Jon Chery
978334a4bc
Implements the v0.12 R-021 load-bearing change's working IdP path: - orca auth init-idp: renders Dex config + systemd unit + Traefik route (atomic deploy, RP ID from --rp-id, C-38) - orca auth register: opens browser to WebAuthn registration page - loadOIDCConfig: config-file loading (oidc block + cluster_domain), falls back to flags + env vars - orca doctor oidc: health check (systemctl is-active + .well-known) - config.go: OIDCConfig block + ClusterDomain field - markdown.go: oidc block parsing in config frontmatter ---ci--- project: orca phase: 6 milestone: v0.13 status: complete requirements: covered: [155] ---/ci---
94 lines
2.9 KiB
Go
94 lines
2.9 KiB
Go
package cli
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// TestAuthInitIDP_RendersConfig tests that orca auth init-idp renders
|
|
// the Dex config, systemd unit, and Traefik route files (P06, REQ-155).
|
|
func TestAuthInitIDP_RendersConfig(t *testing.T) {
|
|
t.Setenv("ORCA_HOME", t.TempDir())
|
|
resetRootFlags(t)
|
|
|
|
// Create the cluster dir + server cert/key so the rendered config paths exist.
|
|
clusterDir := filepath.Join(os.Getenv("ORCA_HOME"), "cluster")
|
|
if err := os.MkdirAll(clusterDir, 0o755); err != nil {
|
|
t.Fatalf("mkdir cluster: %v", err)
|
|
}
|
|
if err := os.WriteFile(filepath.Join(clusterDir, "server.crt"), []byte("fake-cert"), 0o600); err != nil {
|
|
t.Fatalf("write cert: %v", err)
|
|
}
|
|
if err := os.WriteFile(filepath.Join(clusterDir, "server.key"), []byte("fake-key"), 0o600); err != nil {
|
|
t.Fatalf("write key: %v", err)
|
|
}
|
|
|
|
// Run init-idp with a temp output (we mock the system paths).
|
|
// Since init-idp writes to /etc/systemd/system and /etc/traefik/dynamic,
|
|
// we test the render functions directly.
|
|
dexCfg := renderDexConfig(dexConfig{
|
|
Issuer: "https://orca.local",
|
|
ConfigPath: "/tmp/dex.yaml",
|
|
ClusterDir: clusterDir,
|
|
ServerCertPath: filepath.Join(clusterDir, "server.crt"),
|
|
ServerKeyPath: filepath.Join(clusterDir, "server.key"),
|
|
RPID: "orca.local",
|
|
CredsDBPath: filepath.Join(clusterDir, "webauthn-credentials.db"),
|
|
})
|
|
if !strings.Contains(dexCfg, "issuer: https://orca.local") {
|
|
t.Errorf("dex config missing issuer: %s", dexCfg)
|
|
}
|
|
if !strings.Contains(dexCfg, "orca-webauthn") {
|
|
t.Errorf("dex config missing webauthn connector: %s", dexCfg)
|
|
}
|
|
if !strings.Contains(dexCfg, "rpID: orca.local") {
|
|
t.Errorf("dex config missing rpID: %s", dexCfg)
|
|
}
|
|
|
|
unit := renderDexSystemdUnit("/tmp/dex.yaml")
|
|
if !strings.Contains(unit, "Orca Dex") {
|
|
t.Errorf("systemd unit missing orca-dex: %s", unit)
|
|
}
|
|
if !strings.Contains(unit, "dex serve /tmp/dex.yaml") {
|
|
t.Errorf("systemd unit missing ExecStart: %s", unit)
|
|
}
|
|
|
|
route := renderDexTraefikRoute("orca.local")
|
|
if !strings.Contains(route, "orca.local") {
|
|
t.Errorf("traefik route missing rpID: %s", route)
|
|
}
|
|
if !strings.Contains(route, "orca-dex") {
|
|
t.Errorf("traefik route missing service name: %s", route)
|
|
}
|
|
}
|
|
|
|
// TestAuthRegisterCmd_Exists verifies the auth register command is registered.
|
|
func TestAuthRegisterCmd_Exists(t *testing.T) {
|
|
found := false
|
|
for _, cmd := range authCmd.Commands() {
|
|
if cmd.Name() == "register" {
|
|
found = true
|
|
break
|
|
}
|
|
}
|
|
if !found {
|
|
t.Error("auth register command not found in auth subcommands")
|
|
}
|
|
}
|
|
|
|
// TestDoctorOIDCCmd_Exists verifies the doctor oidc command is registered.
|
|
func TestDoctorOIDCCmd_Exists(t *testing.T) {
|
|
found := false
|
|
for _, cmd := range doctorCmd.Commands() {
|
|
if cmd.Name() == "oidc" {
|
|
found = true
|
|
break
|
|
}
|
|
}
|
|
if !found {
|
|
t.Error("doctor oidc command not found in doctor subcommands")
|
|
}
|
|
}
|