52ae0c5802
Some checks failed
cache-seeder / prune (push) Has been skipped
cache-seeder / frontend (push) Failing after 3s
cache-seeder / python (push) Failing after 3s
cache-seeder / gobuild (push) Failing after 4s
cache-seeder / lint (bindata, lint-backend) (push) Failing after 3s
giteabot backport / giteabot (push) Has been skipped
giteabot / giteabot (push) Has been skipped
cache-prune / prune (push) Has been skipped
release-nightly-snapcraft / build-and-publish (ubuntu-24.04) (push) Has been cancelled
release-nightly-snapcraft / build-and-publish (ubuntu-24.04-arm) (push) Has been cancelled
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
cron-renovate / cron-renovate (push) Has been skipped
97 lines
3.5 KiB
Go
97 lines
3.5 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
|
|
auth_model "gitea.dev/models/auth"
|
|
"gitea.dev/models/unittest"
|
|
user_model "gitea.dev/models/user"
|
|
"gitea.dev/modules/setting"
|
|
"gitea.dev/modules/test"
|
|
"gitea.dev/modules/web"
|
|
"gitea.dev/routers/web/auth"
|
|
"gitea.dev/services/auth/source/oauth2"
|
|
"gitea.dev/services/context"
|
|
"gitea.dev/tests"
|
|
|
|
"github.com/markbates/goth"
|
|
"github.com/markbates/goth/gothic"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestOAuth2AvatarFromPicture(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
defer test.MockVariableValue(&setting.OAuth2Client.UpdateAvatar, true)()
|
|
// the SSRF-protected avatar client blocks loopback by default; allow the loopback mock server here
|
|
defer test.MockVariableValue(&setting.Security.AllowedHostList, "loopback,external")()
|
|
|
|
mockServer := createOAuth2MockProvider()
|
|
defer mockServer.Close()
|
|
addOAuth2Source(t, "test-oidc-avatar", oauth2.Source{
|
|
Provider: "openidConnect",
|
|
ClientID: "test-client-id",
|
|
OpenIDConnectAutoDiscoveryURL: mockServer.URL + "/.well-known/openid-configuration",
|
|
})
|
|
authSource, err := auth_model.GetActiveOAuth2SourceByAuthName(t.Context(), "test-oidc-avatar")
|
|
require.NoError(t, err)
|
|
oauth2Source, ok := authSource.Cfg.(*oauth2.Source)
|
|
require.True(t, ok)
|
|
providerName := oauth2Source.Provider
|
|
|
|
t.Run("AutoRegister", func(t *testing.T) {
|
|
defer test.MockVariableValue(&setting.OAuth2Client.Username, "")()
|
|
defer test.MockVariableValue(&setting.OAuth2Client.EnableAutoRegistration, true)()
|
|
defer test.MockVariableValue(&gothic.CompleteUserAuth, func(res http.ResponseWriter, req *http.Request) (goth.User, error) {
|
|
return goth.User{
|
|
Provider: providerName,
|
|
UserID: "oidc-user-ua-pic",
|
|
Email: "oidc-user-ua-pic@example.com",
|
|
Name: "OIDC UA Pic",
|
|
AvatarURL: mockServer.URL + "/avatar.png",
|
|
}, nil
|
|
})()
|
|
|
|
req := NewRequest(t, "GET", "/user/oauth2/test-oidc-avatar/callback?code=XYZ&state=XYZ")
|
|
emptyTestSession(t).MakeRequest(t, req, http.StatusSeeOther)
|
|
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LoginName: "oidc-user-ua-pic"})
|
|
assert.True(t, user.UseCustomAvatar, "avatar must sync (requires Gitea UA)")
|
|
assert.NotEmpty(t, user.Avatar)
|
|
})
|
|
|
|
t.Run("LinkAccountRegister", func(t *testing.T) {
|
|
const newUserName = "oidc-link-register"
|
|
defer web.RouteMockReset()
|
|
web.RouteMock(web.MockAfterMiddlewares, func(ctx *context.Context) {
|
|
require.NoError(t, auth.Oauth2SetLinkAccountData(ctx, auth.LinkAccountData{
|
|
AuthSourceID: authSource.ID,
|
|
GothUser: goth.User{
|
|
Provider: providerName,
|
|
UserID: "oidc-link-register-sub",
|
|
Email: "oidc-link-register-a@example.com",
|
|
Name: "OIDC Link Register",
|
|
AvatarURL: mockServer.URL + "/avatar.png",
|
|
},
|
|
}))
|
|
})
|
|
|
|
req := NewRequestWithValues(t, "POST", "/user/link_account_signup", map[string]string{
|
|
"user_name": newUserName,
|
|
"email": "oidc-link-register-b@example.com",
|
|
"password": "AVeryStrongPassword!1",
|
|
"retype": "AVeryStrongPassword!1",
|
|
})
|
|
emptyTestSession(t).MakeRequest(t, req, http.StatusSeeOther)
|
|
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: newUserName})
|
|
require.Equal(t, auth_model.OAuth2, user.LoginType)
|
|
assert.True(t, user.UseCustomAvatar, "register-link flow must sync avatar from `picture` claim")
|
|
assert.NotEmpty(t, user.Avatar)
|
|
})
|
|
}
|