WorkOS provider: add more comprehensive tests

api/external_workos_test.go

@@ -1,15 +1,23 @@
 package api
 
 import (
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 
 	jwt "github.com/golang-jwt/jwt"
 )
 
-func (ts *ExternalTestSuite) TestSignupExternalWorkOS() {
-	req := httptest.NewRequest(http.MethodGet, "http://localhost/authorize?provider=workos", nil)
+const (
+	workosUser           string = `{"id":"test_prof_workos","first_name":"John","last_name":"Doe","email":"[email protected]","connection_id":"test_conn_1","organization_id":"test_org_1","connection_type":"test","idp_id":"test_idp_1","object": "profile","raw_attributes": {}}`
+	workosUserWrongEmail string = `{"id":"test_prof_workos","first_name":"John","last_name":"Doe","email":"[email protected]","connection_id":"test_conn_1","organization_id":"test_org_1","connection_type":"test","idp_id":"test_idp_1","object": "profile","raw_attributes": {}}`
+	workosUserNoEmail    string = `{"id":"test_prof_workos","first_name":"John","last_name":"Doe","connection_id":"test_conn_1","organization_id":"test_org_1","connection_type":"test","idp_id":"test_idp_1","object": "profile","raw_attributes": {}}`
+)
+
+func (ts *ExternalTestSuite) TestSignupExternalWorkOSWithConnection() {
+	connection := "test_connection_id"
+	req := httptest.NewRequest(http.MethodGet, fmt.Sprintf("http://localhost/authorize?provider=workos&connection=%s", connection), nil)
 	w := httptest.NewRecorder()
 	ts.API.handler.ServeHTTP(w, req)
 	ts.Require().Equal(http.StatusFound, w.Code)
@@ -20,6 +28,7 @@ func (ts *ExternalTestSuite) TestSignupExternalWorkOS() {
 	ts.Equal(ts.Config.External.WorkOS.ClientID, q.Get("client_id"))
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("", q.Get("scope"))
+	ts.Equal(connection, q.Get("connection"))
 
 	claims := ExternalProviderClaims{}
 	p := jwt.Parser{ValidMethods: []string{jwt.SigningMethodHS256.Name}}
@@ -31,3 +40,182 @@ func (ts *ExternalTestSuite) TestSignupExternalWorkOS() {
 	ts.Equal("workos", claims.Provider)
 	ts.Equal(ts.Config.SiteURL, claims.SiteURL)
 }
+
+func (ts *ExternalTestSuite) TestSignupExternalWorkOSWithOrganization() {
+	organization := "test_organization_id"
+	req := httptest.NewRequest(http.MethodGet, fmt.Sprintf("http://localhost/authorize?provider=workos&organization=%s", organization), nil)
+	w := httptest.NewRecorder()
+	ts.API.handler.ServeHTTP(w, req)
+	ts.Require().Equal(http.StatusFound, w.Code)
+	u, err := url.Parse(w.Header().Get("Location"))
+	ts.Require().NoError(err, "redirect url parse failed")
+	q := u.Query()
+	ts.Equal(ts.Config.External.WorkOS.RedirectURI, q.Get("redirect_uri"))
+	ts.Equal(ts.Config.External.WorkOS.ClientID, q.Get("client_id"))
+	ts.Equal("code", q.Get("response_type"))
+	ts.Equal("", q.Get("scope"))
+	ts.Equal(organization, q.Get("organization"))
+
+	claims := ExternalProviderClaims{}
+	p := jwt.Parser{ValidMethods: []string{jwt.SigningMethodHS256.Name}}
+	_, err = p.ParseWithClaims(q.Get("state"), &claims, func(token *jwt.Token) (interface{}, error) {
+		return []byte(ts.Config.JWT.Secret), nil
+	})
+	ts.Require().NoError(err)
+
+	ts.Equal("workos", claims.Provider)
+	ts.Equal(ts.Config.SiteURL, claims.SiteURL)
+}
+
+func (ts *ExternalTestSuite) TestSignupExternalWorkOSWithProvider() {
+	provider := "test_provider"
+	req := httptest.NewRequest(http.MethodGet, fmt.Sprintf("http://localhost/authorize?provider=workos&workos_provider=%s", provider), nil)
+	w := httptest.NewRecorder()
+	ts.API.handler.ServeHTTP(w, req)
+	ts.Require().Equal(http.StatusFound, w.Code)
+	u, err := url.Parse(w.Header().Get("Location"))
+	ts.Require().NoError(err, "redirect url parse failed")
+	q := u.Query()
+	ts.Equal(ts.Config.External.WorkOS.RedirectURI, q.Get("redirect_uri"))
+	ts.Equal(ts.Config.External.WorkOS.ClientID, q.Get("client_id"))
+	ts.Equal("code", q.Get("response_type"))
+	ts.Equal("", q.Get("scope"))
+	ts.Equal(provider, q.Get("provider"))
+
+	claims := ExternalProviderClaims{}
+	p := jwt.Parser{ValidMethods: []string{jwt.SigningMethodHS256.Name}}
+	_, err = p.ParseWithClaims(q.Get("state"), &claims, func(token *jwt.Token) (interface{}, error) {
+		return []byte(ts.Config.JWT.Secret), nil
+	})
+	ts.Require().NoError(err)
+
+	ts.Equal("workos", claims.Provider)
+	ts.Equal(ts.Config.SiteURL, claims.SiteURL)
+}
+
+func WorkosTestSignupSetup(ts *ExternalTestSuite, tokenCount *int, userCount *int, code string, user string) *httptest.Server {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/sso/token":
+			// WorkOS returns the user data along with the token.
+			*tokenCount++
+			*userCount++
+			ts.Equal(code, r.FormValue("code"))
+			ts.Equal("authorization_code", r.FormValue("grant_type"))
+			ts.Equal(ts.Config.External.WorkOS.RedirectURI, r.FormValue("redirect_uri"))
+
+			w.Header().Add("Content-Type", "application/json")
+			fmt.Fprintf(w, `{"access_token":"workos_token","expires_in":100000,"profile":%s}`, user)
+		default:
+			fmt.Printf("%s", r.URL.Path)
+			w.WriteHeader(500)
+			ts.Fail("unknown workos oauth call %s", r.URL.Path)
+		}
+	}))
+
+	ts.Config.External.WorkOS.URL = server.URL
+
+	return server
+}
+
+func (ts *ExternalTestSuite) TestSignupExternalWorkosAuthorizationCode() {
+	ts.Config.DisableSignup = false
+
+	tokenCount, userCount := 0, 0
+	code := "authcode"
+	server := WorkosTestSignupSetup(ts, &tokenCount, &userCount, code, workosUser)
+	defer server.Close()
+
+	u := performAuthorization(ts, "workos", code, "")
+
+	assertAuthorizationSuccess(ts, u, tokenCount, userCount, "[email protected]", "John Doe", "test_prof_workos", "")
+}
+
+func (ts *ExternalTestSuite) TestSignupExternalWorkosDisableSignupErrorWhenNoUser() {
+	ts.Config.DisableSignup = true
+
+	tokenCount, userCount := 0, 0
+	code := "authcode"
+	server := WorkosTestSignupSetup(ts, &tokenCount, &userCount, code, workosUser)
+	defer server.Close()
+
+	u := performAuthorization(ts, "workos", code, "")
+
+	assertAuthorizationFailure(ts, u, "Signups not allowed for this instance", "access_denied", "[email protected]")
+}
+
+func (ts *ExternalTestSuite) TestSignupExternalWorkosDisableSignupErrorWhenEmptyEmail() {
+	ts.Config.DisableSignup = true
+
+	tokenCount, userCount := 0, 0
+	code := "authcode"
+	server := WorkosTestSignupSetup(ts, &tokenCount, &userCount, code, workosUserNoEmail)
+	defer server.Close()
+
+	u := performAuthorization(ts, "workos", code, "")
+
+	assertAuthorizationFailure(ts, u, "Error getting user email from external provider", "server_error", "[email protected]")
+}
+
+func (ts *ExternalTestSuite) TestSignupExternalWorkosDisableSignupSuccessWithPrimaryEmail() {
+	ts.Config.DisableSignup = true
+
+	ts.createUser("test_prof_workos", "[email protected]", "John Doe", "http://example.com/avatar", "")
+
+	tokenCount, userCount := 0, 0
+	code := "authcode"
+	server := WorkosTestSignupSetup(ts, &tokenCount, &userCount, code, workosUser)
+	defer server.Close()
+
+	u := performAuthorization(ts, "workos", code, "")
+
+	assertAuthorizationSuccess(ts, u, tokenCount, userCount, "[email protected]", "John Doe", "test_prof_workos", "http://example.com/avatar")
+}
+
+func (ts *ExternalTestSuite) TestInviteTokenExternalWorkosSuccessWhenMatchingToken() {
+	ts.createUser("test_prof_workos", "[email protected]", "", "http://example.com/avatar", "invite_token")
+
+	tokenCount, userCount := 0, 0
+	code := "authcode"
+	server := WorkosTestSignupSetup(ts, &tokenCount, &userCount, code, workosUser)
+	defer server.Close()
+
+	u := performAuthorization(ts, "workos", code, "invite_token")
+
+	assertAuthorizationSuccess(ts, u, tokenCount, userCount, "[email protected]", "John Doe", "test_prof_workos", "http://example.com/avatar")
+}
+
+func (ts *ExternalTestSuite) TestInviteTokenExternalWorkosErrorWhenNoMatchingToken() {
+	tokenCount, userCount := 0, 0
+	code := "authcode"
+	server := WorkosTestSignupSetup(ts, &tokenCount, &userCount, code, workosUser)
+	defer server.Close()
+
+	w := performAuthorizationRequest(ts, "workos", "invite_token")
+	ts.Require().Equal(http.StatusNotFound, w.Code)
+}
+
+func (ts *ExternalTestSuite) TestInviteTokenExternalWorkosErrorWhenWrongToken() {
+	ts.createUser("test_prof_workos", "[email protected]", "", "", "invite_token")
+
+	tokenCount, userCount := 0, 0
+	code := "authcode"
+	server := WorkosTestSignupSetup(ts, &tokenCount, &userCount, code, workosUser)
+	defer server.Close()
+
+	w := performAuthorizationRequest(ts, "workos", "wrong_token")
+	ts.Require().Equal(http.StatusNotFound, w.Code)
+}
+
+func (ts *ExternalTestSuite) TestInviteTokenExternalWorkosErrorWhenEmailDoesntMatch() {
+	ts.createUser("test_prof_workos", "[email protected]", "", "", "invite_token")
+
+	tokenCount, userCount := 0, 0
+	code := "authcode"
+	server := WorkosTestSignupSetup(ts, &tokenCount, &userCount, code, workosUserWrongEmail)
+	defer server.Close()
+
+	u := performAuthorization(ts, "workos", code, "invite_token")
+
+	assertAuthorizationFailure(ts, u, "Invited email does not match emails from external provider", "invalid_request", "")
+}