405 lines
15 KiB
Go
405 lines
15 KiB
Go
|
// NOTES:
|
||
|
|
// Take a look at the unit tests from the sibling files as we already have some there.
|
||
|
|
// whoamirequest is super simple, zero side effects...
|
||
|
|
// - add bits similar to what we did for crud.go to seed kube with secrets & prove your updates
|
||
|
|
// - perhaps look at oidcclientsecretstorage.go also for the seeding code we wrote
|
||
|
|
// - the things we are seeding here IS the storage of client secrets + hashes
|
||
|
|
// - this is the specific secret formats that we need
|
||
|
|
// - but instead of hello world hashes we will want to put real BCrypt hashes in the seeds
|
||
|
|
// - there is a test helper with some real BCrypt hashes we can use in oidcclient.go -- HashedPassword1AtGoMinCost - 04 for unit tests for speed
|
||
|
|
// - look for a test using HashedPassword1AtGoMinCost to see how we step around the min value of 11 tho production code must do that
|
||
|
|
// - NewKubeStorage, bcrypt.MinCost will show this
|
||
|
|
// // Use lower minimum required bcrypt cost than we would use in production to keep unit the tests fast.
|
||
|
|
// oauthStore := oidc.NewKubeStorage(secrets, oidcClientsClient, timeoutsConfiguration, bcrypt.MinCost)
|
||
|
|
// credentialrequest also has no side effects...
|
||
|
|
//
|
||
|
|
//
|
||
|
|
// Copyright 2022 the Pinniped contributors. All Rights Reserved.
|
||
|
|
// SPDX-License-Identifier: Apache-2.0
|
||
|
|
package clientsecretrequest
|
||
|
|
|
||
|
|
import (
|
||
|
|
"context"
|
||
|
|
"errors"
|
||
|
|
"net/http"
|
||
|
|
"testing"
|
||
|
|
|
||
|
|
"github.com/stretchr/testify/require"
|
||
|
|
apierrors "k8s.io/apimachinery/pkg/api/errors"
|
||
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||
|
|
"k8s.io/apimachinery/pkg/runtime"
|
||
|
|
"k8s.io/apimachinery/pkg/runtime/schema"
|
||
|
|
genericapirequest "k8s.io/apiserver/pkg/endpoints/request"
|
||
|
|
"k8s.io/apiserver/pkg/registry/rest"
|
||
|
|
|
||
|
|
clientsecretapi "go.pinniped.dev/generated/latest/apis/supervisor/clientsecret"
|
||
|
|
)
|
||
|
|
|
||
|
|
func TestNew(t *testing.T) {
|
||
|
|
|
||
|
|
r := NewREST(schema.GroupResource{Group: "bears", Resource: "panda"}, nil, nil, "foobar", 4)
|
||
|
|
|
||
|
|
require.NotNil(t, r)
|
||
|
|
require.True(t, r.NamespaceScoped())
|
||
|
|
require.Equal(t, []string{"pinniped"}, r.Categories())
|
||
|
|
|
||
|
|
require.IsType(t, &clientsecretapi.OIDCClientSecretRequest{}, r.New())
|
||
|
|
require.IsType(t, &clientsecretapi.OIDCClientSecretRequestList{}, r.NewList())
|
||
|
|
|
||
|
|
ctx := context.Background()
|
||
|
|
|
||
|
|
// check the simple invariants of our no-op list
|
||
|
|
list, err := r.List(ctx, nil)
|
||
|
|
require.NoError(t, err)
|
||
|
|
require.NotNil(t, list)
|
||
|
|
require.IsType(t, &clientsecretapi.OIDCClientSecretRequestList{}, list)
|
||
|
|
require.Equal(t, "0", list.(*clientsecretapi.OIDCClientSecretRequestList).ResourceVersion)
|
||
|
|
require.NotNil(t, list.(*clientsecretapi.OIDCClientSecretRequestList).Items)
|
||
|
|
require.Len(t, list.(*clientsecretapi.OIDCClientSecretRequestList).Items, 0)
|
||
|
|
|
||
|
|
// make sure we can turn lists into tables if needed
|
||
|
|
table, err := r.ConvertToTable(ctx, list, nil)
|
||
|
|
require.NoError(t, err)
|
||
|
|
require.NotNil(t, table)
|
||
|
|
require.Equal(t, "0", table.ResourceVersion)
|
||
|
|
require.Nil(t, table.Rows)
|
||
|
|
|
||
|
|
// exercise group resource - force error by passing a runtime.Object that does not have an embedded object meta
|
||
|
|
_, err = r.ConvertToTable(ctx, &metav1.APIGroup{}, nil)
|
||
|
|
require.Error(t, err, "the resource panda.bears does not support being converted to a Table")
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestCreate(t *testing.T) {
|
||
|
|
type args struct {
|
||
|
|
ctx context.Context
|
||
|
|
obj runtime.Object
|
||
|
|
createValidation rest.ValidateObjectFunc
|
||
|
|
options *metav1.CreateOptions
|
||
|
|
}
|
||
|
|
namespace := "some-namespace"
|
||
|
|
|
||
|
|
tests := []struct {
|
||
|
|
name string
|
||
|
|
args args
|
||
|
|
want runtime.Object
|
||
|
|
wantErrStatus metav1.Status
|
||
|
|
}{
|
||
|
|
{
|
||
|
|
name: "wrong type",
|
||
|
|
args: args{
|
||
|
|
ctx: genericapirequest.NewContext(),
|
||
|
|
obj: &metav1.Status{},
|
||
|
|
createValidation: nil,
|
||
|
|
options: nil,
|
||
|
|
},
|
||
|
|
want: nil,
|
||
|
|
wantErrStatus: metav1.Status{
|
||
|
|
Status: metav1.StatusFailure,
|
||
|
|
Message: `not an OIDCClientSecretRequest: &v1.Status{TypeMeta:v1.TypeMeta{Kind:"", APIVersion:""}, ListMeta:v1.ListMeta{SelfLink:"", ResourceVersion:"", Continue:"", RemainingItemCount:(*int64)(nil)}, Status:"", Message:"", Reason:"", Details:(*v1.StatusDetails)(nil), Code:0}`,
|
||
|
|
Reason: metav1.StatusReasonBadRequest,
|
||
|
|
Code: http.StatusBadRequest,
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
name: "bad options for dry run",
|
||
|
|
args: args{
|
||
|
|
ctx: genericapirequest.WithNamespace(genericapirequest.NewContext(), namespace),
|
||
|
|
obj: &clientsecretapi.OIDCClientSecretRequest{
|
||
|
|
ObjectMeta: metav1.ObjectMeta{
|
||
|
|
Name: "client.oauth.pinniped.dev-some-client-name",
|
||
|
|
},
|
||
|
|
},
|
||
|
|
createValidation: nil,
|
||
|
|
options: &metav1.CreateOptions{DryRun: []string{"stuff"}},
|
||
|
|
},
|
||
|
|
want: nil,
|
||
|
|
wantErrStatus: metav1.Status{
|
||
|
|
Status: metav1.StatusFailure,
|
||
|
|
Message: `OIDCClientSecretRequest.clientsecret.supervisor.pinniped.dev "client.oauth.pinniped.dev-some-client-name" is invalid: dryRun: Unsupported value: []string{"stuff"}`,
|
||
|
|
Reason: metav1.StatusReasonInvalid,
|
||
|
|
Code: http.StatusUnprocessableEntity,
|
||
|
|
Details: &metav1.StatusDetails{
|
||
|
|
Group: "clientsecret.supervisor.pinniped.dev",
|
||
|
|
Kind: "OIDCClientSecretRequest",
|
||
|
|
Name: "client.oauth.pinniped.dev-some-client-name",
|
||
|
|
Causes: []metav1.StatusCause{{
|
||
|
|
Type: "FieldValueNotSupported",
|
||
|
|
Message: "Unsupported value: []string{\"stuff\"}",
|
||
|
|
Field: "dryRun",
|
||
|
|
}},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
name: "incorrect namespace",
|
||
|
|
args: args{
|
||
|
|
ctx: genericapirequest.WithNamespace(genericapirequest.NewContext(), "wrong-namespace"),
|
||
|
|
obj: &clientsecretapi.OIDCClientSecretRequest{
|
||
|
|
ObjectMeta: metav1.ObjectMeta{
|
||
|
|
Name: "client.oauth.pinniped.dev-some-client-name",
|
||
|
|
},
|
||
|
|
},
|
||
|
|
createValidation: nil,
|
||
|
|
options: nil,
|
||
|
|
},
|
||
|
|
want: nil,
|
||
|
|
wantErrStatus: metav1.Status{
|
||
|
|
Status: metav1.StatusFailure,
|
||
|
|
Message: `namespace must be some-namespace on OIDCClientSecretRequest, was wrong-namespace`,
|
||
|
|
Reason: metav1.StatusReasonBadRequest,
|
||
|
|
Code: http.StatusBadRequest,
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
name: "create validation: failure from kube api-server rest.ValidateObjectFunc",
|
||
|
|
args: args{
|
||
|
|
ctx: genericapirequest.WithNamespace(genericapirequest.NewContext(), namespace),
|
||
|
|
obj: &clientsecretapi.OIDCClientSecretRequest{
|
||
|
|
ObjectMeta: metav1.ObjectMeta{
|
||
|
|
Name: "client.oauth.pinniped.dev-some-client-name",
|
||
|
|
},
|
||
|
|
},
|
||
|
|
createValidation: func(ctx context.Context, obj runtime.Object) error {
|
||
|
|
return apierrors.NewInternalError(errors.New("some-error-here"))
|
||
|
|
},
|
||
|
|
options: nil,
|
||
|
|
},
|
||
|
|
want: nil,
|
||
|
|
wantErrStatus: metav1.Status{
|
||
|
|
Status: metav1.StatusFailure,
|
||
|
|
Message: "Internal error occurred: some-error-here",
|
||
|
|
Reason: metav1.StatusReasonInternalError,
|
||
|
|
Code: http.StatusInternalServerError,
|
||
|
|
Details: &metav1.StatusDetails{
|
||
|
|
Causes: []metav1.StatusCause{{
|
||
|
|
Message: "some-error-here",
|
||
|
|
}},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
name: "create validation: no namespace on the request context",
|
||
|
|
args: args{
|
||
|
|
ctx: genericapirequest.NewContext(),
|
||
|
|
obj: &clientsecretapi.OIDCClientSecretRequest{
|
||
|
|
ObjectMeta: metav1.ObjectMeta{
|
||
|
|
Name: "client.oauth.pinniped.dev-some-client-name",
|
||
|
|
},
|
||
|
|
},
|
||
|
|
options: nil,
|
||
|
|
},
|
||
|
|
want: nil,
|
||
|
|
wantErrStatus: metav1.Status{
|
||
|
|
Status: metav1.StatusFailure,
|
||
|
|
Message: "Internal error occurred: no namespace information found in request context",
|
||
|
|
Reason: metav1.StatusReasonInternalError,
|
||
|
|
Code: http.StatusInternalServerError,
|
||
|
|
Details: &metav1.StatusDetails{
|
||
|
|
Causes: []metav1.StatusCause{{
|
||
|
|
Message: "no namespace information found in request context",
|
||
|
|
}},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
name: "create validation: namespace on object does not match namespace on request",
|
||
|
|
args: args{
|
||
|
|
ctx: genericapirequest.WithNamespace(genericapirequest.NewContext(), namespace),
|
||
|
|
obj: &clientsecretapi.OIDCClientSecretRequest{
|
||
|
|
ObjectMeta: metav1.ObjectMeta{
|
||
|
|
Name: "client.oauth.pinniped.dev-some-client-name",
|
||
|
|
Namespace: "not-a-matching-namespace",
|
||
|
|
},
|
||
|
|
},
|
||
|
|
options: nil,
|
||
|
|
},
|
||
|
|
want: nil,
|
||
|
|
wantErrStatus: metav1.Status{
|
||
|
|
Status: metav1.StatusFailure,
|
||
|
|
Message: "the namespace of the provided object does not match the namespace sent on the request",
|
||
|
|
Reason: metav1.StatusReasonBadRequest,
|
||
|
|
Code: http.StatusBadRequest,
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
name: "create validation: generateName is unsupported",
|
||
|
|
args: args{
|
||
|
|
ctx: genericapirequest.WithNamespace(genericapirequest.NewContext(), namespace),
|
||
|
|
obj: &clientsecretapi.OIDCClientSecretRequest{
|
||
|
|
ObjectMeta: metav1.ObjectMeta{
|
||
|
|
GenerateName: "foo",
|
||
|
|
},
|
||
|
|
},
|
||
|
|
options: nil,
|
||
|
|
},
|
||
|
|
want: nil,
|
||
|
|
wantErrStatus: metav1.Status{
|
||
|
|
Status: metav1.StatusFailure,
|
||
|
|
Message: "OIDCClientSecretRequest.clientsecret.supervisor.pinniped.dev \"\" is invalid: [metadata.generateName: Invalid value: \"foo\": generateName is not supported, metadata.name: Required value: name or generateName is required]",
|
||
|
|
Reason: metav1.StatusReasonInvalid,
|
||
|
|
Code: http.StatusUnprocessableEntity,
|
||
|
|
Details: &metav1.StatusDetails{
|
||
|
|
Group: "clientsecret.supervisor.pinniped.dev",
|
||
|
|
Kind: "OIDCClientSecretRequest",
|
||
|
|
Name: "",
|
||
|
|
Causes: []metav1.StatusCause{{
|
||
|
|
Type: metav1.CauseTypeFieldValueInvalid,
|
||
|
|
Message: "Invalid value: \"foo\": generateName is not supported",
|
||
|
|
Field: "metadata.generateName",
|
||
|
|
}, {
|
||
|
|
Type: metav1.CauseTypeFieldValueRequired,
|
||
|
|
Message: "Required value: name or generateName is required",
|
||
|
|
Field: "metadata.name",
|
||
|
|
}},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
name: "create validation: name cannot exactly match client.oauth.pinniped.dev-",
|
||
|
|
args: args{
|
||
|
|
ctx: genericapirequest.WithNamespace(genericapirequest.NewContext(), namespace),
|
||
|
|
obj: &clientsecretapi.OIDCClientSecretRequest{
|
||
|
|
ObjectMeta: metav1.ObjectMeta{
|
||
|
|
Name: "client.oauth.pinniped.dev-",
|
||
|
|
},
|
||
|
|
},
|
||
|
|
options: nil,
|
||
|
|
},
|
||
|
|
want: nil,
|
||
|
|
wantErrStatus: metav1.Status{
|
||
|
|
Status: metav1.StatusFailure,
|
||
|
|
Message: "OIDCClientSecretRequest.clientsecret.supervisor.pinniped.dev \"client.oauth.pinniped.dev-\" is invalid: metadata.name: Invalid value: \"client.oauth.pinniped.dev-\": must not equal 'client.oauth.pinniped.dev-'",
|
||
|
|
Reason: metav1.StatusReasonInvalid,
|
||
|
|
Code: http.StatusUnprocessableEntity,
|
||
|
|
Details: &metav1.StatusDetails{
|
||
|
|
Group: "clientsecret.supervisor.pinniped.dev",
|
||
|
|
Kind: "OIDCClientSecretRequest",
|
||
|
|
Name: "client.oauth.pinniped.dev-",
|
||
|
|
Causes: []metav1.StatusCause{{
|
||
|
|
Type: metav1.CauseTypeFieldValueInvalid,
|
||
|
|
Message: "Invalid value: \"client.oauth.pinniped.dev-\": must not equal 'client.oauth.pinniped.dev-'",
|
||
|
|
Field: "metadata.name",
|
||
|
|
}},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
name: "create validation: name must contain prefix client.oauth.pinniped.dev-",
|
||
|
|
args: args{
|
||
|
|
ctx: genericapirequest.WithNamespace(genericapirequest.NewContext(), namespace),
|
||
|
|
obj: &clientsecretapi.OIDCClientSecretRequest{
|
||
|
|
ObjectMeta: metav1.ObjectMeta{
|
||
|
|
Name: "does-not-contain-the-prefix",
|
||
|
|
},
|
||
|
|
},
|
||
|
|
options: nil,
|
||
|
|
},
|
||
|
|
want: nil,
|
||
|
|
wantErrStatus: metav1.Status{
|
||
|
|
Status: metav1.StatusFailure,
|
||
|
|
Message: "OIDCClientSecretRequest.clientsecret.supervisor.pinniped.dev \"does-not-contain-the-prefix\" is invalid: metadata.name: Invalid value: \"does-not-contain-the-prefix\": must start with 'client.oauth.pinniped.dev-'",
|
||
|
|
Reason: metav1.StatusReasonInvalid,
|
||
|
|
Code: http.StatusUnprocessableEntity,
|
||
|
|
Details: &metav1.StatusDetails{
|
||
|
|
Group: "clientsecret.supervisor.pinniped.dev",
|
||
|
|
Kind: "OIDCClientSecretRequest",
|
||
|
|
Name: "does-not-contain-the-prefix",
|
||
|
|
Causes: []metav1.StatusCause{{
|
||
|
|
Type: metav1.CauseTypeFieldValueInvalid,
|
||
|
|
Message: "Invalid value: \"does-not-contain-the-prefix\": must start with 'client.oauth.pinniped.dev-'",
|
||
|
|
Field: "metadata.name",
|
||
|
|
}},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
name: "create validation: name with invalid characters should error",
|
||
|
|
args: args{
|
||
|
|
ctx: genericapirequest.WithNamespace(genericapirequest.NewContext(), namespace),
|
||
|
|
obj: &clientsecretapi.OIDCClientSecretRequest{
|
||
|
|
ObjectMeta: metav1.ObjectMeta{
|
||
|
|
Name: "client.oauth.pinniped.dev-contains/invalid/characters",
|
||
|
|
},
|
||
|
|
},
|
||
|
|
options: nil,
|
||
|
|
},
|
||
|
|
want: nil,
|
||
|
|
wantErrStatus: metav1.Status{
|
||
|
|
Status: metav1.StatusFailure,
|
||
|
|
Message: `OIDCClientSecretRequest.clientsecret.supervisor.pinniped.dev "client.oauth.pinniped.dev-contains/invalid/characters" is invalid: metadata.name: Invalid value: "client.oauth.pinniped.dev-contains/invalid/characters": may not contain '/'`,
|
||
|
|
Reason: metav1.StatusReasonInvalid,
|
||
|
|
Code: http.StatusUnprocessableEntity,
|
||
|
|
Details: &metav1.StatusDetails{
|
||
|
|
Group: "clientsecret.supervisor.pinniped.dev",
|
||
|
|
Kind: "OIDCClientSecretRequest",
|
||
|
|
Name: "client.oauth.pinniped.dev-contains/invalid/characters",
|
||
|
|
Causes: []metav1.StatusCause{{
|
||
|
|
Type: metav1.CauseTypeFieldValueInvalid,
|
||
|
|
Message: `Invalid value: "client.oauth.pinniped.dev-contains/invalid/characters": may not contain '/'`,
|
||
|
|
Field: "metadata.name",
|
||
|
|
}},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
name: "create validation: name validation may return multiple errors",
|
||
|
|
args: args{
|
||
|
|
ctx: genericapirequest.WithNamespace(genericapirequest.NewContext(), namespace),
|
||
|
|
obj: &clientsecretapi.OIDCClientSecretRequest{
|
||
|
|
ObjectMeta: metav1.ObjectMeta{
|
||
|
|
Name: "multiple/errors/aggregated",
|
||
|
|
GenerateName: "no-generate-allowed",
|
||
|
|
},
|
||
|
|
},
|
||
|
|
options: nil,
|
||
|
|
},
|
||
|
|
want: nil,
|
||
|
|
wantErrStatus: metav1.Status{
|
||
|
|
Status: metav1.StatusFailure,
|
||
|
|
Message: `OIDCClientSecretRequest.clientsecret.supervisor.pinniped.dev "multiple/errors/aggregated" is invalid: [metadata.generateName: Invalid value: "no-generate-allowed": generateName is not supported, metadata.name: Invalid value: "multiple/errors/aggregated": must start with 'client.oauth.pinniped.dev-', metadata.name: Invalid value: "multiple/errors/aggregated": may not contain '/']`,
|
||
|
|
Reason: metav1.StatusReasonInvalid,
|
||
|
|
Code: http.StatusUnprocessableEntity,
|
||
|
|
Details: &metav1.StatusDetails{
|
||
|
|
Group: "clientsecret.supervisor.pinniped.dev",
|
||
|
|
Kind: "OIDCClientSecretRequest",
|
||
|
|
Name: "multiple/errors/aggregated",
|
||
|
|
Causes: []metav1.StatusCause{{
|
||
|
|
Type: metav1.CauseTypeFieldValueInvalid,
|
||
|
|
Message: `Invalid value: "no-generate-allowed": generateName is not supported`,
|
||
|
|
Field: "metadata.generateName",
|
||
|
|
}, {
|
||
|
|
Type: metav1.CauseTypeFieldValueInvalid,
|
||
|
|
Message: `Invalid value: "multiple/errors/aggregated": must start with 'client.oauth.pinniped.dev-'`,
|
||
|
|
Field: "metadata.name",
|
||
|
|
}, {
|
||
|
|
Type: metav1.CauseTypeFieldValueInvalid,
|
||
|
|
Message: `Invalid value: "multiple/errors/aggregated": may not contain '/'`,
|
||
|
|
Field: "metadata.name",
|
||
|
|
}},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
// {name: ""},
|
||
|
|
}
|
||
|
|
for _, tt := range tests {
|
||
|
|
tt := tt
|
||
|
|
t.Run(tt.name, func(t *testing.T) {
|
||
|
|
// TODO: update and fill these in with actual values, not nil!
|
||
|
|
r := NewREST(schema.GroupResource{Group: "bears", Resource: "panda"}, nil, nil, namespace, 4)
|
||
|
|
got, err := r.Create(tt.args.ctx, tt.args.obj, tt.args.createValidation, tt.args.options)
|
||
|
|
require.Equal(t, &apierrors.StatusError{
|
||
|
|
ErrStatus: tt.wantErrStatus,
|
||
|
|
}, err)
|
||
|
|
require.Equal(t, tt.want, got)
|
||
|
|
})
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func errString(err error) string {
|
||
|
|
if err == nil {
|
||
|
|
return ""
|
||
|
|
}
|
||
|
|
|
||
|
|
return err.Error()
|
||
|
|
}
|