mirror of
https://github.com/coder/coder.git
synced 2025-07-13 21:36:50 +00:00
chore: implement SCIM PUT endpoint, protect against missing active (#15829)
Closes https://github.com/coder/coder/issues/15828
This commit is contained in:
Steven Masley
GitHub
@ -21,6 +21,7 @@ import (
|
||||
"github.com/coder/coder/v2/coderd/coderdtest/oidctest"
|
||||
"github.com/coder/coder/v2/coderd/database"
|
||||
"github.com/coder/coder/v2/coderd/notifications/notificationstest"
|
||||
"github.com/coder/coder/v2/coderd/util/ptr"
|
||||
"github.com/coder/coder/v2/codersdk"
|
||||
"github.com/coder/coder/v2/cryptorand"
|
||||
"github.com/coder/coder/v2/enterprise/coderd"
|
||||
@ -52,7 +53,7 @@ func makeScimUser(t testing.TB) coderd.SCIMUser {
|
||||
}{
|
||||
{Primary: true, Value: fmt.Sprintf("%s@coder.com", rstr)},
|
||||
},
|
||||
Active: true,
|
||||
Active: ptr.Ref(true),
|
||||
}
|
||||
}
|
||||
|
||||
@ -355,14 +356,14 @@ func TestScim(t *testing.T) {
|
||||
err = json.NewDecoder(res.Body).Decode(&sUser)
|
||||
require.NoError(t, err)
|
||||
|
||||
sUser.Active = false
|
||||
sUser.Active = ptr.Ref(false)
|
||||
res, err = client.Request(ctx, "PATCH", "/scim/v2/Users/"+sUser.ID, sUser, setScimAuth(scimAPIKey))
|
||||
require.NoError(t, err)
|
||||
_, _ = io.Copy(io.Discard, res.Body)
|
||||
_ = res.Body.Close()
|
||||
assert.Equal(t, http.StatusOK, res.StatusCode)
|
||||
|
||||
sUser.Active = true
|
||||
sUser.Active = ptr.Ref(true)
|
||||
res, err = client.Request(ctx, "POST", "/scim/v2/Users", sUser, setScimAuth(scimAPIKey))
|
||||
require.NoError(t, err)
|
||||
_, _ = io.Copy(io.Discard, res.Body)
|
||||
@ -495,7 +496,7 @@ func TestScim(t *testing.T) {
|
||||
err = json.NewDecoder(res.Body).Decode(&sUser)
|
||||
require.NoError(t, err)
|
||||
|
||||
sUser.Active = false
|
||||
sUser.Active = ptr.Ref(false)
|
||||
|
||||
res, err = client.Request(ctx, "PATCH", "/scim/v2/Users/"+sUser.ID, sUser, setScimAuth(scimAPIKey))
|
||||
require.NoError(t, err)
|
||||
@ -590,6 +591,274 @@ func TestScim(t *testing.T) {
|
||||
require.Equal(t, codersdk.UserStatusActive, scimUser.Status, "user is still active")
|
||||
})
|
||||
})
|
||||
|
||||
t.Run("putUser", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
t.Run("disabled", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
|
||||
defer cancel()
|
||||
|
||||
client, _ := coderdenttest.New(t, &coderdenttest.Options{
|
||||
SCIMAPIKey: []byte("hi"),
|
||||
LicenseOptions: &coderdenttest.LicenseOptions{
|
||||
AccountID: "coolin",
|
||||
Features: license.Features{
|
||||
codersdk.FeatureSCIM: 0,
|
||||
},
|
||||
},
|
||||
})
|
||||
|
||||
res, err := client.Request(ctx, http.MethodPut, "/scim/v2/Users/bob", struct{}{})
|
||||
require.NoError(t, err)
|
||||
_, _ = io.Copy(io.Discard, res.Body)
|
||||
_ = res.Body.Close()
|
||||
assert.Equal(t, http.StatusForbidden, res.StatusCode)
|
||||
})
|
||||
|
||||
t.Run("noAuth", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
|
||||
defer cancel()
|
||||
|
||||
client, _ := coderdenttest.New(t, &coderdenttest.Options{
|
||||
SCIMAPIKey: []byte("hi"),
|
||||
LicenseOptions: &coderdenttest.LicenseOptions{
|
||||
AccountID: "coolin",
|
||||
Features: license.Features{
|
||||
codersdk.FeatureSCIM: 1,
|
||||
},
|
||||
},
|
||||
})
|
||||
|
||||
res, err := client.Request(ctx, http.MethodPut, "/scim/v2/Users/bob", struct{}{})
|
||||
require.NoError(t, err)
|
||||
_, _ = io.Copy(io.Discard, res.Body)
|
||||
_ = res.Body.Close()
|
||||
assert.Equal(t, http.StatusUnauthorized, res.StatusCode)
|
||||
})
|
||||
|
||||
t.Run("MissingActiveField", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
|
||||
defer cancel()
|
||||
|
||||
scimAPIKey := []byte("hi")
|
||||
mockAudit := audit.NewMock()
|
||||
client, _ := coderdenttest.New(t, &coderdenttest.Options{
|
||||
Options: &coderdtest.Options{Auditor: mockAudit},
|
||||
SCIMAPIKey: scimAPIKey,
|
||||
AuditLogging: true,
|
||||
LicenseOptions: &coderdenttest.LicenseOptions{
|
||||
AccountID: "coolin",
|
||||
Features: license.Features{
|
||||
codersdk.FeatureSCIM: 1,
|
||||
codersdk.FeatureAuditLog: 1,
|
||||
},
|
||||
},
|
||||
})
|
||||
mockAudit.ResetLogs()
|
||||
|
||||
sUser := makeScimUser(t)
|
||||
res, err := client.Request(ctx, "POST", "/scim/v2/Users", sUser, setScimAuth(scimAPIKey))
|
||||
require.NoError(t, err)
|
||||
defer res.Body.Close()
|
||||
assert.Equal(t, http.StatusOK, res.StatusCode)
|
||||
mockAudit.ResetLogs()
|
||||
|
||||
err = json.NewDecoder(res.Body).Decode(&sUser)
|
||||
require.NoError(t, err)
|
||||
|
||||
sUser.Active = nil
|
||||
|
||||
res, err = client.Request(ctx, http.MethodPut, "/scim/v2/Users/"+sUser.ID, sUser, setScimAuth(scimAPIKey))
|
||||
require.NoError(t, err)
|
||||
defer res.Body.Close()
|
||||
assert.Equal(t, http.StatusBadRequest, res.StatusCode)
|
||||
|
||||
data, err := io.ReadAll(res.Body)
|
||||
require.NoError(t, err)
|
||||
require.Contains(t, string(data), "active field is required")
|
||||
mockAudit.ResetLogs()
|
||||
})
|
||||
|
||||
t.Run("ImmutabilityViolation", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
|
||||
defer cancel()
|
||||
|
||||
scimAPIKey := []byte("hi")
|
||||
mockAudit := audit.NewMock()
|
||||
client, _ := coderdenttest.New(t, &coderdenttest.Options{
|
||||
Options: &coderdtest.Options{Auditor: mockAudit},
|
||||
SCIMAPIKey: scimAPIKey,
|
||||
AuditLogging: true,
|
||||
LicenseOptions: &coderdenttest.LicenseOptions{
|
||||
AccountID: "coolin",
|
||||
Features: license.Features{
|
||||
codersdk.FeatureSCIM: 1,
|
||||
codersdk.FeatureAuditLog: 1,
|
||||
},
|
||||
},
|
||||
})
|
||||
mockAudit.ResetLogs()
|
||||
|
||||
sUser := makeScimUser(t)
|
||||
res, err := client.Request(ctx, "POST", "/scim/v2/Users", sUser, setScimAuth(scimAPIKey))
|
||||
require.NoError(t, err)
|
||||
defer res.Body.Close()
|
||||
assert.Equal(t, http.StatusOK, res.StatusCode)
|
||||
mockAudit.ResetLogs()
|
||||
|
||||
err = json.NewDecoder(res.Body).Decode(&sUser)
|
||||
require.NoError(t, err)
|
||||
|
||||
sUser.UserName += "changed"
|
||||
|
||||
res, err = client.Request(ctx, http.MethodPut, "/scim/v2/Users/"+sUser.ID, sUser, setScimAuth(scimAPIKey))
|
||||
require.NoError(t, err)
|
||||
defer res.Body.Close()
|
||||
assert.Equal(t, http.StatusBadRequest, res.StatusCode)
|
||||
mockAudit.ResetLogs()
|
||||
|
||||
data, err := io.ReadAll(res.Body)
|
||||
require.NoError(t, err)
|
||||
require.Contains(t, string(data), "mutability")
|
||||
require.NoError(t, err)
|
||||
})
|
||||
|
||||
t.Run("OK", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
|
||||
defer cancel()
|
||||
|
||||
scimAPIKey := []byte("hi")
|
||||
mockAudit := audit.NewMock()
|
||||
client, _ := coderdenttest.New(t, &coderdenttest.Options{
|
||||
Options: &coderdtest.Options{Auditor: mockAudit},
|
||||
SCIMAPIKey: scimAPIKey,
|
||||
AuditLogging: true,
|
||||
LicenseOptions: &coderdenttest.LicenseOptions{
|
||||
AccountID: "coolin",
|
||||
Features: license.Features{
|
||||
codersdk.FeatureSCIM: 1,
|
||||
codersdk.FeatureAuditLog: 1,
|
||||
},
|
||||
},
|
||||
})
|
||||
mockAudit.ResetLogs()
|
||||
|
||||
sUser := makeScimUser(t)
|
||||
res, err := client.Request(ctx, "POST", "/scim/v2/Users", sUser, setScimAuth(scimAPIKey))
|
||||
require.NoError(t, err)
|
||||
defer res.Body.Close()
|
||||
assert.Equal(t, http.StatusOK, res.StatusCode)
|
||||
mockAudit.ResetLogs()
|
||||
|
||||
err = json.NewDecoder(res.Body).Decode(&sUser)
|
||||
require.NoError(t, err)
|
||||
|
||||
sUser.Active = ptr.Ref(false)
|
||||
|
||||
res, err = client.Request(ctx, http.MethodPatch, "/scim/v2/Users/"+sUser.ID, sUser, setScimAuth(scimAPIKey))
|
||||
require.NoError(t, err)
|
||||
_, _ = io.Copy(io.Discard, res.Body)
|
||||
_ = res.Body.Close()
|
||||
assert.Equal(t, http.StatusOK, res.StatusCode)
|
||||
|
||||
aLogs := mockAudit.AuditLogs()
|
||||
require.Len(t, aLogs, 1)
|
||||
assert.Equal(t, database.AuditActionWrite, aLogs[0].Action)
|
||||
|
||||
userRes, err := client.Users(ctx, codersdk.UsersRequest{Search: sUser.Emails[0].Value})
|
||||
require.NoError(t, err)
|
||||
require.Len(t, userRes.Users, 1)
|
||||
assert.Equal(t, codersdk.UserStatusSuspended, userRes.Users[0].Status)
|
||||
})
|
||||
|
||||
// Create a user via SCIM, which starts as dormant.
|
||||
// Log in as the user, making them active.
|
||||
// Then patch the user again and the user should still be active.
|
||||
t.Run("ActiveIsActive", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
|
||||
defer cancel()
|
||||
|
||||
scimAPIKey := []byte("hi")
|
||||
|
||||
mockAudit := audit.NewMock()
|
||||
fake := oidctest.NewFakeIDP(t, oidctest.WithServing())
|
||||
client, _ := coderdenttest.New(t, &coderdenttest.Options{
|
||||
Options: &coderdtest.Options{
|
||||
Auditor: mockAudit,
|
||||
OIDCConfig: fake.OIDCConfig(t, []string{}),
|
||||
},
|
||||
SCIMAPIKey: scimAPIKey,
|
||||
AuditLogging: true,
|
||||
LicenseOptions: &coderdenttest.LicenseOptions{
|
||||
AccountID: "coolin",
|
||||
Features: license.Features{
|
||||
codersdk.FeatureSCIM: 1,
|
||||
codersdk.FeatureAuditLog: 1,
|
||||
},
|
||||
},
|
||||
})
|
||||
mockAudit.ResetLogs()
|
||||
|
||||
// User is dormant on create
|
||||
sUser := makeScimUser(t)
|
||||
res, err := client.Request(ctx, http.MethodPost, "/scim/v2/Users", sUser, setScimAuth(scimAPIKey))
|
||||
require.NoError(t, err)
|
||||
defer res.Body.Close()
|
||||
assert.Equal(t, http.StatusOK, res.StatusCode)
|
||||
|
||||
err = json.NewDecoder(res.Body).Decode(&sUser)
|
||||
require.NoError(t, err)
|
||||
|
||||
// Check the audit log
|
||||
aLogs := mockAudit.AuditLogs()
|
||||
require.Len(t, aLogs, 1)
|
||||
assert.Equal(t, database.AuditActionCreate, aLogs[0].Action)
|
||||
|
||||
// Verify the user is dormant
|
||||
scimUser, err := client.User(ctx, sUser.UserName)
|
||||
require.NoError(t, err)
|
||||
require.Equal(t, codersdk.UserStatusDormant, scimUser.Status, "user starts as dormant")
|
||||
|
||||
// Log in as the user, making them active
|
||||
//nolint:bodyclose
|
||||
scimUserClient, _ := fake.Login(t, client, jwt.MapClaims{
|
||||
"email": sUser.Emails[0].Value,
|
||||
})
|
||||
scimUser, err = scimUserClient.User(ctx, codersdk.Me)
|
||||
require.NoError(t, err)
|
||||
require.Equal(t, codersdk.UserStatusActive, scimUser.Status, "user should now be active")
|
||||
|
||||
// Patch the user
|
||||
mockAudit.ResetLogs()
|
||||
res, err = client.Request(ctx, http.MethodPut, "/scim/v2/Users/"+sUser.ID, sUser, setScimAuth(scimAPIKey))
|
||||
require.NoError(t, err)
|
||||
_, _ = io.Copy(io.Discard, res.Body)
|
||||
_ = res.Body.Close()
|
||||
assert.Equal(t, http.StatusOK, res.StatusCode)
|
||||
|
||||
// Should be no audit logs since there is no diff
|
||||
aLogs = mockAudit.AuditLogs()
|
||||
require.Len(t, aLogs, 0)
|
||||
|
||||
// Verify the user is still active.
|
||||
scimUser, err = client.User(ctx, sUser.UserName)
|
||||
require.NoError(t, err)
|
||||
require.Equal(t, codersdk.UserStatusActive, scimUser.Status, "user is still active")
|
||||
})
|
||||
})
|
||||
}
|
||||
|
||||
func TestScimError(t *testing.T) {
|
||||
|
||||
Reference in New Issue
Block a user