danvics/selfhostblocks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

tests: assert user with unknown group cannot login with sso or ldap

Browse source
This commit is contained in:
ibizaman 2025-09-27 22:33:30 +02:00 committed by Pierre Penninckx
parent 01d8f735ae
commit ffa918aec6
6 changed files with 36 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
modules/services/nextcloud-server.nix
View file

@ -1065,10 +1065,6 @@ in
]; ];
in lib.mkIf (cfg.enable && cfg.apps.sso.enable) { in lib.mkIf (cfg.enable && cfg.apps.sso.enable) {
assertions = [ assertions = [
{
assertion = cfg.apps.ldap.enable;
message = "SSO app requires LDAP app to work correctly.";
}
{ {
assertion = cfg.ssl != null; assertion = cfg.ssl != null;
message = "To integrate SSO, SSL must be enabled, set the shb.nextcloud.ssl option."; message = "To integrate SSO, SSL must be enabled, set the shb.nextcloud.ssl option.";
@ -1128,6 +1124,7 @@ in
groups = "groups"; groups = "groups";
is_admin = "is_nextcloud_admin"; is_admin = "is_nextcloud_admin";
}; };
oidc_login_allowed_groups = [ cfg.apps.ldap.userGroup ];
oidc_login_default_group = "oidc"; oidc_login_default_group = "oidc";
oidc_login_use_external_storage = false; oidc_login_use_external_storage = false;
oidc_login_scope = lib.concatStringsSep " " scopes; oidc_login_scope = lib.concatStringsSep " " scopes;

11
test/common.nix
View file

@ -427,16 +427,17 @@ in
groups = [ "user_group" "admin_group" ]; groups = [ "user_group" "admin_group" ];
password.result.path = pkgs.writeText "bobPassword" "BobPassword"; password.result.path = pkgs.writeText "bobPassword" "BobPassword";
}; };
# charlie = { charlie = {
# email = "charlie@example.com"; email = "charlie@example.com";
# groups = [ ]; groups = [ "other_group" ];
# password.result.path = pkgs.writeText "charliePassword" "CharliePassword"; password.result.path = pkgs.writeText "charliePassword" "CharliePassword";
# }; };
}; };
ensureGroups = { ensureGroups = {
user_group = {}; user_group = {};
admin_group = {}; admin_group = {};
other_group = {};
}; };
}; };
}; };

6
test/services/forgejo.nix
View file

@ -247,6 +247,12 @@ in
"expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()" "expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()"
"expect(page).to_have_title(re.compile('Dashboard'))" "expect(page).to_have_title(re.compile('Dashboard'))"
]; } ]; }
{ username = "charlie"; password = "NotCharliePassword"; nextPageExpect = [
"expect(page.get_by_text('Username or password is incorrect.')).to_be_visible()"
]; }
{ username = "charlie"; password = "CharliePassword"; nextPageExpect = [
"expect(page.get_by_text('Username or password is incorrect.')).to_be_visible()"
]; }
]; ];
}; };
}) })

16
test/services/nextcloud.nix
View file

@ -231,11 +231,13 @@ let
{ username = "bob"; password = "NotBobPassword"; nextPageExpect = [ { username = "bob"; password = "NotBobPassword"; nextPageExpect = [
"expect(page.get_by_text('Incorrect username or password')).to_be_visible()" "expect(page.get_by_text('Incorrect username or password')).to_be_visible()"
]; } ]; }
# TODO: charlie has no groups, which makes lldap return a 'null' value instead of an empty array and Authelia does not like that. { username = "charlie"; password = "NotCharliePassword"; nextPageExpect = [
# { username = "charlie"; password = "CharliePassword"; nextPageExpect = [ "expect(page.get_by_text('Incorrect username or password')).to_be_visible()"
# "page.get_by_role('button', name=re.compile('Accept')).click()" ]; }
# "expect(page).to_have_title(re.compile('Dashboard'))" { username = "charlie"; password = "CharliePassword"; nextPageExpect = [
# ]; } "page.get_by_role('button', name=re.compile('Accept')).click()"
"expect(page.get_by_text('not member of the allowed groups')).to_be_visible()"
]; }
]; ];
}; };
}; };
@ -269,6 +271,9 @@ let
sso = { config, ... }: sso = { config, ... }:
{ {
shb.nextcloud = { shb.nextcloud = {
apps.ldap = {
userGroup = "user_group";
};
apps.sso = { apps.sso = {
enable = true; enable = true;
endpoint = "https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}"; endpoint = "https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}";
@ -549,7 +554,6 @@ in
testLib.certs testLib.certs
https https
testLib.ldap testLib.ldap
ldap
(testLib.sso config.shb.certs.certs.selfsigned.n) (testLib.sso config.shb.certs.certs.selfsigned.n)
sso sso
({ config, ... }: { ({ config, ... }: {

7
test/services/open-webui.nix
View file

@ -94,6 +94,13 @@ let
"expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()" "expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()"
"expect(page.get_by_text('logged in')).to_be_visible()" "expect(page.get_by_text('logged in')).to_be_visible()"
]; } ]; }
{ username = "charlie"; password = "NotCharliePassword"; nextPageExpect = [
"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible()"
]; }
{ username = "charlie"; password = "CharliePassword"; nextPageExpect = [
"page.get_by_role('button', name=re.compile('Accept')).click()"
"expect(page.get_by_text('pending activation')).to_be_visible()"
]; }
]; ];
}; };
}; };

6
test/services/pinchflat.nix
View file

@ -115,6 +115,12 @@ let
"expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()" "expect(page.get_by_role('button', name=re.compile('Sign In'))).not_to_be_visible()"
"expect(page.get_by_text('Create a media profile')).to_be_visible()" "expect(page.get_by_text('Create a media profile')).to_be_visible()"
]; } ]; }
{ username = "charlie"; password = "NotCharliePassword"; nextPageExpect = [
"expect(page.get_by_text(re.compile('[Ii]ncorrect'))).to_be_visible()"
]; }
{ username = "charlie"; password = "CharliePassword"; nextPageExpect = [
"expect(page).to_have_url(re.compile('.*/authenticated'))"
]; }
]; ];
}; };
}; };