Skip to content

Commit 1858d2e

Browse files
XiNiHaXiNiHa
committed
update oidc tests to match the latest requirements
1 parent 5af24c0 commit 1858d2e

File tree

4 files changed

+116
-147
lines changed

4 files changed

+116
-147
lines changed

‎integration-tests/testkit/flow.ts‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,17 @@ export function getOrganization(organizationSlug: string, authToken: string) {
158158
reportingOperations
159159
enablingUsageBasedBreakingChanges
160160
}
161+
me {
162+
id
163+
user {
164+
id
165+
}
166+
role {
167+
id
168+
name
169+
permissions
170+
}
171+
}
161172
}
162173
}
163174
`),

‎integration-tests/testkit/seed.ts‎

Lines changed: 48 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -889,49 +889,69 @@ export function initSeed() {
889889
},
890890
};
891891
},
892-
async inviteAndJoinMember(
893-
inviteToken: string = ownerToken,
894-
memberRoleId: string | undefined = undefined,
895-
resources: GraphQLSchema.ResourceAssignmentInput | undefined = undefined,
896-
) {
892+
async inviteAndJoinMember(options?: {
893+
inviteToken?: string;
894+
memberRoleId?: string | undefined;
895+
oidcIntegrationId?: string | undefined;
896+
resources?: GraphQLSchema.ResourceAssignmentInput | undefined;
897+
}) {
898+
const { inviteToken, memberRoleId, oidcIntegrationId, resources } = Object.assign(
899+
options ?? {},
900+
{
901+
inviteToken: ownerToken,
902+
},
903+
);
897904
const memberEmail = userEmail(generateUnique());
898-
const memberToken = await authenticate(memberEmail).then(r => r.access_token);
905+
const memberToken = await authenticate(memberEmail, oidcIntegrationId).then(
906+
r => r.access_token,
907+
);
899908

900-
const invitationResult = await inviteToOrganization(
901-
{
902-
organization: {
903-
bySelector: {
904-
organizationSlug: organization.slug,
909+
if (!oidcIntegrationId) {
910+
const invitationResult = await inviteToOrganization(
911+
{
912+
organization: {
913+
bySelector: {
914+
organizationSlug: organization.slug,
915+
},
905916
},
917+
email: memberEmail,
918+
memberRoleId,
919+
resources,
906920
},
907-
email: memberEmail,
908-
memberRoleId,
909-
resources,
910-
},
911-
inviteToken,
912-
).then(r => r.expectNoGraphQLErrors());
913-
914-
const code =
915-
invitationResult.inviteToOrganizationByEmail.ok?.createdOrganizationInvitation.code;
921+
inviteToken,
922+
).then(r => r.expectNoGraphQLErrors());
923+
const code =
924+
invitationResult.inviteToOrganizationByEmail.ok?.createdOrganizationInvitation
925+
.code;
926+
927+
if (!code) {
928+
throw new Error(
929+
`Could not create invitation for ${memberEmail} to join org ${organization.slug}`,
930+
);
931+
}
916932

917-
if (!code) {
918-
throw new Error(
919-
`Could not create invitation for ${memberEmail} to join org ${organization.slug}`,
933+
const joinResult = await joinOrganization(code, memberToken).then(r =>
934+
r.expectNoGraphQLErrors(),
920935
);
936+
937+
if (joinResult.joinOrganization.__typename !== 'OrganizationPayload') {
938+
throw new Error(
939+
`Member ${memberEmail} could not join organization ${organization.slug}`,
940+
);
941+
}
921942
}
922943

923-
const joinResult = await joinOrganization(code, memberToken).then(r =>
944+
const orgAfterJoin = await getOrganization(organization.slug, memberToken).then(r =>
924945
r.expectNoGraphQLErrors(),
925946
);
947+
const member = orgAfterJoin.organization?.me;
926948

927-
if (joinResult.joinOrganization.__typename !== 'OrganizationPayload') {
949+
if (!member) {
928950
throw new Error(
929-
`Member ${memberEmail} could not join organization ${organization.slug}`,
951+
`Could not retrieve membership for ${memberEmail} in ${organization.slug} after joining`,
930952
);
931953
}
932954

933-
const member = joinResult.joinOrganization.organization.me;
934-
935955
return {
936956
member,
937957
memberEmail,

‎integration-tests/tests/api/oidc-integrations/crud.spec.ts‎

Lines changed: 42 additions & 107 deletions
Original file line numberDiff line numberDiff line change
@@ -540,78 +540,6 @@ describe('delete', () => {
540540
]),
541541
);
542542
});
543-
544-
test.concurrent(
545-
'success: upon integration deletion oidc members are also deleted',
546-
async ({ expect }) => {
547-
const seed = initSeed();
548-
const { ownerToken, createOrg } = await seed.createOwner();
549-
const { organization } = await createOrg();
550-
551-
const createResult = await execute({
552-
document: CreateOIDCIntegrationMutation,
553-
variables: {
554-
input: {
555-
organizationId: organization.id,
556-
clientId: 'foo',
557-
clientSecret: 'foofoofoofoo',
558-
tokenEndpoint: 'http://localhost:8888/oauth/token',
559-
userinfoEndpoint: 'http://localhost:8888/oauth/userinfo',
560-
authorizationEndpoint: 'http://localhost:8888/oauth/authorize',
561-
},
562-
},
563-
authToken: ownerToken,
564-
}).then(r => r.expectNoGraphQLErrors());
565-
566-
const oidcIntegrationId = createResult.createOIDCIntegration.ok!.createdOIDCIntegration.id;
567-
568-
const MeQuery = graphql(`
569-
query Me {
570-
me {
571-
id
572-
}
573-
}
574-
`);
575-
576-
const { access_token: memberAccessToken } = await seed.authenticate(
577-
seed.generateEmail(),
578-
oidcIntegrationId,
579-
);
580-
const meResult = await execute({
581-
document: MeQuery,
582-
authToken: memberAccessToken,
583-
}).then(r => r.expectNoGraphQLErrors());
584-
585-
expect(meResult).toEqual({
586-
me: {
587-
id: expect.any(String),
588-
},
589-
});
590-
591-
await execute({
592-
document: DeleteOIDCIntegrationMutation,
593-
variables: {
594-
input: {
595-
oidcIntegrationId,
596-
},
597-
},
598-
authToken: ownerToken,
599-
}).then(r => r.expectNoGraphQLErrors());
600-
601-
const refetchedMeResult = await execute({
602-
document: MeQuery,
603-
authToken: memberAccessToken,
604-
}).then(r => r.expectGraphQLErrors());
605-
606-
expect(refetchedMeResult).toEqual(
607-
expect.arrayContaining([
608-
expect.objectContaining({
609-
message: `No access (reason: "User not found")`,
610-
}),
611-
]),
612-
);
613-
},
614-
);
615543
});
616544
});
617545

@@ -777,45 +705,50 @@ describe('restrictions', () => {
777705
return result.createOIDCIntegration.ok!.createdOIDCIntegration.id;
778706
}
779707

780-
test.concurrent('non-oidc users cannot join an organization (default)', async ({ expect }) => {
781-
const seed = initSeed();
782-
const { ownerToken, createOrg } = await seed.createOwner();
783-
const { organization, inviteMember, joinMemberUsingCode } = await createOrg();
708+
test.concurrent(
709+
'users authorized with non-OIDC method cannot join an organization (default)',
710+
async ({ expect }) => {
711+
const seed = initSeed();
712+
const { ownerToken, createOrg } = await seed.createOwner();
713+
const { organization, inviteMember, joinMemberUsingCode } = await createOrg();
784714

785-
await configureOIDC({
786-
ownerToken,
787-
organizationId: organization.id,
788-
});
715+
await configureOIDC({
716+
ownerToken,
717+
organizationId: organization.id,
718+
});
789719

790-
const refetchedOrg = await execute({
791-
document: OrganizationWithOIDCIntegration,
792-
variables: {
793-
organizationSlug: organization.slug,
794-
},
795-
authToken: ownerToken,
796-
}).then(r => r.expectNoGraphQLErrors());
720+
const refetchedOrg = await execute({
721+
document: OrganizationWithOIDCIntegration,
722+
variables: {
723+
organizationSlug: organization.slug,
724+
},
725+
authToken: ownerToken,
726+
}).then(r => r.expectNoGraphQLErrors());
797727

798-
expect(refetchedOrg.organization?.oidcIntegration?.oidcUserAccessOnly).toEqual(true);
728+
expect(refetchedOrg.organization?.oidcIntegration?.oidcUserAccessOnly).toEqual(true);
799729

800-
const invitation = await inviteMember('example@example.com');
801-
const invitationCode = invitation.ok?.createdOrganizationInvitation.code;
730+
const invitation = await inviteMember('example@example.com');
731+
const invitationCode = invitation.ok?.createdOrganizationInvitation.code;
802732

803-
if (!invitationCode) {
804-
throw new Error('No invitation code');
805-
}
733+
if (!invitationCode) {
734+
throw new Error('No invitation code');
735+
}
806736

807-
const nonOidcAccount = await seed.authenticate(userEmail('non-oidc-user'));
808-
const joinResult = await joinMemberUsingCode(invitationCode, nonOidcAccount.access_token).then(
809-
r => r.expectNoGraphQLErrors(),
810-
);
737+
const nonOidcAccount = await seed.authenticate(userEmail('non-oidc-user'));
738+
const joinResult = await joinMemberUsingCode(
739+
invitationCode,
740+
nonOidcAccount.access_token,
741+
).then(r => r.expectNoGraphQLErrors());
811742

812-
expect(joinResult.joinOrganization).toEqual(
813-
expect.objectContaining({
814-
__typename: 'OrganizationInvitationError',
815-
message: 'Non-OIDC users are not allowed to join this organization.',
816-
}),
817-
);
818-
});
743+
expect(joinResult.joinOrganization).toEqual(
744+
expect.objectContaining({
745+
__typename: 'OrganizationInvitationError',
746+
message:
747+
'The user is not authorized through the OIDC integration required for the organization',
748+
}),
749+
);
750+
},
751+
);
819752

820753
test.concurrent('non-oidc users can join an organization (opt-in)', async ({ expect }) => {
821754
const seed = initSeed();
@@ -925,10 +858,8 @@ test.concurrent(
925858
const seed = initSeed();
926859
const { createOrg, ownerToken } = await seed.createOwner();
927860
const { organization, inviteAndJoinMember } = await createOrg();
928-
const { createMemberRole, assignMemberRole, updateMemberRole, memberToken, member } =
929-
await inviteAndJoinMember();
930861

931-
await execute({
862+
const createOIDCIntegrationResult = await execute({
932863
document: CreateOIDCIntegrationMutation,
933864
variables: {
934865
input: {
@@ -942,7 +873,11 @@ test.concurrent(
942873
},
943874
authToken: ownerToken,
944875
}).then(r => r.expectNoGraphQLErrors());
876+
const oidcIntegrationId =
877+
createOIDCIntegrationResult.createOIDCIntegration.ok?.createdOIDCIntegration.id;
945878

879+
const { createMemberRole, assignMemberRole, updateMemberRole, memberToken, member } =
880+
await inviteAndJoinMember({ oidcIntegrationId });
946881
const role = await createMemberRole([]);
947882
await assignMemberRole({ roleId: role.id, userId: member.id });
948883

‎integration-tests/tests/api/organization/members.spec.ts‎

Lines changed: 15 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -154,18 +154,21 @@ test.concurrent('invite user with assigned resouces', async ({ expect }) => {
154154
const m = await org.inviteAndJoinMember();
155155
const role = await m.createMemberRole(['organization:describe', 'project:describe']);
156156

157-
const member = await org.inviteAndJoinMember(undefined, role.id, {
158-
mode: ResourceAssignmentModeType.Granular,
159-
projects: [
160-
{
161-
projectId: project1.id,
162-
targets: { mode: ResourceAssignmentModeType.Granular, targets: [] },
163-
},
164-
{
165-
projectId: project3.id,
166-
targets: { mode: ResourceAssignmentModeType.Granular, targets: [] },
167-
},
168-
],
157+
const member = await org.inviteAndJoinMember({
158+
memberRoleId: role.id,
159+
resources: {
160+
mode: ResourceAssignmentModeType.Granular,
161+
projects: [
162+
{
163+
projectId: project1.id,
164+
targets: { mode: ResourceAssignmentModeType.Granular, targets: [] },
165+
},
166+
{
167+
projectId: project3.id,
168+
targets: { mode: ResourceAssignmentModeType.Granular, targets: [] },
169+
},
170+
],
171+
},
169172
});
170173

171174
const result = await org.projects(member.memberToken);

0 commit comments

Comments
 (0)