wmantly
87c0d024d5
Adds the /__proxy_auth OIDC flow served on every proxied host: - routes/host_auth.js: /start (PKCE+state, per-host redirect_uri), /callback (exchange, enforce the host allow-list via utils/host_sso.identityAllowed, mint session + set __proxy_sso cookie), /logout. - models/sso_session.js: SsoSession (Redis-backed, TTL'd; read directly by the Lua gate) and HostSsoState (in-flight auth request). - utils/oidc.js: per-host redirect_uri override on buildAuthUrl/exchangeCode. - conf.hostSso (reuses conf.oidc). Allow-list logic unit-tested. Enforcement (Lua gate + nginx location) lands next. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
43 lines
1.4 KiB
JavaScript
43 lines
1.4 KiB
JavaScript
'use strict';
|
|
|
|
const {describe, test} = require('node:test');
|
|
const assert = require('node:assert');
|
|
|
|
const {identityAllowed} = require('../../utils/host_sso');
|
|
|
|
describe('identityAllowed (per-host SSO authorization)', () => {
|
|
const id = {username: 'alice', email: 'alice@x.com', groups: ['dns-team', 'staff']};
|
|
|
|
test('empty allow-lists allow any authenticated user', () => {
|
|
assert.strictEqual(identityAllowed(id, [], []), true);
|
|
assert.strictEqual(identityAllowed(id, undefined, undefined), true);
|
|
});
|
|
|
|
test('allows by username', () => {
|
|
assert.strictEqual(identityAllowed(id, ['bob', 'alice'], []), true);
|
|
});
|
|
|
|
test('allows by email', () => {
|
|
assert.strictEqual(identityAllowed(id, ['alice@x.com'], []), true);
|
|
});
|
|
|
|
test('allows by group membership', () => {
|
|
assert.strictEqual(identityAllowed(id, [], ['dns-team']), true);
|
|
});
|
|
|
|
test('denies when neither user nor group matches a non-empty list', () => {
|
|
assert.strictEqual(identityAllowed(id, ['bob'], ['admins']), false);
|
|
});
|
|
|
|
test('is case-insensitive', () => {
|
|
assert.strictEqual(identityAllowed(id, ['ALICE'], []), true);
|
|
assert.strictEqual(identityAllowed(id, [], ['DNS-Team']), true);
|
|
assert.strictEqual(identityAllowed({username: 'A', email: 'A@X.com'}, ['a@x.com'], []), true);
|
|
});
|
|
|
|
test('handles a missing/empty identity gracefully', () => {
|
|
assert.strictEqual(identityAllowed({}, ['bob'], ['admins']), false);
|
|
assert.strictEqual(identityAllowed({}, [], []), true);
|
|
});
|
|
});
|