
|
|
func TestCommandSide_setupMinimalInterfaces(t *testing.T) {
|
|
type fields struct {
|
|
eventstore func(t *testing.T) *eventstore.Eventstore
|
|
idGenerator id.Generator
|
|
}
|
|
type args struct {
|
|
ctx context.Context
|
|
instanceAgg *instance.Aggregate
|
|
orgAgg *org.Aggregate
|
|
owner string
|
|
ids ZitadelConfig
|
|
}
|
|
type res struct {
|
|
err func(error) bool
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
fields fields
|
|
args args
|
|
res res
|
|
}{
|
|
{
|
|
name: "create, ok",
|
|
fields: fields{
|
|
eventstore: expectEventstore(
|
|
slices.Concat(
|
|
projectFilters(),
|
|
[]expect{
|
|
expectPush(
|
|
projectAddedEvents(context.Background(),
|
|
"INSTANCE",
|
|
"ORG",
|
|
"PROJECT",
|
|
false,
|
|
)...,
|
|
),
|
|
},
|
|
)...,
|
|
),
|
|
idGenerator: id_mock.NewIDGeneratorExpectIDs(t, projectClientIDs()...),
|
|
},
|
|
args: args{
|
|
ctx: contextWithInstanceSetupInfo(context.Background(), "INSTANCE", "PROJECT", "console-id", "DOMAIN", language.Dutch),
|
|
instanceAgg: instance.NewAggregate("INSTANCE"),
|
|
orgAgg: org.NewAggregate("ORG"),
|
|
owner: "owner",
|
|
ids: instanceSetupZitadelIDs(),
|
|
},
|
|
res: res{
|
|
err: nil,
|
|
},
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
r := &Commands{
|
|
eventstore: tt.fields.eventstore(t),
|
|
idGenerator: tt.fields.idGenerator,
|
|
}
|
|
validations := make([]preparation.Validation, 0)
|
|
setupMinimalInterfaces(r, &validations, tt.args.instanceAgg, tt.args.orgAgg, tt.args.owner, tt.args.ids)
|
|
|
|
err := testSetup(tt.args.ctx, r, validations)
|
|
if tt.res.err == nil {
|
|
assert.NoError(t, err)
|
|
}
|
|
if tt.res.err != nil && !tt.res.err(err) {
|
|
t.Errorf("got wrong err: %v ", err)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
func validZitadelRoles() []authz.RoleMapping {
|
|
return []authz.RoleMapping{
|
|
{Role: domain.RoleOrgOwner, Permissions: []string{""}},
|
|
{Role: domain.RoleIAMOwner, Permissions: []string{""}},
|
|
{Role: domain.RoleIAMLoginClient, Permissions: []string{""}},
|
|
}
|
|
}
|
|
|
|
func TestCommandSide_setupAdmins(t *testing.T) {
|
|
type fields struct {
|
|
eventstore func(t *testing.T) *eventstore.Eventstore
|
|
idGenerator id.Generator
|
|
userPasswordHasher *crypto.Hasher
|
|
roles []authz.RoleMapping
|
|
keyAlgorithm crypto.EncryptionAlgorithm
|
|
}
|
|
type args struct {
|
|
ctx context.Context
|
|
instanceAgg *instance.Aggregate
|
|
orgAgg *org.Aggregate
|
|
machine *AddMachine
|
|
human *AddHuman
|
|
loginClient *AddLoginClient
|
|
}
|
|
type res struct {
|
|
owner string
|
|
pat bool
|
|
machineKey bool
|
|
loginClientPat bool
|
|
err func(error) bool
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
fields fields
|
|
args args
|
|
res res
|
|
}{
|
|
{
|
|
name: "human, ok",
|
|
fields: fields{
|
|
eventstore: expectEventstore(
|
|
slices.Concat(
|
|
humanFilters("ORG"),
|
|
adminMemberFilters("ORG", "USER"),
|
|
[]expect{
|
|
expectPush(
|
|
humanEvents(context.Background(),
|
|
"INSTANCE",
|
|
"ORG",
|
|
"USER",
|
|
)...,
|
|
),
|
|
},
|
|
)...,
|
|
),
|
|
idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "USER"),
|
|
userPasswordHasher: mockPasswordHasher("x"),
|
|
roles: validZitadelRoles(),
|
|
},
|
|
args: args{
|
|
ctx: contextWithInstanceSetupInfo(context.Background(), "INSTANCE", "PROJECT", "console-id", "DOMAIN", language.Dutch),
|
|
instanceAgg: instance.NewAggregate("INSTANCE"),
|
|
orgAgg: org.NewAggregate("ORG"),
|
|
human: instanceSetupHumanConfig(),
|
|
},
|
|
res: res{
|
|
owner: "USER",
|
|
pat: false,
|
|
machineKey: false,
|
|
err: nil,
|
|
},
|
|
},
|
|
{
|
|
name: "machine, ok",
|
|
fields: fields{
|
|
eventstore: expectEventstore(
|
|
slices.Concat(
|
|
machineFilters("ORG", true),
|
|
adminMemberFilters("ORG", "USER-MACHINE"),
|
|
[]expect{
|
|
expectPush(
|
|
machineEvents(context.Background(),
|
|
"INSTANCE",
|
|
"ORG",
|
|
"USER-MACHINE",
|
|
"PAT",
|
|
)...,
|
|
),
|
|
},
|
|
)...,
|
|
),
|
|
idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "USER-MACHINE", "PAT"),
|
|
roles: validZitadelRoles(),
|
|
keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
|
|
},
|
|
args: args{
|
|
ctx: contextWithInstanceSetupInfo(context.Background(), "INSTANCE", "PROJECT", "console-id", "DOMAIN", language.Dutch),
|
|
instanceAgg: instance.NewAggregate("INSTANCE"),
|
|
orgAgg: org.NewAggregate("ORG"),
|
|
machine: instanceSetupMachineConfig(),
|
|
},
|
|
res: res{
|
|
owner: "USER-MACHINE",
|
|
pat: true,
|
|
machineKey: false,
|
|
err: nil,
|
|
},
|
|
},
|
|
{
|
|
name: "human and machine, ok",
|
|
fields: fields{
|
|
eventstore: expectEventstore(
|
|
slices.Concat(
|
|
machineFilters("ORG", true),
|
|
adminMemberFilters("ORG", "USER-MACHINE"),
|
|
humanFilters("ORG"),
|
|
adminMemberFilters("ORG", "USER"),
|
|
[]expect{
|
|
expectPush(
|
|
slices.Concat(
|
|
machineEvents(context.Background(),
|
|
"INSTANCE",
|
|
"ORG",
|
|
"USER-MACHINE",
|
|
"PAT",
|
|
),
|
|
humanEvents(context.Background(),
|
|
"INSTANCE",
|
|
"ORG",
|
|
"USER",
|
|
),
|
|
)...,
|
|
),
|
|
},
|
|
)...,
|
|
),
|
|
userPasswordHasher: mockPasswordHasher("x"),
|
|
idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "USER-MACHINE", "PAT", "USER"),
|
|
roles: validZitadelRoles(),
|
|
keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
|
|
},
|
|
args: args{
|
|
ctx: contextWithInstanceSetupInfo(context.Background(), "INSTANCE", "PROJECT", "console-id", "DOMAIN", language.Dutch),
|
|
instanceAgg: instance.NewAggregate("INSTANCE"),
|
|
orgAgg: org.NewAggregate("ORG"),
|
|
machine: instanceSetupMachineConfig(),
|
|
human: instanceSetupHumanConfig(),
|
|
},
|
|
res: res{
|
|
owner: "USER",
|
|
pat: true,
|
|
machineKey: false,
|
|
err: nil,
|
|
},
|
|
},
|
|
{
|
|
name: "human, machine and login client, ok",
|
|
fields: fields{
|
|
eventstore: expectEventstore(
|
|
slices.Concat(
|
|
machineFilters("ORG", true),
|
|
adminMemberFilters("ORG", "USER-MACHINE"),
|
|
humanFilters("ORG"),
|
|
adminMemberFilters("ORG", "USER"),
|
|
loginClientFilters("ORG", true),
|
|
instanceMemberFilters("ORG", "USER-LOGIN-CLIENT"),
|
|
[]expect{
|
|
expectPush(
|
|
slices.Concat(
|
|
machineEvents(context.Background(),
|
|
"INSTANCE",
|
|
"ORG",
|
|
"USER-MACHINE",
|
|
"PAT",
|
|
),
|
|
humanEvents(context.Background(),
|
|
"INSTANCE",
|
|
"ORG",
|
|
"USER",
|
|
),
|
|
loginClientEvents(context.Background(),
|
|
"INSTANCE",
|
|
"ORG",
|
|
"USER-LOGIN-CLIENT",
|
|
"LOGIN-CLIENT-PAT",
|
|
),
|
|
)...,
|
|
),
|
|
},
|
|
)...,
|
|
),
|
|
userPasswordHasher: mockPasswordHasher("x"),
|
|
idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "USER-MACHINE", "PAT", "USER", "USER-LOGIN-CLIENT", "LOGIN-CLIENT-PAT"),
|
|
roles: validZitadelRoles(),
|
|
keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
|
|
},
|
|
args: args{
|
|
ctx: contextWithInstanceSetupInfo(context.Background(), "INSTANCE", "PROJECT", "console-id", "DOMAIN", language.Dutch),
|
|
instanceAgg: instance.NewAggregate("INSTANCE"),
|
|
orgAgg: org.NewAggregate("ORG"),
|
|
machine: instanceSetupMachineConfig(),
|
|
human: instanceSetupHumanConfig(),
|
|
loginClient: instanceSetupLoginClientConfig(),
|
|
},
|
|
res: res{
|
|
owner: "USER",
|
|
pat: true,
|
|
machineKey: false,
|
|
loginClientPat: true,
|
|
err: nil,
|
|
},
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
r := &Commands{
|
|
eventstore: tt.fields.eventstore(t),
|
|
idGenerator: tt.fields.idGenerator,
|
|
zitadelRoles: tt.fields.roles,
|
|
userPasswordHasher: tt.fields.userPasswordHasher,
|
|
keyAlgorithm: tt.fields.keyAlgorithm,
|
|
authAlgorithm: &mockAuthCrypto{},
|
|
}
|
|
validations := make([]preparation.Validation, 0)
|
|
owner, pat, mk, loginClientPat, err := setupAdmins(r, &validations, tt.args.instanceAgg, tt.args.orgAgg, tt.args.machine, tt.args.human, tt.args.loginClient)
|
|
if tt.res.err == nil {
|
|
assert.NoError(t, err)
|
|
}
|
|
if tt.res.err != nil && !tt.res.err(err) {
|
|
t.Errorf("got wrong err: %v ", err)
|
|
}
|
|
|
|
err = testSetup(tt.args.ctx, r, validations)
|
|
if tt.res.err == nil {
|
|
assert.NoError(t, err)
|
|
}
|
|
if tt.res.err != nil && !tt.res.err(err) {
|
|
t.Errorf("got wrong err: %v ", err)
|
|
}
|
|
|
|
if tt.res.err == nil {
|
|
assert.Equal(t, owner, tt.res.owner)
|
|
if tt.res.pat {
|
|
assert.NotNil(t, pat)
|
|
}
|
|
if tt.res.machineKey {
|
|
assert.NotNil(t, mk)
|
|
}
|
|
if tt.res.loginClientPat {
|
|
assert.NotNil(t, loginClientPat)
|
|
}
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestCommandSide_setupDefaultOrg(t *testing.T) {
|
|
type fields struct {
|
|
eventstore func(t *testing.T) *eventstore.Eventstore
|
|
idGenerator id.Generator
|
|
userPasswordHasher *crypto.Hasher
|
|
roles []authz.RoleMapping
|
|
keyAlgorithm crypto.EncryptionAlgorithm
|
|
}
|
|
type args struct {
|
|
ctx context.Context
|
|
instanceAgg *instance.Aggregate
|
|
orgName string
|
|
machine *AddMachine
|
|
human *AddHuman
|
|
loginClient *AddLoginClient
|
|
ids ZitadelConfig
|
|
}
|
|
type res struct {
|
|
pat bool
|
|
machineKey bool
|
|
loginClientPat bool
|
|
err func(error) bool
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
fields fields
|
|
args args
|
|
res res
|
|
}{
|
|
{
|
|
name: "human, machine and login client, ok",
|
|
fields: fields{
|
|
eventstore: expectEventstore(
|
|
slices.Concat(
|
|
orgFilters(
|
|
"ORG",
|
|
true,
|
|
true,
|
|
true,
|
|
),
|
|
[]expect{
|
|
expectPush(
|
|
slices.Concat(
|
|
orgEvents(context.Background(),
|
|
"INSTANCE",
|
|
"ORG",
|
|
"ZITADEL",
|
|
"PROJECT",
|
|
"DOMAIN",
|
|
false,
|
|
true,
|
|
true,
|
|
true,
|
|
),
|
|
)...,
|
|
),
|
|
},
|
|
)...,
|
|
),
|
|
userPasswordHasher: mockPasswordHasher("x"),
|
|
idGenerator: id_mock.NewIDGeneratorExpectIDs(t, orgIDs()...),
|
|
roles: validZitadelRoles(),
|
|
keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
|
|
},
|
|
args: args{
|
|
ctx: contextWithInstanceSetupInfo(context.Background(), "INSTANCE", "PROJECT", "console-id", "DOMAIN", language.Dutch),
|
|
instanceAgg: instance.NewAggregate("INSTANCE"),
|
|
orgName: "ZITADEL",
|
|
machine: &AddMachine{
|
|
Machine: &Machine{
|
|
Username: "zitadel-admin-machine",
|
|
Name: "ZITADEL-machine",
|
|
Description: "Admin",
|
|
AccessTokenType: domain.OIDCTokenTypeBearer,
|
|
},
|
|
Pat: &AddPat{
|
|
ExpirationDate: time.Time{},
|
|
Scopes: nil,
|
|
},
|
|
/* not predictable with the key value in the events
|
|
MachineKey: &AddMachineKey{
|
|
Type: domain.AuthNKeyTypeJSON,
|
|
ExpirationDate: time.Time{},
|
|
},
|
|
*/
|
|
},
|
|
human: &AddHuman{
|
|
Username: "zitadel-admin",
|
|
FirstName: "ZITADEL",
|
|
LastName: "Admin",
|
|
Email: Email{
|
|
Address: domain.EmailAddress("[email protected]"),
|
|
Verified: true,
|
|
},
|
|
PreferredLanguage: language.English,
|
|
Password: "password",
|
|
PasswordChangeRequired: false,
|
|
},
|
|
loginClient: &AddLoginClient{
|
|
Machine: &Machine{
|
|
Username: "zitadel-login-client",
|
|
Name: "ZITADEL-login-client",
|
|
Description: "Login Client",
|
|
AccessTokenType: domain.OIDCTokenTypeBearer,
|
|
},
|
|
Pat: &AddPat{
|
|
ExpirationDate: time.Time{},
|
|
Scopes: nil,
|
|
},
|
|
},
|
|
ids: ZitadelConfig{
|
|
instanceID: "INSTANCE",
|
|
orgID: "ORG",
|
|
projectID: "PROJECT",
|
|
managementConsoleAppID: "console-id",
|
|
authAppID: "auth-id",
|
|
mgmtAppID: "mgmt-id",
|
|
adminAppID: "admin-id",
|
|
},
|
|
},
|
|
res: res{
|
|
pat: true,
|
|
machineKey: false,
|
|
loginClientPat: true,
|
|
err: nil,
|
|
},
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
r := &Commands{
|
|
eventstore: tt.fields.eventstore(t),
|
|
idGenerator: tt.fields.idGenerator,
|
|
zitadelRoles: tt.fields.roles,
|
|
userPasswordHasher: tt.fields.userPasswordHasher,
|
|
keyAlgorithm: tt.fields.keyAlgorithm,
|
|
authAlgorithm: &mockAuthCrypto{},
|
|
}
|
|
validations := make([]preparation.Validation, 0)
|
|
pat, mk, loginClientPat, err := setupDefaultOrg(tt.args.ctx, r, &validations, tt.args.instanceAgg, tt.args.orgName, tt.args.machine, tt.args.human, tt.args.loginClient, tt.args.ids)
|
|
if tt.res.err == nil {
|
|
assert.NoError(t, err)
|
|
}
|
|
if tt.res.err != nil && !tt.res.err(err) {
|
|
t.Errorf("got wrong err: %v ", err)
|
|
}
|
|
|
|
err = testSetup(context.Background(), r, validations)
|
|
if tt.res.err == nil {
|
|
assert.NoError(t, err)
|
|
}
|
|
if tt.res.err != nil && !tt.res.err(err) {
|
|
t.Errorf("got wrong err: %v ", err)
|
|
}
|
|
|
|
if tt.res.err == nil {
|
|
if tt.res.pat {
|
|
assert.NotNil(t, pat)
|
|
}
|
|
if tt.res.machineKey {
|
|
assert.NotNil(t, mk)
|
|
}
|
|
if tt.res.loginClientPat {
|
|
assert.NotNil(t, loginClientPat)
|
|
}
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestCommandSide_setupInstanceElements(t *testing.T) {
|
|
type fields struct {
|
|
eventstore func(t *testing.T) *eventstore.Eventstore
|
|
}
|
|
type args struct {
|
|
ctx context.Context
|
|
instanceAgg *instance.Aggregate
|
|
setup *InstanceSetup
|
|
}
|
|
type res struct {
|
|
err func(error) bool
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
fields fields
|
|
args args
|
|
res res
|
|
}{
|
|
{
|
|
name: "ok",
|
|
fields: fields{
|
|
eventstore: expectEventstore(
|
|
slices.Concat(
|
|
setupInstanceElementsFilters("INSTANCE"),
|
|
[]expect{
|
|
expectPush(
|
|
setupInstanceElementsEvents(context.Background(),
|
|
"INSTANCE",
|
|
"ZITADEL",
|
|
language.English,
|
|
)...,
|
|
),
|
|
},
|
|
)...,
|
|
),
|
|
},
|
|
args: args{
|
|
ctx: contextWithInstanceSetupInfo(context.Background(), "INSTANCE", "PROJECT", "console-id", "DOMAIN", language.Dutch),
|
|
instanceAgg: instance.NewAggregate("INSTANCE"),
|
|
setup: setupInstanceElementsConfig(),
|
|
},
|
|
res: res{
|
|
err: nil,
|
|
},
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
r := &Commands{
|
|
eventstore: tt.fields.eventstore(t),
|
|
}
|
|
validations := setupInstanceElements(tt.args.instanceAgg, tt.args.setup)
|
|
|
|
err := testSetup(context.Background(), r, validations)
|
|
if tt.res.err == nil {
|
|
assert.NoError(t, err)
|
|
}
|
|
if tt.res.err != nil && !tt.res.err(err) {
|
|
t.Errorf("got wrong err: %v ", err)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestCommandSide_setUpInstance(t *testing.T) {
|
|
type fields struct {
|
|
eventstore func(t *testing.T) *eventstore.Eventstore
|
|
idGenerator id.Generator
|
|
userPasswordHasher *crypto.Hasher
|
|
roles []authz.RoleMapping
|
|
keyAlgorithm crypto.EncryptionAlgorithm
|
|
generateDomain func(string, string) (string, error)
|
|
}
|
|
type args struct {
|
|
ctx context.Context
|
|
setup *InstanceSetup
|
|
}
|
|
type res struct {
|
|
pat bool
|
|
machineKey bool
|
|
loginClientPat bool
|
|
err func(error) bool
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
fields fields
|
|
args args
|
|
res res
|
|
}{
|
|
{
|
|
name: "ok",
|
|
fields: fields{
|
|
eventstore: expectEventstore(
|
|
slices.Concat(
|
|
setupInstanceFilters("INSTANCE", "ORG", "PROJECT", "console-id", "DOMAIN", []string{"trusted-domain.com", "another-trusted-domain.com"}),
|
|
[]expect{
|
|
expectPush(
|
|
setupInstanceEvents(context.Background(),
|
|
"INSTANCE",
|
|
"ORG",
|
|
"PROJECT",
|
|
"console-id",
|
|
"ZITADEL",
|
|
"ZITADEL",
|
|
language.English,
|
|
"DOMAIN",
|
|
false,
|
|
[]string{"trusted-domain.com", "another-trusted-domain.com"},
|
|
)...,
|
|
),
|
|
},
|
|
)...,
|
|
),
|
|
userPasswordHasher: mockPasswordHasher("x"),
|
|
idGenerator: id_mock.NewIDGeneratorExpectIDs(t, orgIDs()...),
|
|
roles: validZitadelRoles(),
|
|
keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
|
|
generateDomain: func(string, string) (string, error) {
|
|
return "DOMAIN", nil
|
|
},
|
|
},
|
|
args: args{
|
|
ctx: contextWithInstanceSetupInfo(context.Background(), "INSTANCE", "PROJECT", "console-id", "DOMAIN", language.Dutch),
|
|
setup: setupInstanceConfig(),
|
|
},
|
|
res: res{
|
|
err: nil,
|
|
},
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
r := &Commands{
|
|
eventstore: tt.fields.eventstore(t),
|
|
idGenerator: tt.fields.idGenerator,
|
|
zitadelRoles: tt.fields.roles,
|
|
userPasswordHasher: tt.fields.userPasswordHasher,
|
|
keyAlgorithm: tt.fields.keyAlgorithm,
|
|
GenerateDomain: tt.fields.generateDomain,
|
|
authAlgorithm: &mockAuthCrypto{},
|
|
}
|
|
|
|
validations, pat, mk, loginClientPat, err := setUpInstance(tt.args.ctx, r, tt.args.setup)
|
|
if tt.res.err == nil {
|
|
assert.NoError(t, err)
|
|
}
|
|
if tt.res.err != nil && !tt.res.err(err) {
|
|
t.Errorf("got wrong err: %v ", err)
|
|
}
|
|
|
|
err = testSetup(tt.args.ctx, r, validations)
|
|
if tt.res.err == nil {
|
|
assert.NoError(t, err)
|
|
}
|
|
if tt.res.err != nil && !tt.res.err(err) {
|
|
t.Errorf("got wrong err: %v ", err)
|
|
}
|
|
|
|
if tt.res.err == nil {
|
|
if tt.res.pat {
|
|
assert.NotNil(t, pat)
|
|
}
|
|
if tt.res.machineKey {
|
|
assert.NotNil(t, mk)
|
|
}
|
|
if tt.res.loginClientPat {
|
|
assert.NotNil(t, loginClientPat)
|
|
}
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestCommandSide_UpdateInstance(t *testing.T) {
|
|
type fields struct {
|
|
eventstore func(t *testing.T) *eventstore.Eventstore
|
|
}
|
|
type args struct {
|
|
ctx context.Context
|
|
name string
|
|
}
|
|
type res struct {
|
|
want *domain.ObjectDetails
|
|
err func(error) bool
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
fields fields
|
|
args args
|
|
res res
|
|
}{
|
|
{
|
|
name: "empty name, invalid error",
|
|
fields: fields{
|
|
eventstore: expectEventstore(),
|
|
},
|
|
args: args{
|
|
ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
|
|
name: " ",
|
|
},
|
|
res: res{
|
|
err: zerrors.IsErrorInvalidArgument,
|
|
},
|
|
},
|
|
{
|
|
name: "instance not existing, not found error",
|
|
fields: fields{
|
|
eventstore: expectEventstore(
|
|
expectFilter(),
|
|
),
|
|
},
|
|
args: args{
|
|
ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
|
|
name: "INSTANCE_CHANGED",
|
|
},
|
|
res: res{
|
|
err: zerrors.IsNotFound,
|
|
},
|
|
},
|
|
{
|
|
name: "instance removed, not found error",
|
|
fields: fields{
|
|
eventstore: expectEventstore(
|
|
expectFilter(
|
|
eventFromEventPusher(
|
|
instance.NewInstanceAddedEvent(
|
|
context.Background(),
|
|
&instance.NewAggregate("INSTANCE").Aggregate,
|
|
"INSTANCE",
|
|
),
|
|
),
|
|
eventFromEventPusher(
|
|
instance.NewInstanceRemovedEvent(context.Background(),
|
|
&instance.NewAggregate("INSTANCE").Aggregate,
|
|
"INSTANCE",
|
|
nil,
|
|
),
|
|
),
|
|
),
|
|
),
|
|
},
|
|
args: args{
|
|
ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
|
|
name: "INSTANCE_CHANGED",
|
|
},
|
|
res: res{
|
|
err: zerrors.IsNotFound,
|
|
},
|
|
},
|
|
{
|
|
name: "no changes, precondition error",
|
|
fields: fields{
|
|
eventstore: expectEventstore(
|
|
expectFilter(
|
|
eventFromEventPusher(
|
|
instance.NewInstanceAddedEvent(
|
|
context.Background(),
|
|
&instance.NewAggregate("INSTANCE").Aggregate,
|
|
"INSTANCE",
|
|
),
|
|
),
|
|
),
|
|
),
|
|
},
|
|
args: args{
|
|
ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
|
|
name: "INSTANCE",
|
|
},
|
|
res: res{
|
|
want: &domain.ObjectDetails{
|
|
ResourceOwner: "INSTANCE",
|
|
},
|
|
},
|
|
},
|
|
{
|
|
name: "instance change, ok",
|
|
fields: fields{
|
|
eventstore: expectEventstore(
|
|
expectFilter(
|
|
eventFromEventPusherWithInstanceID(
|
|
"INSTANCE",
|
|
instance.NewInstanceAddedEvent(context.Background(),
|
|
&instance.NewAggregate("INSTANCE").Aggregate,
|
|
"INSTANCE",
|
|
),
|
|
),
|
|
),
|
|
expectPush(
|
|
instance.NewInstanceChangedEvent(context.Background(),
|
|
&instance.NewAggregate("INSTANCE").Aggregate,
|
|
"INSTANCE_CHANGED",
|
|
),
|
|
),
|
|
),
|
|
},
|
|
args: args{
|
|
ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
|
|
name: "INSTANCE_CHANGED",
|
|
},
|
|
res: res{
|
|
want: &domain.ObjectDetails{
|
|
ResourceOwner: "INSTANCE",
|
|
},
|
|
},
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
r := &Commands{
|
|
eventstore: tt.fields.eventstore(t),
|
|
}
|
|
got, err := r.UpdateInstance(tt.args.ctx, tt.args.name)
|
|
if tt.res.err == nil {
|
|
assert.NoError(t, err)
|
|
}
|
|
if tt.res.err != nil && !tt.res.err(err) {
|
|
t.Errorf("got wrong err: %v ", err)
|
|
}
|
|
if tt.res.err == nil {
|
|
assertObjectDetails(t, tt.res.want, got)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestCommandSide_RemoveInstance(t *testing.T) {
|
|
type fields struct {
|
|
eventstore func(t *testing.T) *eventstore.Eventstore
|
|
}
|
|
type args struct {
|
|
ctx context.Context
|
|
instanceID string
|
|
errorIfNotFound bool
|
|
}
|
|
type res struct {
|
|
want *domain.ObjectDetails
|
|
err func(error) bool
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
fields fields
|
|
args args
|
|
res res
|
|
}{
|
|
{
|
|
name: "instance empty, invalid argument error",
|
|
fields: fields{
|
|
eventstore: func(t *testing.T) *eventstore.Eventstore { return &eventstore.Eventstore{} },
|
|
},
|
|
args: args{
|
|
ctx: authz.WithInstanceID(context.Background(), " "),
|
|
instanceID: " ",
|
|
},
|
|
res: res{
|
|
err: zerrors.IsErrorInvalidArgument,
|
|
},
|
|
},
|
|
{
|
|
name: "instance too long, invalid argument error",
|
|
fields: fields{
|
|
eventstore: func(t *testing.T) *eventstore.Eventstore { return &eventstore.Eventstore{} },
|
|
},
|
|
args: args{
|
|
ctx: authz.WithInstanceID(context.Background(), "averylonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonginstance"),
|
|
instanceID: "averylonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglonginstance",
|
|
},
|
|
res: res{
|
|
err: zerrors.IsErrorInvalidArgument,
|
|
},
|
|
},
|
|
{
|
|
name: "instance not existing, not found error",
|
|
fields: fields{
|
|
eventstore: expectEventstore(
|
|
expectFilter(),
|
|
),
|
|
},
|
|
args: args{
|
|
ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
|
|
instanceID: "INSTANCE",
|
|
errorIfNotFound: true,
|
|
},
|
|
res: res{
|
|
err: zerrors.IsNotFound,
|
|
},
|
|
},
|
|
{
|
|
name: "instance not existing, no error",
|
|
fields: fields{
|
|
eventstore: expectEventstore(
|
|
expectFilter(),
|
|
),
|
|
},
|
|
args: args{
|
|
ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
|
|
instanceID: "INSTANCE",
|
|
errorIfNotFound: false,
|
|
},
|
|
res: res{},
|
|
},
|
|
{
|
|
name: "instance removed, not found error",
|
|
fields: fields{
|
|
eventstore: expectEventstore(
|
|
expectFilter(
|
|
eventFromEventPusher(
|
|
instance.NewInstanceAddedEvent(
|
|
context.Background(),
|
|
&instance.NewAggregate("INSTANCE").Aggregate,
|
|
"INSTANCE",
|
|
),
|
|
),
|
|
eventFromEventPusher(
|
|
instance.NewInstanceRemovedEvent(context.Background(),
|
|
&instance.NewAggregate("INSTANCE").Aggregate,
|
|
"INSTANCE",
|
|
nil,
|
|
),
|
|
),
|
|
),
|
|
),
|
|
},
|
|
args: args{
|
|
ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
|
|
instanceID: "INSTANCE",
|
|
errorIfNotFound: true,
|
|
},
|
|
res: res{
|
|
err: zerrors.IsNotFound,
|
|
},
|
|
},
|
|
{
|
|
name: "instance removed, no error",
|
|
fields: fields{
|
|
eventstore: expectEventstore(
|
|
expectFilter(
|
|
eventFromEventPusher(
|
|
instance.NewInstanceAddedEvent(
|
|
context.Background(),
|
|
&instance.NewAggregate("INSTANCE").Aggregate,
|
|
"INSTANCE",
|
|
),
|
|
),
|
|
eventFromEventPusher(
|
|
instance.NewInstanceRemovedEvent(context.Background(),
|
|
&instance.NewAggregate("INSTANCE").Aggregate,
|
|
"INSTANCE",
|
|
nil,
|
|
),
|
|
),
|
|
),
|
|
),
|
|
},
|
|
args: args{
|
|
ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
|
|
instanceID: "INSTANCE",
|
|
errorIfNotFound: false,
|
|
},
|
|
res: res{},
|
|
},
|
|
{
|
|
name: "instance remove, ok",
|
|
fields: fields{
|
|
eventstore: expectEventstore(
|
|
expectFilter(
|
|
eventFromEventPusherWithInstanceID(
|
|
"INSTANCE",
|
|
instance.NewInstanceAddedEvent(context.Background(),
|
|
&instance.NewAggregate("INSTANCE").Aggregate,
|
|
"INSTANCE",
|
|
),
|
|
),
|
|
eventFromEventPusherWithInstanceID(
|
|
"INSTANCE",
|
|
instance.NewDomainAddedEvent(context.Background(),
|
|
&instance.NewAggregate("INSTANCE").Aggregate,
|
|
"instance.domain",
|
|
true,
|
|
),
|
|
),
|
|
eventFromEventPusherWithInstanceID(
|
|
"INSTANCE",
|
|
instance.NewDomainAddedEvent(context.Background(),
|
|
&instance.NewAggregate("INSTANCE").Aggregate,
|
|
"custom.domain",
|
|
false,
|
|
),
|
|
),
|
|
),
|
|
expectPush(
|
|
instance.NewInstanceRemovedEvent(context.Background(),
|
|
&instance.NewAggregate("INSTANCE").Aggregate,
|
|
"INSTANCE",
|
|
[]string{
|
|
"instance.domain",
|
|
"custom.domain",
|
|
},
|
|
),
|
|
milestone.NewReachedEvent(context.Background(),
|
|
milestone.NewInstanceAggregate("INSTANCE"),
|
|
milestone.InstanceDeleted,
|
|
),
|
|
),
|
|
),
|
|
},
|
|
args: args{
|
|
ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
|
|
instanceID: "INSTANCE",
|
|
},
|
|
res: res{
|
|
want: &domain.ObjectDetails{
|
|
ResourceOwner: "INSTANCE",
|
|
},
|
|
},
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
r := &Commands{
|
|
eventstore: tt.fields.eventstore(t),
|
|
caches: &Caches{
|
|
milestones: noop.NewCache[milestoneIndex, string, *MilestonesReached](),
|
|
},
|
|
}
|
|
got, err := r.RemoveInstance(tt.args.ctx, tt.args.instanceID, tt.args.errorIfNotFound)
|
|
if tt.res.err == nil {
|
|
assert.NoError(t, err)
|
|
}
|
|
if tt.res.err != nil && !tt.res.err(err) {
|
|
t.Errorf("got wrong err: %v ", err)
|
|
}
|
|
if tt.res.err == nil {
|
|
assertObjectDetails(t, tt.res.want, got)
|
|
}
|
|
})
|
|
}
|
|
}
|