nexarch/internal/oidc/login_test.go

package oidc

import (
	"context"
	"crypto/rsa"
	"fmt"
	"os"
	"testing"
	"time"

	"github.com/jackc/pgx/v5/pgxpool"
	"github.com/golang-jwt/jwt/v5"

	"gitea.perlbach24.de/scripte/nexarch/internal/auth"
	"gitea.perlbach24.de/scripte/nexarch/internal/ldapsync"
	"gitea.perlbach24.de/scripte/nexarch/internal/rbac"
	"gitea.perlbach24.de/scripte/nexarch/internal/user"
)

func setupLoginTest(t *testing.T) (*pgxpool.Pool, func()) {
	t.Helper()
	adminDSN := os.Getenv("TEST_ADMIN_DSN")
	if adminDSN == "" {
		t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
	}
	ctx := context.Background()

	pool, err := pgxpool.New(ctx, adminDSN)
	if err != nil {
		t.Fatalf("pool: %v", err)
	}
	if _, err := pool.Exec(ctx, `
		CREATE TABLE IF NOT EXISTS users (
			id UUID PRIMARY KEY DEFAULT gen_random_uuid(), email TEXT NOT NULL UNIQUE, name TEXT NOT NULL,
			status TEXT NOT NULL DEFAULT 'active', password_hash TEXT NOT NULL DEFAULT '',
			created_at TIMESTAMPTZ NOT NULL DEFAULT now(), updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
		);
		CREATE TABLE IF NOT EXISTS role_assignments (
			user_id UUID PRIMARY KEY REFERENCES users(id), role TEXT NOT NULL CHECK (role IN ('user','tenant_admin')),
			granted_by TEXT NOT NULL, granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
		);
		CREATE TABLE IF NOT EXISTS role_assignment_history (
			id UUID PRIMARY KEY DEFAULT gen_random_uuid(), user_id UUID NOT NULL, role TEXT NOT NULL,
			granted_by TEXT NOT NULL, granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
		);
		CREATE TABLE IF NOT EXISTS ldap_group_role_mapping (
			ldap_group TEXT PRIMARY KEY, role TEXT NOT NULL CHECK (role IN ('user','tenant_admin'))
		);
		CREATE TABLE IF NOT EXISTS oidc_states (
			state TEXT PRIMARY KEY, nonce TEXT NOT NULL, expires_at TIMESTAMPTZ NOT NULL,
			used_at TIMESTAMPTZ, created_at TIMESTAMPTZ NOT NULL DEFAULT now()
		);
	`); err != nil {
		t.Fatalf("schema: %v", err)
	}

	cleanup := func() { pool.Close() }
	return pool, cleanup
}

// Akzeptanzkriterium 1 + 3: End-to-End-Login gegen ein (selbst signiertes,
// aber protokollkorrektes) ID-Token — Signatur, Nonce, State, Rollen-Mapping,
// Sitzungs-Token-Ausstellung.
func TestCompleteOIDCLogin_EndToEnd(t *testing.T) {
	pool, cleanup := setupLoginTest(t)
	defer cleanup()
	ctx := context.Background()

	key := generateTestKey(t)
	verifier := NewVerifier(map[string]*rsa.PublicKey{"kid-1": &key.PublicKey}, "https://idp.example.com")
	states := NewStateStore(pool)
	users := user.NewTenantUserStore(pool)
	roles := rbac.NewStore(pool)
	roleMapping := ldapsync.NewRoleMappingStore(pool)
	issuer := auth.NewTokenIssuer("test-secret-nur-fuer-tests")

	if err := roleMapping.SetMapping(ctx, "sso-admins", rbac.RoleTenantAdmin); err != nil {
		t.Fatalf("set mapping: %v", err)
	}

	state, nonce, err := states.Generate(ctx)
	if err != nil {
		t.Fatalf("generate state: %v", err)
	}

	email := fmt.Sprintf("oidc-test-%d@example.com", time.Now().UnixNano())
	claims := Claims{
		Subject: "idp-subject-123",
		Email:   email,
		Nonce:   nonce,
		Roles:   []string{"sso-admins"},
		RegisteredClaims: jwt.RegisteredClaims{
			Issuer:    "https://idp.example.com",
			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
		},
	}
	idToken := signTestToken(t, key, "kid-1", claims)

	token, err := CompleteOIDCLogin(ctx, verifier, states, users, roles, roleMapping, issuer, "acme", state, idToken)
	if err != nil {
		t.Fatalf("complete oidc login: %v", err)
	}
	if token == "" {
		t.Fatal("erwartet nicht-leeres sitzungs-token")
	}

	assignment, err := roles.Get(ctx, mustGetUserID(t, ctx, users, email))
	if err != nil {
		t.Fatalf("rollenzuweisung lesen: %v", err)
	}
	if assignment.Role != rbac.RoleTenantAdmin {
		t.Fatalf("erwartet tenant_admin aus sso-admins-mapping, habe %q", assignment.Role)
	}

	// Replay desselben state schlaegt fehl.
	if _, err := CompleteOIDCLogin(ctx, verifier, states, users, roles, roleMapping, issuer, "acme", state, idToken); err == nil {
		t.Fatal("erwartet fehler bei wiederverwendetem state (replay)")
	}
}

// Akzeptanzkriterium 2 + Pruefung 1: keine Privilege-Escalation ueber
// manipulierte/unbekannte Rollen-Claims.
func TestCompleteOIDCLogin_UnmappedRoleGrantsNothing(t *testing.T) {
	pool, cleanup := setupLoginTest(t)
	defer cleanup()
	ctx := context.Background()

	key := generateTestKey(t)
	verifier := NewVerifier(map[string]*rsa.PublicKey{"kid-1": &key.PublicKey}, "https://idp.example.com")
	states := NewStateStore(pool)
	users := user.NewTenantUserStore(pool)
	roles := rbac.NewStore(pool)
	roleMapping := ldapsync.NewRoleMappingStore(pool)
	issuer := auth.NewTokenIssuer("test-secret-nur-fuer-tests")

	state, nonce, err := states.Generate(ctx)
	if err != nil {
		t.Fatalf("generate state: %v", err)
	}

	email := fmt.Sprintf("oidc-test-%d@example.com", time.Now().UnixNano())
	claims := Claims{
		Email: email,
		Nonce: nonce,
		// Versuch, sich ueber einen manipulierten Rollen-Claim
		// hochzustufen — diese Gruppen wurden NIE gemappt.
		Roles: []string{"tenant_admin", "superadmin"},
		RegisteredClaims: jwt.RegisteredClaims{
			Issuer:    "https://idp.example.com",
			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
		},
	}
	idToken := signTestToken(t, key, "kid-1", claims)

	if _, err := CompleteOIDCLogin(ctx, verifier, states, users, roles, roleMapping, issuer, "acme", state, idToken); err != nil {
		t.Fatalf("complete oidc login: %v", err)
	}

	userID := mustGetUserID(t, ctx, users, email)
	if _, err := roles.Get(ctx, userID); err == nil {
		t.Fatal("erwartet KEINE rollenzuweisung fuer nicht gemappte claims (privilege-escalation-versuch)")
	}
}

func mustGetUserID(t *testing.T, ctx context.Context, users *user.TenantUserStore, email string) string {
	t.Helper()
	creds, err := users.GetByEmailForAuth(ctx, email)
	if err != nil {
		t.Fatalf("get user by email: %v", err)
	}
	return creds.User.ID
}