coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Deny suspended directory identities
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 24s
Details

Browse source
This commit is contained in:
tegwick 2026-07-28 01:23:22 +02:00
parent 76da0237ff
commit 909bb327fc
4 changed files with 67 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

28
src/internal/server/oidc/userinfo_test.go
View file

@ -27,7 +27,7 @@ func newUserinfoHandler(t *testing.T, users domain.UserRepository) (*oidc.Userin
capture := &captureEmitter{}
h := &oidc.UserinfoHandler{
Users: users,
SigningKey: &key.PublicKey,
SigningKey: &key.PublicKey,
Issuer: "https://auth.netkingdom.local",
Emitter: capture,
}
@ -100,6 +100,26 @@ func TestUserinfoHandler_ValidToken_ReturnsClaims(t *testing.T) {
}
}
func TestUserinfoHandler_SuspendedUserInvalidatesToken(t *testing.T) {
user := aliceUser()
user.Groups = append(user.Groups, "netkingdom-suspended")
users := &mockUserRepo{users: map[string]*domain.User{"alice": user}}
h, key := newUserinfoHandler(t, users)
now := time.Now()
token := buildToken(t, map[string]interface{}{
"iss": "https://auth.netkingdom.local",
"sub": "alice",
"aud": "test-client",
"exp": now.Add(10 * time.Minute).Unix(),
"iat": now.Unix(),
}, key)
w := httptest.NewRecorder()
h.ServeHTTP(w, userinfoRequest(token))
if w.Code != http.StatusUnauthorized {
t.Fatalf("expected 401, got %d: %s", w.Code, w.Body.String())
}
}
func TestUserinfoHandler_MissingAuthorization_Returns401(t *testing.T) {
users := &mockUserRepo{}
h, _ := newUserinfoHandler(t, users)
@ -246,10 +266,10 @@ func TestUserinfoHandler_EmitsTelemetry(t *testing.T) {
key, _ := rsa.GenerateKey(rand.Reader, 2048)
capture := &captureEmitter{}
h := &oidc.UserinfoHandler{
Users: users,
Users: users,
SigningKey: &key.PublicKey,
Issuer: "https://auth.netkingdom.local",
Emitter: capture,
Issuer: "https://auth.netkingdom.local",
Emitter: capture,
}
now := time.Now()