336 lines
9.6 KiB
Rust
336 lines
9.6 KiB
Rust
#![cfg(feature = "sqlite")]
|
|
|
|
use nx9_auth::db::{
|
|
self,
|
|
models::Tenant,
|
|
provider::{DatabaseProvider, SqliteProvider},
|
|
};
|
|
use nx9_auth::identity::{applications, slug};
|
|
use std::sync::Arc;
|
|
|
|
async fn setup_test_provider() -> (Arc<SqliteProvider>, String) {
|
|
let db_id = uuid::Uuid::new_v4().to_string();
|
|
let db_path = format!("target/test_slug_{}.db", db_id);
|
|
let pool = db::create_pool(&db_path)
|
|
.await
|
|
.expect("Failed to create test pool");
|
|
db::run_migrations(&pool)
|
|
.await
|
|
.expect("Failed to run migrations");
|
|
(Arc::new(SqliteProvider::new(pool)), db_path)
|
|
}
|
|
|
|
async fn teardown_test_db(path: String) {
|
|
let _ = std::fs::remove_file(path);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_canonical_slug_validation_and_policy() {
|
|
// Valid slugs
|
|
assert!(slug::validate_slug("default").is_ok());
|
|
assert!(slug::validate_slug("my-app-1").is_ok());
|
|
assert!(slug::validate_slug("acme-tenant").is_ok());
|
|
assert!(slug::validate_slug("ab").is_ok());
|
|
|
|
// Invalid length
|
|
assert!(slug::validate_slug("a").is_err());
|
|
let long_slug = "a".repeat(64);
|
|
assert!(slug::validate_slug(&long_slug).is_err());
|
|
|
|
// Invalid formatting
|
|
assert!(slug::validate_slug("-invalid").is_err());
|
|
assert!(slug::validate_slug("invalid-").is_err());
|
|
assert!(slug::validate_slug("in--valid").is_err());
|
|
assert!(slug::validate_slug("Invalid").is_err());
|
|
assert!(slug::validate_slug("in_valid").is_err());
|
|
|
|
// Reserved names
|
|
assert!(slug::validate_slug("admin").is_err());
|
|
assert!(slug::validate_slug("api").is_err());
|
|
assert!(slug::validate_slug("system").is_err());
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_explicit_invalid_slug_rejection_no_silent_slugify() {
|
|
let (provider, db_path) = setup_test_provider().await;
|
|
|
|
// Explicit invalid slug must be rejected directly and NOT silently slugified
|
|
let tenant_id = uuid::Uuid::new_v4().to_string();
|
|
let res = provider
|
|
.tenants()
|
|
.create(&tenant_id, "My Organization", Some("INVALID SLUG!"))
|
|
.await;
|
|
|
|
assert!(res.is_err(), "Explicit invalid slug should be rejected");
|
|
|
|
teardown_test_db(db_path).await;
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_omitted_slug_generation_on_create() {
|
|
let (provider, db_path) = setup_test_provider().await;
|
|
|
|
let tenant_id = uuid::Uuid::new_v4().to_string();
|
|
let tenant = provider
|
|
.tenants()
|
|
.create(&tenant_id, "Acme Corporation Inc!", None)
|
|
.await
|
|
.expect("Should derive slug from name when omitted");
|
|
|
|
assert_eq!(tenant.slug.as_deref(), Some("acme-corporation-inc"));
|
|
|
|
teardown_test_db(db_path).await;
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_same_resource_duplicate_rejection() {
|
|
let (provider, db_path) = setup_test_provider().await;
|
|
|
|
let id1 = uuid::Uuid::new_v4().to_string();
|
|
provider
|
|
.tenants()
|
|
.create(&id1, "Tenant One", Some("tenant-one"))
|
|
.await
|
|
.expect("First tenant creation should succeed");
|
|
|
|
let id2 = uuid::Uuid::new_v4().to_string();
|
|
let res = provider
|
|
.tenants()
|
|
.create(&id2, "Tenant Two", Some("tenant-one"))
|
|
.await;
|
|
|
|
assert!(res.is_err(), "Duplicate tenant slug must be rejected");
|
|
|
|
teardown_test_db(db_path).await;
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_cross_resource_collision_rejection() {
|
|
let (provider, db_path) = setup_test_provider().await;
|
|
let provider_dyn: Arc<dyn nx9_auth::db::provider::DatabaseProvider> = provider.clone();
|
|
|
|
// Create a tenant with slug "shared-identifier"
|
|
let t_id = uuid::Uuid::new_v4().to_string();
|
|
provider
|
|
.tenants()
|
|
.create(&t_id, "Shared Tenant", Some("shared-identifier"))
|
|
.await
|
|
.expect("Tenant creation should succeed");
|
|
|
|
// Attempting to create an application with the SAME slug "shared-identifier" must fail
|
|
let app_res = applications::create(
|
|
&provider_dyn,
|
|
Tenant::DEFAULT_ID,
|
|
"Colliding Application",
|
|
"shared-identifier",
|
|
None,
|
|
None,
|
|
None,
|
|
None,
|
|
None,
|
|
None,
|
|
)
|
|
.await;
|
|
|
|
assert!(
|
|
app_res.is_err(),
|
|
"Cross-resource slug collision (app vs tenant) must be rejected"
|
|
);
|
|
|
|
teardown_test_db(db_path).await;
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_unchanged_slug_update_no_op() {
|
|
let (provider, db_path) = setup_test_provider().await;
|
|
|
|
let id = uuid::Uuid::new_v4().to_string();
|
|
provider
|
|
.tenants()
|
|
.create(&id, "Original Name", Some("stable-slug"))
|
|
.await
|
|
.expect("Tenant creation should succeed");
|
|
|
|
// Updating tenant name while keeping the exact same slug must succeed (no-op for registry)
|
|
let update_res = provider
|
|
.tenants()
|
|
.update(&id, "Updated Name", Some("stable-slug"))
|
|
.await;
|
|
|
|
assert!(
|
|
update_res.is_ok(),
|
|
"Unchanged slug update should succeed as no-op"
|
|
);
|
|
|
|
let updated = provider.tenants().find_by_id(&id).await.unwrap().unwrap();
|
|
assert_eq!(updated.name, "Updated Name");
|
|
assert_eq!(updated.slug.as_deref(), Some("stable-slug"));
|
|
|
|
teardown_test_db(db_path).await;
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_rename_and_old_slug_release() {
|
|
let (provider, db_path) = setup_test_provider().await;
|
|
|
|
let id = uuid::Uuid::new_v4().to_string();
|
|
provider
|
|
.tenants()
|
|
.create(&id, "Alpha Tenant", Some("old-alpha-slug"))
|
|
.await
|
|
.expect("Tenant creation should succeed");
|
|
|
|
// Rename to new-alpha-slug
|
|
provider
|
|
.tenants()
|
|
.update(&id, "Alpha Tenant", Some("new-alpha-slug"))
|
|
.await
|
|
.expect("Rename should succeed");
|
|
|
|
// Verify old-alpha-slug is released and can be claimed by another resource
|
|
let id2 = uuid::Uuid::new_v4().to_string();
|
|
let claim_res = provider
|
|
.tenants()
|
|
.create(&id2, "Beta Tenant", Some("old-alpha-slug"))
|
|
.await;
|
|
|
|
assert!(
|
|
claim_res.is_ok(),
|
|
"Released old slug should be claimable by new resource"
|
|
);
|
|
|
|
teardown_test_db(db_path).await;
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_slug_release_ownership_verification() {
|
|
let (provider, db_path) = setup_test_provider().await;
|
|
|
|
let id1 = uuid::Uuid::new_v4().to_string();
|
|
provider
|
|
.tenants()
|
|
.create(&id1, "Tenant One", Some("tenant-slug-1"))
|
|
.await
|
|
.expect("Tenant 1 creation should succeed");
|
|
|
|
// Attempting to release tenant-slug-1 using a wrong entity_id (id2) directly via sqlite helper
|
|
let mut tx = provider.pool.begin().await.unwrap();
|
|
let rows = db::repository::sqlite::global_slugs::release_slug_by_name_sqlite(
|
|
&mut tx,
|
|
"tenant-slug-1",
|
|
"tenant",
|
|
"wrong-entity-id",
|
|
)
|
|
.await
|
|
.unwrap();
|
|
tx.commit().await.unwrap();
|
|
|
|
assert_eq!(
|
|
rows, 0,
|
|
"Release with wrong entity_id ownership must affect 0 rows"
|
|
);
|
|
|
|
// Verify tenant-slug-1 is still registered in global_slugs
|
|
let existing_slug = provider
|
|
.global_slugs()
|
|
.find_by_slug("tenant-slug-1")
|
|
.await
|
|
.unwrap();
|
|
assert!(
|
|
existing_slug.is_some(),
|
|
"Registration must remain intact when release ownership fails"
|
|
);
|
|
|
|
teardown_test_db(db_path).await;
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_deletion_slug_release() {
|
|
let (provider, db_path) = setup_test_provider().await;
|
|
|
|
let id = uuid::Uuid::new_v4().to_string();
|
|
provider
|
|
.tenants()
|
|
.create(&id, "Temporary Tenant", Some("temp-tenant-slug"))
|
|
.await
|
|
.expect("Tenant creation should succeed");
|
|
|
|
// Delete tenant
|
|
provider
|
|
.tenants()
|
|
.delete(&id)
|
|
.await
|
|
.expect("Tenant deletion should succeed");
|
|
|
|
// Verify temp-tenant-slug is released from global_slugs
|
|
let found = provider
|
|
.global_slugs()
|
|
.find_by_slug("temp-tenant-slug")
|
|
.await
|
|
.unwrap();
|
|
assert!(
|
|
found.is_none(),
|
|
"Slug must be removed from global_slugs after deletion"
|
|
);
|
|
|
|
teardown_test_db(db_path).await;
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_application_slug_never_authenticates_as_client_id() {
|
|
let (provider, db_path) = setup_test_provider().await;
|
|
let provider_dyn: Arc<dyn nx9_auth::db::provider::DatabaseProvider> = provider.clone();
|
|
|
|
let (app, raw_secret) = applications::create(
|
|
&provider_dyn,
|
|
Tenant::DEFAULT_ID,
|
|
"Auth App",
|
|
"auth-app-slug",
|
|
None,
|
|
None,
|
|
None,
|
|
None,
|
|
None,
|
|
None,
|
|
)
|
|
.await
|
|
.expect("App creation should succeed");
|
|
|
|
// Authenticating using canonical client_id must succeed
|
|
let auth_ok =
|
|
applications::validate_client_credentials(&provider_dyn, app.get_client_id(), &raw_secret)
|
|
.await;
|
|
assert!(
|
|
auth_ok.is_ok(),
|
|
"Authentication with client_id must succeed"
|
|
);
|
|
|
|
// Authenticating using application SLUG as client_id MUST FAIL
|
|
let auth_slug_fail =
|
|
applications::validate_client_credentials(&provider_dyn, "auth-app-slug", &raw_secret)
|
|
.await;
|
|
assert!(
|
|
auth_slug_fail.is_err(),
|
|
"Application slug MUST NEVER authenticate as client_id"
|
|
);
|
|
|
|
teardown_test_db(db_path).await;
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_dual_migration_paths_sqlite() {
|
|
let db_id = uuid::Uuid::new_v4().to_string();
|
|
let db_path = format!("target/test_migration_path_{}.db", db_id);
|
|
let pool = db::create_pool(&db_path).await.unwrap();
|
|
|
|
// Fresh migration
|
|
let res = db::run_migrations(&pool).await;
|
|
assert!(res.is_ok(), "Fresh migration must succeed");
|
|
|
|
// Idempotent re-run
|
|
let res2 = db::run_migrations(&pool).await;
|
|
assert!(res2.is_ok(), "Re-running migrations must succeed");
|
|
|
|
let _ = std::fs::remove_file(db_path);
|
|
}
|