Jon Chery
5429da1f87
---ci--- project: orca phase: 4 milestone: v0.12 status: execute ---/ci--- internal/identity/oidc.go: OIDC client (provider discovery, JWKS, auth-code+PKCE+local-loopback redirect flow, device-code headless fallback, token verification, credentials store at ~/.orca/credentials.json 0600, refresh). VerifyIDTokenStatic for SSH-push applier. internal/cli/auth.go: orca auth login/logout/status/init-idp commands. Dependencies: github.com/coreos/go-oidc/v3, github.com/go-webauthn/webauthn (pre-added for P05). Bundled Dex deploy (init-idp) stubs to P05 (WebAuthn connector ships the full systemd unit + Traefik route). 9 tests pass (5 identity + 4 CLI). go vet clean. Full build green.
54 lines
1.4 KiB
Go
54 lines
1.4 KiB
Go
package cli
|
|
|
|
import (
|
|
"testing"
|
|
)
|
|
|
|
// TestAuthStatusNotAuthenticated verifies auth status reports
|
|
// "not authenticated" when no credentials exist.
|
|
func TestAuthStatusNotAuthenticated(t *testing.T) {
|
|
dir := t.TempDir()
|
|
t.Setenv("ORCA_HOME", dir)
|
|
resetRootFlags(t)
|
|
rootCmd.SetArgs([]string{"auth", "status"})
|
|
// auth status should not error on missing credentials.
|
|
if err := rootCmd.Execute(); err != nil {
|
|
t.Errorf("auth status on missing creds: %v", err)
|
|
}
|
|
}
|
|
|
|
// TestAuthLogoutNoCreds verifies logout succeeds even with no creds.
|
|
func TestAuthLogoutNoCreds(t *testing.T) {
|
|
dir := t.TempDir()
|
|
t.Setenv("ORCA_HOME", dir)
|
|
resetRootFlags(t)
|
|
rootCmd.SetArgs([]string{"auth", "logout"})
|
|
if err := rootCmd.Execute(); err != nil {
|
|
t.Errorf("auth logout with no creds: %v", err)
|
|
}
|
|
}
|
|
|
|
// TestAuthInitIDPRequiresRPID verifies --rp-id is required.
|
|
func TestAuthInitIDPRequiresRPID(t *testing.T) {
|
|
dir := t.TempDir()
|
|
t.Setenv("ORCA_HOME", dir)
|
|
resetRootFlags(t)
|
|
rootCmd.SetArgs([]string{"auth", "init-idp"})
|
|
err := rootCmd.Execute()
|
|
if err == nil {
|
|
t.Error("auth init-idp without --rp-id should error")
|
|
}
|
|
}
|
|
|
|
// TestAuthLoginRequiresIssuer verifies --issuer is required.
|
|
func TestAuthLoginRequiresIssuer(t *testing.T) {
|
|
dir := t.TempDir()
|
|
t.Setenv("ORCA_HOME", dir)
|
|
resetRootFlags(t)
|
|
rootCmd.SetArgs([]string{"auth", "login"})
|
|
err := rootCmd.Execute()
|
|
if err == nil {
|
|
t.Error("auth login without --issuer should error")
|
|
}
|
|
}
|