snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

selfservice/flow/settings/flow_test.go

@@ -0,0 +1,187 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package settings_test
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"net/http"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/gofrs/uuid"
+
+	"github.com/tidwall/gjson"
+
+	"github.com/ory/x/clock"
+	"github.com/ory/x/jsonx"
+
+	"github.com/ory/kratos/pkg"
+
+	"github.com/go-faker/faker/v4"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/ory/x/urlx"
+
+	"github.com/ory/kratos/identity"
+	"github.com/ory/kratos/selfservice/flow"
+	"github.com/ory/kratos/selfservice/flow/settings"
+	"github.com/ory/kratos/session"
+	"github.com/ory/kratos/x"
+)
+
+func TestFakeFlow(t *testing.T) {
+	var r settings.Flow
+	require.NoError(t, faker.FakeData(&r))
+
+	assert.Equal(t, uuid.Nil, r.ID)
+	assert.NotEmpty(t, r.IssuedAt)
+	assert.NotEmpty(t, r.ExpiresAt)
+	assert.NotEmpty(t, r.RequestURL)
+	assert.NotEmpty(t, r.Active)
+}
+
+func TestNewFlow(t *testing.T) {
+	ctx := context.Background()
+	conf, reg := pkg.NewVeryFastRegistryWithoutDB(t)
+
+	id := &identity.Identity{ID: x.NewUUID()}
+	t.Run("case=0", func(t *testing.T) {
+		r, err := settings.NewFlow(reg, &http.Request{URL: urlx.ParseOrPanic("/"),
+			Host: "ory.sh", TLS: &tls.ConnectionState{}}, id, flow.TypeBrowser)
+
+		require.NoError(t, err)
+		assert.True(t, r.ExpiresAt.After(r.IssuedAt))
+		assert.Equal(t, flow.TypeBrowser, r.Type)
+		assert.Equal(t, "https://ory.sh/", r.RequestURL)
+	})
+
+	t.Run("type=return_to", func(t *testing.T) {
+		_, err := settings.NewFlow(reg, &http.Request{URL: &url.URL{Path: "/", RawQuery: "return_to=https://not-allowed/foobar"}, Host: "ory.sh"}, id, flow.TypeBrowser)
+		require.Error(t, err)
+
+		_, err = settings.NewFlow(reg, &http.Request{URL: &url.URL{Path: "/", RawQuery: "return_to=" + urlx.AppendPaths(conf.SelfPublicURL(ctx), "/self-service/login/browser").String()}, Host: "ory.sh"}, id, flow.TypeBrowser)
+		require.NoError(t, err)
+	})
+
+	t.Run("case=1", func(t *testing.T) {
+		r, err := settings.NewFlow(reg, &http.Request{
+			URL:  urlx.ParseOrPanic("/?refresh=true"),
+			Host: "ory.sh"}, id, flow.TypeAPI)
+
+		require.NoError(t, err)
+		assert.True(t, r.ExpiresAt.After(r.IssuedAt))
+		assert.Equal(t, flow.TypeAPI, r.Type)
+		assert.Equal(t, "http://ory.sh/?refresh=true", r.RequestURL)
+	})
+
+	t.Run("case=2", func(t *testing.T) {
+		r, err := settings.NewFlow(reg, &http.Request{
+			URL:  urlx.ParseOrPanic("https://ory.sh/"),
+			Host: "ory.sh"}, id, flow.TypeBrowser)
+
+		require.NoError(t, err)
+		assert.Equal(t, "https://ory.sh/", r.RequestURL)
+	})
+}
+
+func TestFlow(t *testing.T) {
+	_, reg := pkg.NewVeryFastRegistryWithoutDB(t)
+
+	alice := x.NewUUID()
+	malice := x.NewUUID()
+	for k, tc := range []struct {
+		r         *settings.Flow
+		exp       time.Duration
+		s         *session.Session
+		expectErr bool
+	}{
+		{
+			r: settings.MustNewFlow(
+				reg,
+				&http.Request{URL: urlx.ParseOrPanic("http://foo/bar/baz"), Host: "foo"},
+				&identity.Identity{ID: alice},
+				flow.TypeBrowser),
+			exp: time.Hour,
+
+			s: &session.Session{Identity: &identity.Identity{ID: alice}},
+		},
+		{
+			r: settings.MustNewFlow(
+				reg,
+				&http.Request{URL: urlx.ParseOrPanic("http://foo/bar/baz"), Host: "foo"},
+				&identity.Identity{ID: alice},
+				flow.TypeBrowser),
+			exp: time.Hour,
+
+			s:         &session.Session{Identity: &identity.Identity{ID: malice}},
+			expectErr: true,
+		},
+		{
+			r: settings.MustNewFlow(
+				reg,
+				&http.Request{URL: urlx.ParseOrPanic("http://foo/bar/baz"), Host: "foo"},
+				&identity.Identity{ID: alice},
+				flow.TypeBrowser),
+			exp: -time.Hour,
+
+			s:         &session.Session{Identity: &identity.Identity{ID: alice}},
+			expectErr: true,
+		},
+	} {
+		t.Run(fmt.Sprintf("case=%d", k), func(t *testing.T) {
+			tc.r.ExpiresAt = tc.r.IssuedAt.Add(tc.exp)
+			err := tc.r.Valid(clock.New(), tc.s)
+			if tc.expectErr {
+				require.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+		})
+	}
+}
+
+func TestGetType(t *testing.T) {
+	for _, ft := range []flow.Type{
+		flow.TypeAPI,
+		flow.TypeBrowser,
+	} {
+		t.Run(fmt.Sprintf("case=%s", ft), func(t *testing.T) {
+			r := &settings.Flow{Type: ft}
+			assert.Equal(t, ft, r.GetType())
+		})
+	}
+}
+
+func TestGetRequestURL(t *testing.T) {
+	expectedURL := "http://foo/bar/baz"
+	f := &settings.Flow{RequestURL: expectedURL}
+	assert.Equal(t, expectedURL, f.GetRequestURL())
+}
+
+func TestEnsureInternalContext(t *testing.T) {
+	f := new(settings.Flow)
+	f.EnsureInternalContext()
+	assert.Equal(t, "{}", string(f.InternalContext))
+}
+
+func TestFlowEncodeJSON(t *testing.T) {
+	assert.EqualValues(t, "", gjson.Get(jsonx.TestMarshalJSONString(t, &settings.Flow{RequestURL: "https://foo.bar?foo=bar"}), "return_to").String())
+	assert.EqualValues(t, "/bar", gjson.Get(jsonx.TestMarshalJSONString(t, &settings.Flow{RequestURL: "https://foo.bar?return_to=/bar"}), "return_to").String())
+	assert.EqualValues(t, "/bar", gjson.Get(jsonx.TestMarshalJSONString(t, settings.Flow{RequestURL: "https://foo.bar?return_to=/bar"}), "return_to").String())
+}
+
+func TestFlowDontOverrideReturnTo(t *testing.T) {
+	f := &settings.Flow{ReturnTo: "/foo"}
+	f.SetReturnTo()
+	assert.Equal(t, "/foo", f.ReturnTo)
+
+	f = &settings.Flow{RequestURL: "https://foo.bar?return_to=/bar"}
+	f.SetReturnTo()
+	assert.Equal(t, "/bar", f.ReturnTo)
+}