Docker/forgejo
Docker/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2025-08-02 16:35:19 +02:00
Code Issues Releases Activity

fix(sec): add tests for OAuth2 signup

Browse source 
Test two scenarios:
1. Account linking is set to `auto` and tries to link against a user who
is enrolled into Webauthn should show 2FA screen.
2. User is already linked and logins via OAuth2 and is enrolled into
WebAuthn should show 2FA screen.

(cherry picked from commit aa4ae81fe0)
This commit is contained in:
Gusted 2025-04-29 13:31:20 +02:00 • committed by Earl Warren
parent 23e6ca0415
commit f4f7083960
No known key found for this signature in database
GPG key ID: 0579CB2928A78A00
1 changed files with 67 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

67
tests/integration/oauth_test.go
View file

@ -12,6 +12,7 @@ import (
"testing"
auth_model "code.gitea.io/gitea/models/auth"
"code.gitea.io/gitea/models/db"
"code.gitea.io/gitea/models/unittest"
user_model "code.gitea.io/gitea/models/user"
"code.gitea.io/gitea/modules/json"
@ -635,3 +636,69 @@ func TestOAuth_GrantApplicationOAuth(t *testing.T) {
resp = ctx.MakeRequest(t, req, http.StatusSeeOther)
assert.Contains(t, test.RedirectURL(resp), "error=access_denied&error_description=the+request+is+denied")
}
func TestSignUpViaOAuthLinking2FA(t *testing.T) {
defer tests.PrepareTestEnv(t)()
defer test.MockVariableValue(&setting.OAuth2Client.EnableAutoRegistration, true)()
defer test.MockVariableValue(&setting.OAuth2Client.AccountLinking, setting.OAuth2AccountLinkingAuto)()
// Fake that user 2 is enrolled into WebAuthn.
t.Cleanup(func() {
require.NoError(t, db.DeleteBeans(db.DefaultContext, &auth_model.WebAuthnCredential{UserID: 2}))
})
unittest.AssertSuccessfulInsert(t, &auth_model.WebAuthnCredential{UserID: 2})
gitlabName := "gitlab"
addAuthSource(t, authSourcePayloadGitLabCustom(gitlabName))
userGitLabUserID := "107"
defer mockCompleteUserAuth(func(res http.ResponseWriter, req *http.Request) (goth.User, error) {
return goth.User{
Provider: gitlabName,
UserID: userGitLabUserID,
NickName: "user2",
Email: "user2@example.com",
}, nil
})()
req := NewRequest(t, "GET", fmt.Sprintf("/user/oauth2/%s/callback?code=XYZ&state=XYZ", gitlabName))
resp := MakeRequest(t, req, http.StatusSeeOther)
// Make sure the user has to go through 2FA after linking.
assert.Equal(t, "/user/webauthn", test.RedirectURL(resp))
}
func TestSignUpViaOAuth2FA(t *testing.T) {
defer tests.PrepareTestEnv(t)()
defer test.MockVariableValue(&setting.OAuth2Client.EnableAutoRegistration, true)()
defer test.MockVariableValue(&setting.OAuth2Client.AccountLinking, setting.OAuth2AccountLinkingAuto)()
gitlabName := "gitlab"
addAuthSource(t, authSourcePayloadGitLabCustom(gitlabName))
userGitLabUserID := "21"
defer mockCompleteUserAuth(func(res http.ResponseWriter, req *http.Request) (goth.User, error) {
return goth.User{
Provider: gitlabName,
UserID: userGitLabUserID,
NickName: "user2",
Email: "user2@example.com",
}, nil
})()
req := NewRequest(t, "GET", fmt.Sprintf("/user/oauth2/%s/callback?code=XYZ&state=XYZ", gitlabName))
resp := MakeRequest(t, req, http.StatusSeeOther)
// Make sure the user can login normally and is linked.
assert.Equal(t, "/", test.RedirectURL(resp))
// Fake that user 2 is enrolled into WebAuthn.
t.Cleanup(func() {
require.NoError(t, db.DeleteBeans(db.DefaultContext, &auth_model.WebAuthnCredential{UserID: 2}))
})
unittest.AssertSuccessfulInsert(t, &auth_model.WebAuthnCredential{UserID: 2})
req = NewRequest(t, "GET", fmt.Sprintf("/user/oauth2/%s/callback?code=XYZ&state=XYZ", gitlabName))
resp = MakeRequest(t, req, http.StatusSeeOther)
// Make sure user has to go through 2FA.
assert.Equal(t, "/user/webauthn", test.RedirectURL(resp))
}