@@ -19,103 +19,103 @@ import (
19
19
// attempts to login, the error message doesn't expose the list of authorized domains.
20
20
func TestOIDCDomainErrorMessage (t * testing.T ) {
21
21
t .Parallel ()
22
-
22
+
23
23
// Setup OIDC fake provider
24
24
fake := oidctest .NewFakeIDP (t , oidctest .WithServing ())
25
-
25
+
26
26
// Configure OIDC provider with domain restrictions
27
27
allowedDomains := []string {"allowed1.com" , "allowed2.org" , "company.internal" }
28
28
cfg := fake .OIDCConfig (t , nil , func (cfg * coderd.OIDCConfig ) {
29
29
cfg .EmailDomain = allowedDomains
30
30
cfg .AllowSignups = true
31
31
})
32
-
32
+
33
33
// Create a Coder server with OIDC enabled
34
34
server := coderdtest .New (t , & coderdtest.Options {
35
35
OIDCConfig : cfg ,
36
36
})
37
-
37
+
38
38
// Test case 1: Email domain not in allowed list
39
39
t .Run ("ErrorMessageOmitsDomains" , func (t * testing.T ) {
40
40
t .Parallel ()
41
-
41
+
42
42
// Prepare claims with email from unauthorized domain
43
43
claims := jwt.MapClaims {
44
44
"email" : "user@unauthorized.com" ,
45
45
"email_verified" : true ,
46
46
"sub" : uuid .NewString (),
47
47
}
48
-
48
+
49
49
// Attempt login and check for failure
50
50
_ , resp := fake .AttemptLogin (t , server , claims )
51
51
defer resp .Body .Close ()
52
-
52
+
53
53
// Verify the status code
54
54
require .Equal (t , http .StatusForbidden , resp .StatusCode )
55
-
55
+
56
56
// Check the response content
57
57
data , err := io .ReadAll (resp .Body )
58
58
require .NoError (t , err )
59
-
59
+
60
60
// Verify the message contains the generic text
61
61
require .Contains (t , string (data ), "is not from an authorized domain" )
62
62
require .Contains (t , string (data ), "Please contact your administrator" )
63
-
63
+
64
64
// Verify it doesn't contain any of the allowed domains
65
65
for _ , domain := range allowedDomains {
66
66
require .NotContains (t , string (data ), domain )
67
67
}
68
68
})
69
-
69
+
70
70
// Test case 2: Malformed email without @ symbol
71
71
t .Run ("MalformedEmailErrorOmitsDomains" , func (t * testing.T ) {
72
72
t .Parallel ()
73
-
73
+
74
74
// Prepare claims with an invalid email format (no @ symbol)
75
75
claims := jwt.MapClaims {
76
76
"email" : "invalid-email-without-domain" ,
77
77
"email_verified" : true ,
78
78
"sub" : uuid .NewString (),
79
79
}
80
-
80
+
81
81
// Attempt login and check for failure
82
82
_ , resp := fake .AttemptLogin (t , server , claims )
83
83
defer resp .Body .Close ()
84
-
84
+
85
85
// Verify the status code
86
86
require .Equal (t , http .StatusForbidden , resp .StatusCode )
87
-
87
+
88
88
// Check the response content
89
89
data , err := io .ReadAll (resp .Body )
90
90
require .NoError (t , err )
91
-
91
+
92
92
// Verify the message contains the generic text
93
93
require .Contains (t , string (data ), "is not from an authorized domain" )
94
94
require .Contains (t , string (data ), "Please contact your administrator" )
95
-
95
+
96
96
// Verify it doesn't contain any of the allowed domains
97
97
for _ , domain := range allowedDomains {
98
98
require .NotContains (t , string (data ), domain )
99
99
}
100
100
})
101
-
101
+
102
102
// Test case 3: Authorized domain (should succeed)
103
103
t .Run ("AuthorizedDomainSucceeds" , func (t * testing.T ) {
104
104
t .Parallel ()
105
-
105
+
106
106
// Prepare claims with an authorized domain
107
107
claims := jwt.MapClaims {
108
108
"email" : "user@allowed1.com" ,
109
109
"email_verified" : true ,
110
110
"sub" : uuid .NewString (),
111
111
}
112
-
112
+
113
113
// Attempt login and expect success
114
114
client , _ := fake .Login (t , server , claims )
115
-
115
+
116
116
// Verify the user was created correctly
117
117
user , err := client .User (context .Background (), "me" )
118
118
require .NoError (t , err )
119
119
require .Equal (t , "user" , user .Username )
120
120
})
121
- }
121
+ }
0 commit comments