-
Notifications
You must be signed in to change notification settings - Fork 373
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
## What kind of change does this PR introduce?
* Add a `password_hash` field to admin create user, which allows an
admin to create a user with a given password hash (argon2 or bcrypt)
* Add an `id` field to admin create user, which allows an admin to
create a user with a custom id
* To prevent someone from creating a bunch of users with a high bcrypt
hashing cost, we opt to rehash the password with the default cost (10)
on subsequent sign-in.
## What is the current behavior?
* Only plaintext passwords are allowed, which will subsequently be
hashed internally
## What is the new behavior?
Example request using the bcrypt hash of "test":
```bash
$ curl -X POST 'http://localhost:9999/admin/users' \
-H 'Authorization: Bearer <admin_jwt>' \
-H 'Content-Type: application/json' \
-d '{"email": "[email protected]", "password_hash": "$2y$10$SXEz2HeT8PUIGQXo9yeUIem8KzNxgG0d7o/.eGj2rj8KbRgAuRVlq"}'
```
Example request using a custom id:
```bash
$ curl -X POST 'http://localhost:9999/admin/users' \
-H 'Authorization: Bearer <admin_jwt>' \
-H 'Content-Type: application/json' \
-d '{"id": "2a8813c2-bda7-47f0-94a6-49fcfdf61a70", "email": "[email protected]"}'
```
Feel free to include screenshots if it includes visual changes.
## Additional context
Add any other context or screenshots.- Loading branch information
1 parent
3f70d9d
commit 20d59f1
Showing
8 changed files
with
340 additions
and
56 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -10,6 +10,7 @@ import ( | |
| "testing" | ||
| "time" | ||
|
|
||
| "github.com/gofrs/uuid" | ||
| jwt "github.com/golang-jwt/jwt/v5" | ||
| "github.com/stretchr/testify/assert" | ||
| "github.com/stretchr/testify/require" | ||
|
|
@@ -244,6 +245,7 @@ func (ts *AdminTestSuite) TestAdminUserCreate() { | |
| "isAuthenticated": true, | ||
| "provider": "phone", | ||
| "providers": []string{"phone"}, | ||
| "password": "test1", | ||
| }, | ||
| }, | ||
| { | ||
|
|
@@ -259,6 +261,7 @@ func (ts *AdminTestSuite) TestAdminUserCreate() { | |
| "isAuthenticated": true, | ||
| "provider": "email", | ||
| "providers": []string{"email", "phone"}, | ||
| "password": "test1", | ||
| }, | ||
| }, | ||
| { | ||
|
|
@@ -288,6 +291,7 @@ func (ts *AdminTestSuite) TestAdminUserCreate() { | |
| "isAuthenticated": false, | ||
| "provider": "email", | ||
| "providers": []string{"email"}, | ||
| "password": "", | ||
| }, | ||
| }, | ||
| { | ||
|
|
@@ -304,6 +308,39 @@ func (ts *AdminTestSuite) TestAdminUserCreate() { | |
| "isAuthenticated": true, | ||
| "provider": "email", | ||
| "providers": []string{"email"}, | ||
| "password": "test1", | ||
| }, | ||
| }, | ||
| { | ||
| desc: "With password hash", | ||
| params: map[string]interface{}{ | ||
| "email": "[email protected]", | ||
| "password_hash": "$2y$10$SXEz2HeT8PUIGQXo9yeUIem8KzNxgG0d7o/.eGj2rj8KbRgAuRVlq", | ||
| }, | ||
| expected: map[string]interface{}{ | ||
| "email": "[email protected]", | ||
| "phone": "", | ||
| "isAuthenticated": true, | ||
| "provider": "email", | ||
| "providers": []string{"email"}, | ||
| "password": "test", | ||
| }, | ||
| }, | ||
| { | ||
| desc: "With custom id", | ||
| params: map[string]interface{}{ | ||
| "id": "fc56ab41-2010-4870-a9b9-767c1dc573fb", | ||
| "email": "[email protected]", | ||
| "password": "test", | ||
| }, | ||
| expected: map[string]interface{}{ | ||
| "id": "fc56ab41-2010-4870-a9b9-767c1dc573fb", | ||
| "email": "[email protected]", | ||
| "phone": "", | ||
| "isAuthenticated": true, | ||
| "provider": "email", | ||
| "providers": []string{"email"}, | ||
| "password": "test", | ||
| }, | ||
| }, | ||
| } | ||
|
|
@@ -345,15 +382,18 @@ func (ts *AdminTestSuite) TestAdminUserCreate() { | |
| } | ||
| } | ||
|
|
||
| var expectedPassword string | ||
| if _, ok := c.params["password"]; ok { | ||
| expectedPassword = fmt.Sprintf("%v", c.params["password"]) | ||
| if _, ok := c.expected["password"]; ok { | ||
| expectedPassword := fmt.Sprintf("%v", c.expected["password"]) | ||
| isAuthenticated, _, err := u.Authenticate(context.Background(), ts.API.db, expectedPassword, ts.API.config.Security.DBEncryption.DecryptionKeys, ts.API.config.Security.DBEncryption.Encrypt, ts.API.config.Security.DBEncryption.EncryptionKeyID) | ||
| require.NoError(ts.T(), err) | ||
| require.Equal(ts.T(), c.expected["isAuthenticated"], isAuthenticated) | ||
| } | ||
|
|
||
| isAuthenticated, _, err := u.Authenticate(context.Background(), expectedPassword, ts.API.config.Security.DBEncryption.DecryptionKeys, ts.API.config.Security.DBEncryption.Encrypt, ts.API.config.Security.DBEncryption.EncryptionKeyID) | ||
| require.NoError(ts.T(), err) | ||
|
|
||
| assert.Equal(ts.T(), c.expected["isAuthenticated"], isAuthenticated) | ||
| if id, ok := c.expected["id"]; ok { | ||
| uid, err := uuid.FromString(id.(string)) | ||
| require.NoError(ts.T(), err) | ||
| require.Equal(ts.T(), uid, data.ID) | ||
| } | ||
|
|
||
| // remove created user after each case | ||
| require.NoError(ts.T(), ts.API.db.Destroy(u)) | ||
|
|
@@ -820,5 +860,63 @@ func (ts *AdminTestSuite) TestAdminUserUpdateFactor() { | |
| require.Equal(ts.T(), c.ExpectedCode, w.Code) | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| func (ts *AdminTestSuite) TestAdminUserCreateValidationErrors() { | ||
| cases := []struct { | ||
| desc string | ||
| params map[string]interface{} | ||
| }{ | ||
| { | ||
| desc: "create user without email and phone", | ||
| params: map[string]interface{}{ | ||
| "password": "test_password", | ||
| }, | ||
| }, | ||
| { | ||
| desc: "create user with password and password hash", | ||
| params: map[string]interface{}{ | ||
| "email": "[email protected]", | ||
| "password": "test_password", | ||
| "password_hash": "$2y$10$Tk6yEdmTbb/eQ/haDMaCsuCsmtPVprjHMcij1RqiJdLGPDXnL3L1a", | ||
| }, | ||
| }, | ||
| { | ||
| desc: "invalid ban duration", | ||
| params: map[string]interface{}{ | ||
| "email": "[email protected]", | ||
| "ban_duration": "never", | ||
| }, | ||
| }, | ||
| { | ||
| desc: "custom id is nil", | ||
| params: map[string]interface{}{ | ||
| "id": "00000000-0000-0000-0000-000000000000", | ||
| "email": "[email protected]", | ||
| }, | ||
| }, | ||
| { | ||
| desc: "bad id format", | ||
| params: map[string]interface{}{ | ||
| "id": "bad_uuid_format", | ||
| "email": "[email protected]", | ||
| }, | ||
| }, | ||
| } | ||
| for _, c := range cases { | ||
| ts.Run(c.desc, func() { | ||
| var buffer bytes.Buffer | ||
| require.NoError(ts.T(), json.NewEncoder(&buffer).Encode(c.params)) | ||
| req := httptest.NewRequest(http.MethodPost, "/admin/users", &buffer) | ||
| req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", ts.token)) | ||
| w := httptest.NewRecorder() | ||
| ts.API.handler.ServeHTTP(w, req) | ||
| require.Equal(ts.T(), http.StatusBadRequest, w.Code, w) | ||
|
|
||
| data := map[string]interface{}{} | ||
| require.NoError(ts.T(), json.NewDecoder(w.Body).Decode(&data)) | ||
| require.Equal(ts.T(), data["error_code"], ErrorCodeValidationFailed) | ||
| }) | ||
|
|
||
| } | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -310,7 +310,7 @@ func (ts *UserTestSuite) TestUserUpdatePassword() { | |
| u, err = models.FindUserByEmailAndAudience(ts.API.db, "[email protected]", ts.Config.JWT.Aud) | ||
| require.NoError(ts.T(), err) | ||
|
|
||
| isAuthenticated, _, err := u.Authenticate(context.Background(), c.newPassword, ts.API.config.Security.DBEncryption.DecryptionKeys, ts.API.config.Security.DBEncryption.Encrypt, ts.API.config.Security.DBEncryption.EncryptionKeyID) | ||
| isAuthenticated, _, err := u.Authenticate(context.Background(), ts.API.db, c.newPassword, ts.API.config.Security.DBEncryption.DecryptionKeys, ts.API.config.Security.DBEncryption.Encrypt, ts.API.config.Security.DBEncryption.EncryptionKeyID) | ||
| require.NoError(ts.T(), err) | ||
|
|
||
| require.Equal(ts.T(), c.expected.isAuthenticated, isAuthenticated) | ||
|
|
@@ -372,7 +372,7 @@ func (ts *UserTestSuite) TestUserUpdatePasswordNoReauthenticationRequired() { | |
| u, err = models.FindUserByEmailAndAudience(ts.API.db, "[email protected]", ts.Config.JWT.Aud) | ||
| require.NoError(ts.T(), err) | ||
|
|
||
| isAuthenticated, _, err := u.Authenticate(context.Background(), c.newPassword, ts.API.config.Security.DBEncryption.DecryptionKeys, ts.API.config.Security.DBEncryption.Encrypt, ts.API.config.Security.DBEncryption.EncryptionKeyID) | ||
| isAuthenticated, _, err := u.Authenticate(context.Background(), ts.API.db, c.newPassword, ts.API.config.Security.DBEncryption.DecryptionKeys, ts.API.config.Security.DBEncryption.Encrypt, ts.API.config.Security.DBEncryption.EncryptionKeyID) | ||
| require.NoError(ts.T(), err) | ||
|
|
||
| require.Equal(ts.T(), c.expected.isAuthenticated, isAuthenticated) | ||
|
|
@@ -430,7 +430,7 @@ func (ts *UserTestSuite) TestUserUpdatePasswordReauthentication() { | |
| u, err = models.FindUserByEmailAndAudience(ts.API.db, "[email protected]", ts.Config.JWT.Aud) | ||
| require.NoError(ts.T(), err) | ||
|
|
||
| isAuthenticated, _, err := u.Authenticate(context.Background(), "newpass", ts.Config.Security.DBEncryption.DecryptionKeys, ts.Config.Security.DBEncryption.Encrypt, ts.Config.Security.DBEncryption.EncryptionKeyID) | ||
| isAuthenticated, _, err := u.Authenticate(context.Background(), ts.API.db, "newpass", ts.Config.Security.DBEncryption.DecryptionKeys, ts.Config.Security.DBEncryption.Encrypt, ts.Config.Security.DBEncryption.EncryptionKeyID) | ||
| require.NoError(ts.T(), err) | ||
|
|
||
| require.True(ts.T(), isAuthenticated) | ||
|
|
||
Oops, something went wrong.