Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 17 additions & 21 deletions services/spar/test-integration/Test/Spar/APISpec.hs
Original file line number Diff line number Diff line change
Expand Up @@ -1013,7 +1013,7 @@ specCRUDIdentityProvider = do
idp2 ^. idpMetadata . SAML.edIssuer `shouldBe` issuer2
idp2 ^. idpId `shouldNotBe` idp1 ^. idpId
idp2 ^. idpExtraInfo . wiOldIssuers `shouldBe` [idpmeta1 ^. edIssuer]
idp1' ^. idpExtraInfo . wiReplacedBy `shouldBe` (Just $ idp2 ^. idpId)
idp1' ^. idpExtraInfo . wiReplacedBy `shouldBe` Just (idp2 ^. idpId)
-- erase everything that is supposed to be different between idp1, idp2, and make
-- sure the result is equal.
let erase :: IdP -> IdP
Expand Down Expand Up @@ -1088,7 +1088,7 @@ specDeleteCornerCases = describe "delete corner cases" $ do
uid <- getUserIdViaRef' uref
liftIO $ do
uid `shouldSatisfy` isJust
uref `shouldBe` (SAML.UserRef issuer1 userSubject)
uref `shouldBe` SAML.UserRef issuer1 userSubject
idp2 <-
let idpmeta2 = idpmeta1 & edIssuer .~ issuer2
in call $ callIdpCreateReplace (env ^. teWireIdPAPIVersion) (env ^. teSpar) (Just owner1) idpmeta2 (idp1 ^. SAML.idpId)
Expand All @@ -1097,7 +1097,7 @@ specDeleteCornerCases = describe "delete corner cases" $ do
uid' <- getUserIdViaRef' uref'
liftIO $ do
uid' `shouldBe` uid
uref' `shouldBe` (SAML.UserRef issuer1 userSubject)
uref' `shouldBe` SAML.UserRef issuer1 userSubject
it "deleting the replacing idp2 before it has users does not block registrations on idp1" $ do
env <- ask
(owner1, _, idp1, (IdPMetadataValue _ idpmeta1, privkey1)) <- registerTestIdPWithMeta
Expand All @@ -1112,7 +1112,7 @@ specDeleteCornerCases = describe "delete corner cases" $ do
uid <- getUserIdViaRef' uref
liftIO $ do
uid `shouldSatisfy` isJust
uref `shouldBe` (SAML.UserRef issuer1 userSubject)
uref `shouldBe` SAML.UserRef issuer1 userSubject
it "create user1 via idp1 (saml); delete user1; create user via newly created idp2 (saml)" $ do
pending
it "create user1 via saml; delete user1; create via scim (in same team)" $ do
Expand All @@ -1134,7 +1134,7 @@ specDeleteCornerCases = describe "delete corner cases" $ do
let uref = SAML.UserRef tenant subj
subj = either (error . show) id $ SAML.mkNameID uname Nothing Nothing Nothing
tenant = idp ^. SAML.idpMetadata . SAML.edIssuer
!(Just !uid) <- createViaSaml idp privcreds uref
(Just !uid) <- createViaSaml idp privcreds uref
samlUserShouldSatisfy uref isJust
deleteViaBrig uid
samlUserShouldSatisfy uref isJust -- brig doesn't talk to spar right now when users
Expand Down Expand Up @@ -1298,21 +1298,19 @@ specSsoSettings = do
-- check it is set
callGetDefaultSsoCode (env ^. teSpar)
`shouldRespondWith` \resp ->
and
[ statusCode resp == 200,
responseJsonEither resp == Right (ssoSettings (Just idpid1))
]
(statusCode resp == 200)
&& ( responseJsonEither resp == Right (ssoSettings (Just idpid1))
)
-- update to 2
callSetDefaultSsoCode (env ^. teSpar) idpid2
`shouldRespondWith` \resp ->
statusCode resp == 200
-- check it is set
callGetDefaultSsoCode (env ^. teSpar)
`shouldRespondWith` \resp ->
and
[ statusCode resp == 200,
responseJsonEither resp == Right (ssoSettings (Just idpid2))
]
(statusCode resp == 200)
&& ( responseJsonEither resp == Right (ssoSettings (Just idpid2))
)
it "allows removing the default SSO code" $ do
env <- ask
(_userid, _teamid, (^. idpId) -> idpid) <- registerTestIdP
Expand All @@ -1327,10 +1325,9 @@ specSsoSettings = do
-- check it is not set anymore
callGetDefaultSsoCode (env ^. teSpar)
`shouldRespondWith` \resp ->
and
[ statusCode resp == 200,
responseJsonEither resp == Right (ssoSettings Nothing)
]
(statusCode resp == 200)
&& ( responseJsonEither resp == Right (ssoSettings Nothing)
)
it "removes the default SSO code if the IdP gets removed" $ do
env <- ask
(userid, _teamid, (^. idpId) -> idpid) <- registerTestIdP
Expand All @@ -1344,10 +1341,9 @@ specSsoSettings = do
-- check it is not set anymore
callGetDefaultSsoCode (env ^. teSpar)
`shouldRespondWith` \resp ->
and
[ statusCode resp == 200,
responseJsonEither resp == Right (ssoSettings Nothing)
]
(statusCode resp == 200)
&& ( responseJsonEither resp == Right (ssoSettings Nothing)
)
where
ssoSettings maybeCode =
object
Expand Down
4 changes: 2 additions & 2 deletions services/spar/test-integration/Test/Spar/AppSpec.hs
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,7 @@ spec = describe "accessVerdict" $ do
Servant.errHTTPCode outcome `shouldBe` 303
Servant.errReasonPhrase outcome `shouldBe` "forbidden"
Servant.errBody outcome `shouldBe` "[\"No Bearer SubjectConfirmation\",\"no AuthnStatement\"]"
uriScheme loc `shouldBe` (URI.Scheme "wire")
uriScheme loc `shouldBe` URI.Scheme "wire"
List.lookup "userid" qry `shouldBe` Nothing
List.lookup "cookie" qry `shouldBe` Nothing
List.lookup "label" qry `shouldBe` Just "forbidden"
Expand All @@ -99,7 +99,7 @@ spec = describe "accessVerdict" $ do
Servant.errHTTPCode outcome `shouldBe` 303
Servant.errReasonPhrase outcome `shouldBe` "success"
Servant.errBody outcome `shouldBe` mempty
uriScheme loc `shouldBe` (URI.Scheme "wire")
uriScheme loc `shouldBe` URI.Scheme "wire"
List.lookup "label" qry `shouldBe` Nothing
List.lookup "userid" qry `shouldBe` (Just . cs . show $ uid)
List.lookup "cookie" qry `shouldNotBe` Nothing
Expand Down
4 changes: 2 additions & 2 deletions services/spar/test-integration/Test/Spar/DataSpec.hs
Original file line number Diff line number Diff line change
Expand Up @@ -163,14 +163,14 @@ spec = do
it "getIdPConfigsByTeam works" $ do
skipIdPAPIVersions [WireIdPAPIV1]
teamid <- nextWireId
idp <- makeTestIdP <&> idpExtraInfo .~ (WireIdP teamid Nothing [] Nothing)
idp <- makeTestIdP <&> idpExtraInfo .~ WireIdP teamid Nothing [] Nothing
() <- runSpar $ IdPEffect.storeConfig idp
idps <- runSpar $ IdPEffect.getConfigsByTeam teamid
liftIO $ idps `shouldBe` [idp]
it "deleteIdPConfig works" $ do
teamid <- nextWireId
idpApiVersion <- asks (^. teWireIdPAPIVersion)
idp <- makeTestIdP <&> idpExtraInfo .~ (WireIdP teamid (Just idpApiVersion) [] Nothing)
idp <- makeTestIdP <&> idpExtraInfo .~ WireIdP teamid (Just idpApiVersion) [] Nothing
() <- runSpar $ IdPEffect.storeConfig idp
do
midp <- runSpar $ IdPEffect.getConfig (idp ^. idpId)
Expand Down
14 changes: 7 additions & 7 deletions services/spar/test-integration/Test/Spar/Scim/UserSpec.hs
Original file line number Diff line number Diff line change
Expand Up @@ -135,7 +135,7 @@ specImportToScimFromSAML =
let uref = SAML.UserRef tenant subj
subj = emailToSAMLNameID email
tenant = idp ^. SAML.idpMetadata . SAML.edIssuer
!(Just !uid) <- createViaSaml idp privCreds uref
(Just !uid) <- createViaSaml idp privCreds uref
samlUserShouldSatisfy uref isJust
pure (uref, uid)

Expand Down Expand Up @@ -193,7 +193,7 @@ specImportToScimFromSAML =
assertBrigCassandra uid uref (Scim.value . Scim.thing $ storedUserUpdated) (valemail, True) ManagedByScim

-- login again
!(Just !uid') <- createViaSaml idp privCreds uref
(Just !uid') <- createViaSaml idp privCreds uref
liftIO $ uid' `shouldBe` uid

specImportToScimFromInvitation :: SpecWith TestEnv
Expand All @@ -213,7 +213,7 @@ specImportToScimFromInvitation =
email <- randomEmail
memberInvited <- call (inviteAndRegisterUser (env ^. teBrig) owner teamid email)
let memberIdInvited = userId memberInvited
emailInvited = maybe (error "must have email") id (userEmail memberInvited)
emailInvited = fromMaybe (error "must have email") (userEmail memberInvited)
pure (memberIdInvited, emailInvited)

addSamlIdP :: HasCallStack => UserId -> TestSpar (SAML.IdPConfig User.WireIdP, SAML.SignPrivCreds)
Expand Down Expand Up @@ -507,7 +507,7 @@ testCsvData tid owner uid mbeid mbsaml hasissuer = do
pure (decodeCSV @CsvExport.TeamExportUser rbody)

liftIO $ do
any (== uid) (CsvExport.tExportUserId <$> usersInCsv) `shouldBe` True
elem uid (CsvExport.tExportUserId <$> usersInCsv) `shouldBe` True
forM_ usersInCsv $ \export -> when (CsvExport.tExportUserId export == uid) $ do
('e', CsvExport.tExportSCIMExternalId export)
`shouldBe` ('e', fromMaybe "" mbeid)
Expand Down Expand Up @@ -924,7 +924,7 @@ testScimCreateVsUserRef = do
let uref = SAML.UserRef tenant subj
subj = either (error . show) id $ SAML.mkNameID uname Nothing Nothing Nothing
tenant = idp ^. SAML.idpMetadata . SAML.edIssuer
!(Just !uid) <- createViaSaml idp privCreds uref
(Just !uid) <- createViaSaml idp privCreds uref
samlUserShouldSatisfy uref isJust
deleteViaBrig uid
samlUserShouldSatisfy uref isJust -- brig doesn't talk to spar right now when users
Expand Down Expand Up @@ -1138,7 +1138,7 @@ testFindTeamSettingsInvitedUserMigratedWithEmailInTeamWithSSOViaUserId = do
let memberIdInvited = userId memberInvited

_ <- getUser tok memberIdInvited
Just brigUserInvited' <- runSpar $ Intra.getBrigUser Intra.NoPendingInvitations (memberIdInvited)
Just brigUserInvited' <- runSpar $ Intra.getBrigUser Intra.NoPendingInvitations memberIdInvited
liftIO $ userManagedBy brigUserInvited' `shouldBe` ManagedByScim

testFindProvisionedUserNoIdP :: TestSpar ()
Expand Down Expand Up @@ -2116,7 +2116,7 @@ specSCIMManaged = do
randomAlphaNum :: MonadIO m => m Text
randomAlphaNum = liftIO $ do
nrs <- replicateM 21 (randomRIO (97, 122)) -- a-z
return (cs (map chr nrs))
pure (cs (map chr nrs))

----------------------------------------------------------------------------
-- Team Search for SAML users
Expand Down
81 changes: 39 additions & 42 deletions services/spar/test-integration/Util/Core.hs
Original file line number Diff line number Diff line change
Expand Up @@ -222,20 +222,20 @@ mkEnvFromOptions = do
cliOptsParser :: OPA.Parser (String, String)
cliOptsParser =
(,)
<$> ( OPA.strOption $
OPA.long "integration-config"
<> OPA.short 'i'
<> OPA.help "Integration config to load"
<> OPA.showDefault
<> OPA.value defaultIntPath
)
<*> ( OPA.strOption $
OPA.long "service-config"
<> OPA.short 's'
<> OPA.help "Spar application config to load"
<> OPA.showDefault
<> OPA.value defaultSparPath
)
<$> OPA.strOption
( OPA.long "integration-config"
<> OPA.short 'i'
<> OPA.help "Integration config to load"
<> OPA.showDefault
<> OPA.value defaultIntPath
)
<*> OPA.strOption
( OPA.long "service-config"
<> OPA.short 's'
<> OPA.help "Spar application config to load"
<> OPA.showDefault
<> OPA.value defaultSparPath
)
where
defaultIntPath = "/etc/wire/integration/integration.yaml"
defaultSparPath = "/etc/wire/spar/conf/spar.yaml"
Expand Down Expand Up @@ -333,7 +333,7 @@ getUserBrig uid = do
200 -> do
let user = selfUser $ responseJsonUnsafe resp
pure $
if (userDeleted user)
if userDeleted user
then Nothing
else Just user
404 -> pure Nothing
Expand Down Expand Up @@ -367,7 +367,7 @@ createUserWithTeamDisableSSO brg gly = do
() <-
Control.Exception.assert {- "Team ID in self profile and team table do not match" -} (selfTeam == Just tid) $
pure ()
return (uid, tid)
pure (uid, tid)

getSSOEnabledInternal :: (HasCallStack, MonadHttp m, MonadIO m) => GalleyReq -> TeamId -> m ResponseLBS
getSSOEnabledInternal gly tid = do
Expand Down Expand Up @@ -407,7 +407,7 @@ inviteAndRegisterUser brig u tid inviteeEmail = do
unless (Just tid == userTeam invitee) $ error "Team ID in registration and team table do not match"
selfTeam <- userTeam . selfUser <$> getSelfProfile brig (userId invitee)
unless (selfTeam == Just tid) $ error "Team ID in self profile and team table do not match"
return invitee
pure invitee
where
accept' :: User.Email -> User.InvitationCode -> RequestBody
accept' email code = acceptWithName (User.Name "Bob") email code
Expand Down Expand Up @@ -450,7 +450,7 @@ inviteAndRegisterUser brig u tid inviteeEmail = do
. queryItem "invitation_id" (toByteString' ref)
)
let lbs = fromMaybe "" $ responseBody r
return $ fromByteString . fromMaybe (error "No code?") $ encodeUtf8 <$> (lbs ^? key "code" . _String)
pure $ fromByteString (maybe (error "No code?") encodeUtf8 (lbs ^? key "code" . _String))

-- | NB: this does create an SSO UserRef on brig, but not on spar. this is inconsistent, but the
-- inconsistency does not affect the tests we're running with this. to resolve it, we could add an
Expand Down Expand Up @@ -550,11 +550,9 @@ nextSubject = liftIO $ do
nextUserRef :: MonadIO m => m SAML.UserRef
nextUserRef = liftIO $ do
tenant <- UUID.toText <$> UUID.nextRandom
subject <- nextSubject
pure $
SAML.UserRef
(SAML.Issuer $ SAML.unsafeParseURI ("http://" <> tenant))
subject
SAML.UserRef
(SAML.Issuer $ SAML.unsafeParseURI ("http://" <> tenant))
<$> nextSubject

createRandomPhoneUser :: (HasCallStack, MonadCatch m, MonadIO m, MonadHttp m) => BrigReq -> m (UserId, Brig.Phone)
createRandomPhoneUser brig_ = do
Expand All @@ -574,7 +572,7 @@ createRandomPhoneUser brig_ = do
get (brig_ . path "/self" . zUser uid) !!! do
const 200 === statusCode
const (Right (Just phn)) === (fmap Brig.userPhone . responseJsonEither)
return (uid, phn)
pure (uid, phn)

getTeams :: (HasCallStack, MonadHttp m, MonadIO m) => UserId -> GalleyReq -> m Galley.TeamList
getTeams u gly = do
Expand All @@ -585,7 +583,7 @@ getTeams u gly = do
. zAuthAccess u "conn"
. expect2xx
)
return $ responseJsonUnsafe r
pure $ responseJsonUnsafe r

getTeamMemberIds :: HasCallStack => UserId -> TeamId -> TestSpar [UserId]
getTeamMemberIds usr tid = (^. Galley.userId) <$$> getTeamMembers usr tid
Expand Down Expand Up @@ -613,7 +611,7 @@ promoteTeamMember usr tid memid = do
getSelfProfile :: (HasCallStack, MonadHttp m, MonadIO m) => BrigReq -> UserId -> m Brig.SelfProfile
getSelfProfile brg usr = do
rsp <- get $ brg . path "/self" . zUser usr
return $ responseJsonUnsafe rsp
pure $ responseJsonUnsafe rsp

zAuthAccess :: UserId -> SBS -> Request -> Request
zAuthAccess u c = header "Z-Type" "access" . zUser u . zConn c
Expand All @@ -624,13 +622,13 @@ newTeam = Galley.BindingNewTeam $ Galley.newNewTeam (unsafeRange "teamName") Def
randomEmail :: MonadIO m => m Brig.Email
randomEmail = do
uid <- liftIO nextRandom
return $ Brig.Email ("success+" <> UUID.toText uid) "simulator.amazonses.com"
pure $ Brig.Email ("success+" <> UUID.toText uid) "simulator.amazonses.com"

randomPhone :: MonadIO m => m Brig.Phone
randomPhone = liftIO $ do
nrs <- map show <$> replicateM 14 (randomRIO (0, 9) :: IO Int)
let phone = Brig.parsePhone . cs $ "+0" ++ concat nrs
return $ fromMaybe (error "Invalid random phone#") phone
pure $ fromMaybe (error "Invalid random phone#") phone

randomUser :: (HasCallStack, MonadCatch m, MonadIO m, MonadHttp m) => BrigReq -> m Brig.User
randomUser brig_ = do
Expand All @@ -644,7 +642,7 @@ createUser ::
m Brig.User
createUser name brig_ = do
r <- postUser name True Nothing Nothing brig_ <!! const 201 === statusCode
return $ responseJsonUnsafe r
pure $ responseJsonUnsafe r

-- more flexible variant of 'createUser' (see above). (check the variant that brig has before you
-- clone this again!)
Expand Down Expand Up @@ -687,7 +685,7 @@ getActivationCode brig_ ep = do
let lbs = fromMaybe "" $ responseBody r
let akey = Brig.ActivationKey . Ascii.unsafeFromText <$> (lbs ^? Aeson.key "key" . Aeson._String)
let acode = Brig.ActivationCode . Ascii.unsafeFromText <$> (lbs ^? Aeson.key "code" . Aeson._String)
return $ (,) <$> akey <*> acode
pure $ (,) <$> akey <*> acode

activate ::
(HasCallStack, MonadIO m, MonadHttp m) =>
Expand Down Expand Up @@ -753,7 +751,7 @@ makeTestIdP = do
SampleIdP md _ _ _ <- makeSampleIdPMetadata
IdPConfig
<$> (IdPId <$> liftIO UUID.nextRandom)
<*> (pure md)
<*> pure md
<*> nextWireIdP apiversion

getTestSPMetadata :: (HasCallStack, MonadReader TestEnv m, MonadIO m) => TeamId -> m SPMetadata
Expand Down Expand Up @@ -932,7 +930,7 @@ loginCreatedSsoUser nameid idp privCreds = do
authnResp <- runSimpleSP $ mkAuthnResponseWithSubj nameid privCreds idp spmeta authnReq True
sparAuthnResp <- submitAuthnResponse tid authnResp

let wireCookie = maybe (error (show sparAuthnResp)) id . lookup "Set-Cookie" $ responseHeaders sparAuthnResp
let wireCookie = fromMaybe (error (show sparAuthnResp)) . lookup "Set-Cookie" $ responseHeaders sparAuthnResp
accessResp :: ResponseLBS <-
call $
post ((env ^. teBrig) . path "/access" . header "Cookie" wireCookie . expect2xx)
Expand Down Expand Up @@ -1095,16 +1093,15 @@ callIdpCreateReplace' apiversion sparreq_ muid metadata idpid = do
. maybe id zUser muid
. path "/identity-providers/"
. Bilge.query
( [ ( "api_version",
case apiversion of
WireIdPAPIV1 -> if explicitQueryParam then Just "v1" else Nothing
WireIdPAPIV2 -> Just "v2"
),
( "replaces",
Just . cs . idPIdToST $ idpid
)
]
)
[ ( "api_version",
case apiversion of
WireIdPAPIV1 -> if explicitQueryParam then Just "v1" else Nothing
WireIdPAPIV2 -> Just "v2"
),
( "replaces",
Just . cs . idPIdToST $ idpid
)
]
. body (RequestBodyLBS . cs $ SAML.encode metadata)
. header "Content-Type" "application/xml"

Expand Down
2 changes: 1 addition & 1 deletion services/spar/test-integration/Util/Email.hs
Original file line number Diff line number Diff line change
Expand Up @@ -153,7 +153,7 @@ getActivationCode brig ep = do
let lbs = fromMaybe "" $ responseBody r
let akey = ActivationKey . Ascii.unsafeFromText <$> (lbs ^? key "key" . _String)
let acode = ActivationCode . Ascii.unsafeFromText <$> (lbs ^? key "code" . _String)
return $ (,) <$> akey <*> acode
pure $ (,) <$> akey <*> acode

setSamlEmailValidation :: HasCallStack => TeamId -> Feature.TeamFeatureStatusValue -> TestSpar ()
setSamlEmailValidation tid status = do
Expand Down
Loading