mirror of
https://github.com/overleaf/overleaf.git
synced 2024-11-07 20:31:06 -05:00
[web] Unit test for GroupSSOHandler (#15652)
* [web] Unit test for `GroupSSOHandler` GitOrigin-RevId: 6b3bf8f9a77c8c2065937cf1887dcd086734f495
This commit is contained in:
Miguel Serrano
Copybot
parent
b0ddbbb5f8
commit
33981d7f91
1 changed files with 210 additions and 0 deletions
210
services/web/test/unit/src/Subscription/GroupSSOHandlerTests.js
Normal file
210
services/web/test/unit/src/Subscription/GroupSSOHandlerTests.js
Normal file
|
|
@ -0,0 +1,210 @@
|
|||
const SandboxedModule = require('sandboxed-module')
|
||||
const sinon = require('sinon')
|
||||
const chai = require('chai')
|
||||
const { expect } = chai
|
||||
const { ObjectId } = require('mongodb')
|
||||
const Errors = require('../../../../app/src/Features/Errors/Errors')
|
||||
|
||||
const MODULE_PATH = '../../../../app/src/Features/Subscription/GroupSSOHandler'
|
||||
|
||||
describe('GroupSSOHandler', function () {
|
||||
beforeEach(function () {
|
||||
this.user = { _id: new ObjectId(), enrollment: { sso: [] } }
|
||||
this.subscription = {
|
||||
_id: ObjectId().toString(),
|
||||
admin_id: new ObjectId(),
|
||||
member_ids: [this.user._id],
|
||||
}
|
||||
this.samlIdentifier = {
|
||||
externalUserId: 'user@external.com',
|
||||
userIdAttribute: 'email',
|
||||
providerId: `ol-group-subscription-id:${this.subscription._id.toString()}`,
|
||||
}
|
||||
this.auditLog = {
|
||||
initiatorId: 'test-initiator-id',
|
||||
ipAddress: '127.0.0.1',
|
||||
}
|
||||
this.ssoConfigData = {
|
||||
entryPoint: 'https://example.com/saml',
|
||||
certificates: ['abc'],
|
||||
signatureAlgorithm: 'sha256',
|
||||
userIdAttribute: 'nameId',
|
||||
enabled: true,
|
||||
}
|
||||
|
||||
this.SSOConfig = {
|
||||
findById: sinon.stub().returns({
|
||||
exec: sinon.stub().resolves(this.ssoConfigData),
|
||||
}),
|
||||
}
|
||||
this.UserAuditLogHandler = {
|
||||
promises: {
|
||||
addEntry: sinon.stub().resolves(),
|
||||
},
|
||||
}
|
||||
this.UserUpdater = {
|
||||
promises: {
|
||||
updateUser: sinon.stub().resolves(),
|
||||
},
|
||||
}
|
||||
this.SAMLIdentityManager = {
|
||||
getUser: sinon.stub().resolves(),
|
||||
}
|
||||
this.User = {
|
||||
findOne: sinon.stub().returns({
|
||||
exec: sinon.stub().resolves(this.user),
|
||||
}),
|
||||
}
|
||||
this.GroupSSOHandler = SandboxedModule.require(MODULE_PATH, {
|
||||
requires: {
|
||||
'../../models/SSOConfig': { SSOConfig: this.SSOConfig },
|
||||
'../User/UserAuditLogHandler': this.UserAuditLogHandler,
|
||||
'../User/UserUpdater': this.UserUpdater,
|
||||
'../User/SAMLIdentityManager': this.SAMLIdentityManager,
|
||||
'../../models/User': {
|
||||
User: this.User,
|
||||
},
|
||||
},
|
||||
})
|
||||
})
|
||||
|
||||
describe('checkUserCanEnrollInSubscription', function () {
|
||||
it('should throw an error if the subscription is not found', async function () {
|
||||
this.SSOConfig.findById.returns({
|
||||
exec: sinon.stub().resolves(undefined),
|
||||
})
|
||||
await expect(
|
||||
this.GroupSSOHandler.promises.checkUserCanEnrollInSubscription(
|
||||
this.user._id,
|
||||
this.subscription
|
||||
)
|
||||
).to.be.rejectedWith(Errors.SAMLGroupSSODisabledError)
|
||||
})
|
||||
|
||||
it('should throw an error if SSO is not enabled for the group', async function () {
|
||||
const disabledSSOConfig = { ...this.ssoConfig, enabled: false }
|
||||
this.SSOConfig.findById.returns({
|
||||
exec: sinon.stub().resolves(disabledSSOConfig),
|
||||
})
|
||||
await expect(
|
||||
this.GroupSSOHandler.promises.checkUserCanEnrollInSubscription(
|
||||
this.user._id,
|
||||
this.subscription
|
||||
)
|
||||
).to.be.rejectedWith(Errors.SAMLGroupSSODisabledError)
|
||||
})
|
||||
|
||||
it('should throw an error if the user is not a member of the group', async function () {
|
||||
const testSubscription = {
|
||||
...this.subscription,
|
||||
member_ids: [],
|
||||
}
|
||||
await expect(
|
||||
this.GroupSSOHandler.promises.checkUserCanEnrollInSubscription(
|
||||
this.user._id,
|
||||
testSubscription
|
||||
)
|
||||
).to.be.rejectedWith(Errors.SAMLGroupSSOLoginIdentityNotFoundError)
|
||||
})
|
||||
|
||||
it('should throw an error if the user is already enrolled to the group', async function () {
|
||||
const testUser = {
|
||||
...this.user,
|
||||
enrollment: {
|
||||
sso: [{ groupId: this.subscription._id }],
|
||||
},
|
||||
}
|
||||
this.User.findOne.returns({
|
||||
exec: sinon.stub().resolves(testUser),
|
||||
})
|
||||
await expect(
|
||||
this.GroupSSOHandler.promises.checkUserCanEnrollInSubscription(
|
||||
this.user._id,
|
||||
this.subscription
|
||||
)
|
||||
).to.be.rejectedWith(Errors.SAMLIdentityExistsError)
|
||||
})
|
||||
|
||||
it('should resolve if the user can be enrolled to the group', async function () {
|
||||
await expect(
|
||||
this.GroupSSOHandler.promises.checkUserCanEnrollInSubscription(
|
||||
this.user._id,
|
||||
this.subscription
|
||||
)
|
||||
).to.be.fulfilled
|
||||
})
|
||||
})
|
||||
|
||||
describe('enrollInSubscription', function () {
|
||||
it('should throw an error if the user cannot be enrolled', async function () {
|
||||
const disabledSSOConfig = { ...this.ssoConfig, enabled: false }
|
||||
this.SSOConfig.findById.returns({
|
||||
exec: sinon.stub().resolves(disabledSSOConfig),
|
||||
})
|
||||
await expect(
|
||||
this.GroupSSOHandler.promises.enrollInSubscription(
|
||||
this.user._id,
|
||||
this.subscription,
|
||||
this.samlIdentifier.externalUserId,
|
||||
this.samlIdentifier.userIdAttribute,
|
||||
this.auditLog
|
||||
)
|
||||
).to.be.rejectedWith(Errors.SAMLGroupSSODisabledError)
|
||||
})
|
||||
|
||||
it('should throw an error if an identical SAML identity for the subscription/user already exists', async function () {
|
||||
this.SAMLIdentityManager.getUser.resolves(this.user)
|
||||
await expect(
|
||||
this.GroupSSOHandler.promises.enrollInSubscription(
|
||||
this.user._id,
|
||||
this.subscription,
|
||||
this.samlIdentifier.externalUserId,
|
||||
this.samlIdentifier.userIdAttribute,
|
||||
this.auditLog
|
||||
)
|
||||
).to.be.rejectedWith(Errors.SAMLIdentityExistsError)
|
||||
})
|
||||
|
||||
it("should add an entry the user's SSO enrollment and samlIdentifiers lists", async function () {
|
||||
await this.GroupSSOHandler.promises.enrollInSubscription(
|
||||
this.user._id,
|
||||
this.subscription,
|
||||
this.samlIdentifier.externalUserId,
|
||||
this.samlIdentifier.userIdAttribute,
|
||||
this.auditLog
|
||||
)
|
||||
expect(this.UserUpdater.promises.updateUser).to.have.been.calledWith(
|
||||
this.user._id,
|
||||
{
|
||||
$push: {
|
||||
samlIdentifiers: this.samlIdentifier,
|
||||
'enrollment.sso': {
|
||||
groupId: this.subscription._id,
|
||||
linkedAt: sinon.match.instanceOf(Date),
|
||||
primary: true,
|
||||
},
|
||||
},
|
||||
}
|
||||
)
|
||||
})
|
||||
|
||||
it('should add an entry to the user audit log', async function () {
|
||||
await this.GroupSSOHandler.promises.enrollInSubscription(
|
||||
this.user._id,
|
||||
this.subscription,
|
||||
this.samlIdentifier.externalUserId,
|
||||
this.samlIdentifier.userIdAttribute,
|
||||
this.auditLog
|
||||
)
|
||||
expect(
|
||||
this.UserAuditLogHandler.promises.addEntry
|
||||
).to.have.been.calledWith(
|
||||
this.user._id,
|
||||
'group-sso-link',
|
||||
this.auditLog.initiatorId,
|
||||
this.auditLog.ipAddress,
|
||||
this.samlIdentifier
|
||||
)
|
||||
})
|
||||
})
|
||||
})
|
||||
Loading…
Reference in a new issue