Edouard Vanbelle
70 lines
3.7 KiB
Plaintext
70 lines
3.7 KiB
Plaintext
# =============================================================
|
|
# OxiCloud — SSO-only WITHOUT auto-redirect policy
|
|
# =============================================================
|
|
# Sibling to tests/oidc/sso-only.hurl. Both run against
|
|
# server-with-oidc-only-no-policy.env (OXICLOUD_AUTH_METHODS=oidc but
|
|
# OXICLOUD_AUTH_POLICIES unset) and prove the SPECIFIC posture difference
|
|
# the auto_redirect_if_standalone_oidc policy makes:
|
|
#
|
|
# * with policy (sso-only.hurl): GET /login → 307 to /api/auth/oidc/authorize
|
|
# * without policy (this file): GET /login → 200 (SPA shell)
|
|
#
|
|
# In this posture the SPA renders the login page with the SSO button;
|
|
# the user clicks it to start the OIDC flow. Everything else about the
|
|
# OIDC surface is identical, so we DON'T re-run the full OIDC dance —
|
|
# that's covered by sso-only.hurl + oidc.hurl. This file only asserts
|
|
# what actually differs.
|
|
# =============================================================
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Step 1 — Providers reports SSO-only but WITHOUT auto-redirect.
|
|
# The `auto_redirect_to_oidc` field on the DTO comes from
|
|
# AuthApplicationService::auto_redirect_to_oidc(), which
|
|
# requires the policy in the vector. Without it → false.
|
|
# ─────────────────────────────────────────────────────────────
|
|
GET {{base_url}}/api/auth/oidc/providers
|
|
|
|
HTTP 200
|
|
[Asserts]
|
|
jsonpath "$.enabled" == true
|
|
jsonpath "$.password_login_enabled" == false
|
|
jsonpath "$.magic_link_login_enabled" == false
|
|
# The load-bearing difference from sso-only.hurl:
|
|
jsonpath "$.auto_redirect_to_oidc" == false
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Step 2 — GET /login must NOT redirect. The middleware's
|
|
# `should_redirect` predicate evaluates false because
|
|
# `auto_redirect_to_oidc()` returns false (policy absent),
|
|
# so the request falls through to the SPA fallback service.
|
|
# Result: 200 with the SPA shell HTML.
|
|
# ─────────────────────────────────────────────────────────────
|
|
GET {{base_url}}/login
|
|
[Options]
|
|
location: false
|
|
|
|
HTTP 200
|
|
# Deliberately no Location-header assertion — we're proving its ABSENCE
|
|
# by way of the 200 status. If the middleware had incorrectly fired the
|
|
# redirect this would be a 307.
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Step 3 — The authorize endpoint still works (user clicks the SSO
|
|
# button → SPA fetches this URL → server redirects to IdP).
|
|
# Same shape as sso-only.hurl Step 4; here we only assert
|
|
# the FIRST hop returns a valid IdP URL, which is enough to
|
|
# prove the OIDC surface is functional under this posture.
|
|
# ─────────────────────────────────────────────────────────────
|
|
GET {{base_url}}/api/auth/oidc/authorize
|
|
[Options]
|
|
location: false
|
|
|
|
HTTP 307
|
|
[Asserts]
|
|
# Location points at the fake IdP's /auth endpoint with the OAuth2
|
|
# response_type / client_id / redirect_uri / PKCE dance.
|
|
header "Location" matches "^{{oidc_issuer}}/auth\\?response_type=code&client_id={{oidc_client_id}}&"
|