nexarch/internal/saml/login_test.go

package saml

import (
	"context"
	"crypto/rsa"
	"fmt"
	"os"
	"testing"
	"time"

	"github.com/golang-jwt/jwt/v5"
	"github.com/jackc/pgx/v5/pgxpool"

	"gitea.perlbach24.de/scripte/nexarch/internal/auth"
	"gitea.perlbach24.de/scripte/nexarch/internal/ldapsync"
	"gitea.perlbach24.de/scripte/nexarch/internal/oidc"
	"gitea.perlbach24.de/scripte/nexarch/internal/rbac"
	"gitea.perlbach24.de/scripte/nexarch/internal/user"
)

const schema = `
CREATE TABLE IF NOT EXISTS users (
	id UUID PRIMARY KEY DEFAULT gen_random_uuid(), email TEXT NOT NULL UNIQUE, name TEXT NOT NULL,
	status TEXT NOT NULL DEFAULT 'active', password_hash TEXT NOT NULL DEFAULT '',
	created_at TIMESTAMPTZ NOT NULL DEFAULT now(), updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
);
CREATE TABLE IF NOT EXISTS role_assignments (
	user_id UUID PRIMARY KEY REFERENCES users(id), role TEXT NOT NULL CHECK (role IN ('user','tenant_admin')),
	granted_by TEXT NOT NULL, granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
);
CREATE TABLE IF NOT EXISTS role_assignment_history (
	id UUID PRIMARY KEY DEFAULT gen_random_uuid(), user_id UUID NOT NULL, role TEXT NOT NULL,
	granted_by TEXT NOT NULL, granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
);
CREATE TABLE IF NOT EXISTS ldap_group_role_mapping (
	ldap_group TEXT PRIMARY KEY, role TEXT NOT NULL CHECK (role IN ('user','tenant_admin'))
);`

func setupTest(t *testing.T) (*pgxpool.Pool, func()) {
	t.Helper()
	adminDSN := os.Getenv("TEST_ADMIN_DSN")
	if adminDSN == "" {
		t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
	}
	ctx := context.Background()

	pool, err := pgxpool.New(ctx, adminDSN)
	if err != nil {
		t.Fatalf("pool: %v", err)
	}
	if _, err := pool.Exec(ctx, schema); err != nil {
		t.Fatalf("schema: %v", err)
	}
	cleanup := func() { pool.Close() }
	return pool, cleanup
}

// Akzeptanzkriterium 1 + Pruefung 1: End-to-End-Test gegen simulierten SAML-IdP.
// Akzeptanzkriterium 3 + Pruefung 3: Rollenzuordnung aus SAML-Attributen korrekt.
func TestCompleteSAMLLogin_EndToEnd(t *testing.T) {
	pool, cleanup := setupTest(t)
	defer cleanup()
	ctx := context.Background()

	idpKey := generateTestIdPKey(t)
	verifier := NewVerifier(&idpKey.PublicKey, "https://test-idp.example.com")
	users := user.NewTenantUserStore(pool)
	roles := rbac.NewStore(pool)
	roleMapping := ldapsync.NewRoleMappingStore(pool)
	issuer := auth.NewTokenIssuer("test-secret-nur-fuer-tests")

	if err := roleMapping.SetMapping(ctx, "saml-admins", rbac.RoleTenantAdmin); err != nil {
		t.Fatalf("set mapping: %v", err)
	}

	email := fmt.Sprintf("saml-test-%d@example.com", time.Now().UnixNano())
	rawResp, err := BuildResponse(idpKey, testAssertion("https://test-idp.example.com", email, []string{"saml-admins"}))
	if err != nil {
		t.Fatalf("build response (simulierter idp): %v", err)
	}

	token, err := CompleteSAMLLogin(ctx, verifier, users, roles, roleMapping, issuer, "acme", rawResp)
	if err != nil {
		t.Fatalf("complete saml login: %v", err)
	}
	if token == "" {
		t.Fatal("erwartet nicht-leeres sitzungs-token")
	}

	creds, err := users.GetByEmailForAuth(ctx, email)
	if err != nil {
		t.Fatalf("user nach login: %v", err)
	}
	assignment, err := roles.Get(ctx, creds.User.ID)
	if err != nil {
		t.Fatalf("rollenzuweisung lesen: %v", err)
	}
	if assignment.Role != rbac.RoleTenantAdmin {
		t.Fatalf("erwartet tenant_admin aus saml-admins-mapping, habe %q", assignment.Role)
	}
}

// Akzeptanzkriterium 3 + Pruefung 3 (Negativfall): keine Privilege-
// Escalation ueber unbekannte/manipulierte Rollen-Attribute.
func TestCompleteSAMLLogin_UnmappedRoleGrantsNothing(t *testing.T) {
	pool, cleanup := setupTest(t)
	defer cleanup()
	ctx := context.Background()

	idpKey := generateTestIdPKey(t)
	verifier := NewVerifier(&idpKey.PublicKey, "https://test-idp.example.com")
	users := user.NewTenantUserStore(pool)
	roles := rbac.NewStore(pool)
	roleMapping := ldapsync.NewRoleMappingStore(pool)
	issuer := auth.NewTokenIssuer("test-secret-nur-fuer-tests")

	email := fmt.Sprintf("saml-test-%d@example.com", time.Now().UnixNano())
	rawResp, err := BuildResponse(idpKey, testAssertion("https://test-idp.example.com", email, []string{"tenant_admin", "superadmin"}))
	if err != nil {
		t.Fatalf("build response: %v", err)
	}

	if _, err := CompleteSAMLLogin(ctx, verifier, users, roles, roleMapping, issuer, "acme", rawResp); err != nil {
		t.Fatalf("complete saml login: %v", err)
	}

	creds, err := users.GetByEmailForAuth(ctx, email)
	if err != nil {
		t.Fatalf("user nach login: %v", err)
	}
	if _, err := roles.Get(ctx, creds.User.ID); err == nil {
		t.Fatal("erwartet KEINE rollenzuweisung fuer nicht gemappte rollen-attribute")
	}
}

// Akzeptanzkriterium 2 + Pruefung 2: SAML- und OIDC-Anmeldung koennen
// nebeneinander fuer unterschiedliche Tenants konfiguriert sein — hier durch
// zwei physisch getrennte Tenant-Datenbanken demonstriert (Modell C).
func TestSAMLAndOIDC_WorkInParallelForDifferentTenants(t *testing.T) {
	adminDSN := os.Getenv("TEST_ADMIN_DSN")
	if adminDSN == "" {
		t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
	}
	ctx := context.Background()

	poolSAML, cleanupSAML := setupTest(t)
	defer cleanupSAML()

	poolOIDC, err := pgxpool.New(ctx, adminDSN)
	if err != nil {
		t.Fatalf("pool oidc: %v", err)
	}
	defer poolOIDC.Close()
	if _, err := poolOIDC.Exec(ctx, schema+`
		CREATE TABLE IF NOT EXISTS oidc_states (
			state TEXT PRIMARY KEY, nonce TEXT NOT NULL, expires_at TIMESTAMPTZ NOT NULL,
			used_at TIMESTAMPTZ, created_at TIMESTAMPTZ NOT NULL DEFAULT now()
		)`); err != nil {
		t.Fatalf("schema oidc: %v", err)
	}

	// Tenant "saml-tenant": SAML konfiguriert.
	idpKey := generateTestIdPKey(t)
	samlVerifier := NewVerifier(&idpKey.PublicKey, "https://test-idp.example.com")
	samlUsers := user.NewTenantUserStore(poolSAML)
	samlRoles := rbac.NewStore(poolSAML)
	samlMapping := ldapsync.NewRoleMappingStore(poolSAML)
	issuer := auth.NewTokenIssuer("test-secret-nur-fuer-tests")

	samlEmail := fmt.Sprintf("saml-parallel-%d@example.com", time.Now().UnixNano())
	samlResp, err := BuildResponse(idpKey, testAssertion("https://test-idp.example.com", samlEmail, nil))
	if err != nil {
		t.Fatalf("build saml response: %v", err)
	}
	samlToken, err := CompleteSAMLLogin(ctx, samlVerifier, samlUsers, samlRoles, samlMapping, issuer, "saml-tenant", samlResp)
	if err != nil {
		t.Fatalf("saml-tenant login: %v", err)
	}
	if samlToken == "" {
		t.Fatal("erwartet token fuer saml-tenant")
	}

	// Tenant "oidc-tenant": OIDC konfiguriert, voellig unabhaengige Datenbank.
	oidcKey := generateTestIdPKey(t)
	oidcVerifier := oidc.NewVerifier(map[string]*rsa.PublicKey{"kid-1": &oidcKey.PublicKey}, "https://oidc-idp.example.com")
	oidcStates := oidc.NewStateStore(poolOIDC)
	oidcUsers := user.NewTenantUserStore(poolOIDC)
	oidcRoles := rbac.NewStore(poolOIDC)
	oidcMapping := ldapsync.NewRoleMappingStore(poolOIDC)

	state, nonce, err := oidcStates.Generate(ctx)
	if err != nil {
		t.Fatalf("oidc generate state: %v", err)
	}
	oidcEmail := fmt.Sprintf("oidc-parallel-%d@example.com", time.Now().UnixNano())
	claims := oidc.Claims{
		Email: oidcEmail,
		Nonce: nonce,
		RegisteredClaims: jwt.RegisteredClaims{
			Issuer: "https://oidc-idp.example.com", ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
		},
	}
	idToken := signOIDCTestToken(t, oidcKey, claims)

	oidcToken, err := oidc.CompleteOIDCLogin(ctx, oidcVerifier, oidcStates, oidcUsers, oidcRoles, oidcMapping, issuer, "oidc-tenant", state, idToken)
	if err != nil {
		t.Fatalf("oidc-tenant login: %v", err)
	}
	if oidcToken == "" {
		t.Fatal("erwartet token fuer oidc-tenant")
	}

	if samlToken == oidcToken {
		t.Fatal("tokens sollten unterschiedlich sein")
	}
}

func signOIDCTestToken(t *testing.T, key *rsa.PrivateKey, claims oidc.Claims) string {
	t.Helper()
	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
	token.Header["kid"] = "kid-1"
	s, err := token.SignedString(key)
	if err != nil {
		t.Fatalf("sign oidc test token: %v", err)
	}
	return s
}