80 lines
3.3 KiB
Python
80 lines
3.3 KiB
Python
import pathlib
|
|
import sys
|
|
import unittest
|
|
|
|
sys.path.insert(0, str(pathlib.Path(__file__).parents[1]))
|
|
from provisioner import (
|
|
_directory_username,
|
|
_oidc_subject,
|
|
_username,
|
|
dispatch,
|
|
DriftResult,
|
|
LLDAPProvisioner,
|
|
Result,
|
|
)
|
|
|
|
|
|
class Fake:
|
|
def provision(self, payload): return Result("p", "u", "password_setup_required", False)
|
|
def suspend(self, subject): return Result("p", subject, "suspended", False)
|
|
def reactivate(self, subject): return Result("p", subject, "active", False)
|
|
def deprovision(self, subject): return Result("p", subject, "deprovisioned", False)
|
|
def drift(self, payload): return DriftResult("p", payload["external_subject"], "drifted", ("group:missing:t:users",))
|
|
def reconcile(self, payload): return DriftResult("p", payload["external_subject"], "reconciled", (), ("group:added:t:users",))
|
|
|
|
|
|
class ProvisionerTests(unittest.TestCase):
|
|
def test_username_is_stable_and_sanitized(self):
|
|
self.assertEqual("bernd.worsch", _username("Bernd.Worsch@binky-hedgehog.com"))
|
|
|
|
def test_oidc_subject_is_canonical_ldap_dn(self):
|
|
self.assertEqual(
|
|
"uid=bernd.worsch,ou=people,dc=netkingdom,dc=local",
|
|
_oidc_subject("bernd.worsch"),
|
|
)
|
|
|
|
def test_directory_lifecycle_normalizes_canonical_ldap_dn(self):
|
|
subject = "uid=bernd.worsch,ou=people,dc=netkingdom,dc=local"
|
|
self.assertEqual("bernd.worsch", _directory_username(subject))
|
|
self.assertEqual("bernd.worsch", _directory_username("bernd.worsch"))
|
|
|
|
def test_preferred_username_is_honored_and_validated(self):
|
|
self.assertEqual("chosen.name", _username("other@example.test", "Chosen.Name"))
|
|
with self.assertRaisesRegex(ValueError, "invalid"):
|
|
_username("other@example.test", "not allowed!")
|
|
with self.assertRaisesRegex(ValueError, "reserved"):
|
|
_username("other@example.test", "admin")
|
|
|
|
def test_dispatch_requires_idempotency(self):
|
|
with self.assertRaisesRegex(ValueError, "idempotency_key"):
|
|
dispatch(Fake(), "/v1/identities/suspend", {
|
|
"external_subject": "u", "correlation_id": "c"
|
|
})
|
|
|
|
def test_lifecycle_dispatch(self):
|
|
result = dispatch(Fake(), "/v1/identities/suspend", {
|
|
"external_subject": "u",
|
|
"idempotency_key": "1234567890123456",
|
|
"correlation_id": "c",
|
|
})
|
|
self.assertEqual("suspended", result.status)
|
|
|
|
def test_drift_and_reconcile_dispatch(self):
|
|
payload = {
|
|
"external_subject": "u",
|
|
"tenant": "t",
|
|
"primary_email": "u@example.com",
|
|
"idempotency_key": "1234567890123456",
|
|
"correlation_id": "c",
|
|
}
|
|
drift = dispatch(Fake(), "/v1/identities/drift", payload)
|
|
reconciled = dispatch(Fake(), "/v1/identities/reconcile", payload)
|
|
self.assertEqual("drifted", drift.status)
|
|
self.assertEqual("reconciled", reconciled.status)
|
|
|
|
def test_missing_directory_user_is_normalized(self):
|
|
provisioner = LLDAPProvisioner(base_url="http://directory", admin_password="unused")
|
|
provisioner._gql = lambda *_args, **_kwargs: (_ for _ in ()).throw(
|
|
ValueError("User not found")
|
|
)
|
|
self.assertIsNone(provisioner._user("token", "absent"))
|