790 lines
26 KiB
Ruby
790 lines
26 KiB
Ruby
require 'spec_helper'
|
|
|
|
describe Gitlab::Auth::OAuth::User do
|
|
include LdapHelpers
|
|
|
|
let(:oauth_user) { described_class.new(auth_hash) }
|
|
let(:gl_user) { oauth_user.gl_user }
|
|
let(:uid) { 'my-uid' }
|
|
let(:dn) { 'uid=user1,ou=people,dc=example' }
|
|
let(:provider) { 'my-provider' }
|
|
let(:auth_hash) { OmniAuth::AuthHash.new(uid: uid, provider: provider, info: info_hash) }
|
|
let(:info_hash) do
|
|
{
|
|
nickname: '-john+gitlab-ETC%.git@gmail.com',
|
|
name: 'John',
|
|
email: 'john@mail.com',
|
|
address: {
|
|
locality: 'locality',
|
|
country: 'country'
|
|
}
|
|
}
|
|
end
|
|
let(:ldap_user) { Gitlab::Auth::LDAP::Person.new(Net::LDAP::Entry.new, 'ldapmain') }
|
|
|
|
describe '#persisted?' do
|
|
let!(:existing_user) { create(:omniauth_user, extern_uid: 'my-uid', provider: 'my-provider') }
|
|
|
|
it "finds an existing user based on uid and provider (facebook)" do
|
|
expect( oauth_user.persisted? ).to be_truthy
|
|
end
|
|
|
|
it 'returns false if user is not found in database' do
|
|
allow(auth_hash).to receive(:uid).and_return('non-existing')
|
|
expect( oauth_user.persisted? ).to be_falsey
|
|
end
|
|
end
|
|
|
|
def stub_omniauth_config(messages)
|
|
allow(Gitlab.config.omniauth).to receive_messages(messages)
|
|
end
|
|
|
|
describe '#save' do
|
|
let(:provider) { 'twitter' }
|
|
|
|
describe 'when account exists on server' do
|
|
it 'does not mark the user as external' do
|
|
create(:omniauth_user, extern_uid: 'my-uid', provider: provider)
|
|
stub_omniauth_config(allow_single_sign_on: [provider], external_providers: [provider])
|
|
|
|
oauth_user.save
|
|
|
|
expect(gl_user).to be_valid
|
|
expect(gl_user.external).to be_falsey
|
|
end
|
|
end
|
|
|
|
describe 'signup' do
|
|
context 'when signup is disabled' do
|
|
before do
|
|
stub_application_setting signup_enabled: false
|
|
end
|
|
|
|
it 'creates the user' do
|
|
stub_omniauth_config(allow_single_sign_on: [provider])
|
|
|
|
oauth_user.save
|
|
|
|
expect(gl_user).to be_persisted
|
|
end
|
|
end
|
|
|
|
context 'when user confirmation email is enabled' do
|
|
before do
|
|
stub_application_setting send_user_confirmation_email: true
|
|
end
|
|
|
|
it 'creates and confirms the user anyway' do
|
|
stub_omniauth_config(allow_single_sign_on: [provider])
|
|
|
|
oauth_user.save
|
|
|
|
expect(gl_user).to be_persisted
|
|
expect(gl_user).to be_confirmed
|
|
end
|
|
end
|
|
|
|
it 'marks user as having password_automatically_set' do
|
|
stub_omniauth_config(allow_single_sign_on: [provider], external_providers: [provider])
|
|
|
|
oauth_user.save
|
|
|
|
expect(gl_user).to be_persisted
|
|
expect(gl_user).to be_password_automatically_set
|
|
end
|
|
|
|
shared_examples 'to verify compliance with allow_single_sign_on' do
|
|
context 'provider is marked as external' do
|
|
it 'marks user as external' do
|
|
stub_omniauth_config(allow_single_sign_on: [provider], external_providers: [provider])
|
|
oauth_user.save
|
|
expect(gl_user).to be_valid
|
|
expect(gl_user.external).to be_truthy
|
|
end
|
|
end
|
|
|
|
context 'provider was external, now has been removed' do
|
|
it 'does not mark external user as internal' do
|
|
create(:omniauth_user, extern_uid: 'my-uid', provider: provider, external: true)
|
|
stub_omniauth_config(allow_single_sign_on: [provider], external_providers: ['facebook'])
|
|
oauth_user.save
|
|
expect(gl_user).to be_valid
|
|
expect(gl_user.external).to be_truthy
|
|
end
|
|
end
|
|
|
|
context 'provider is not external' do
|
|
context 'when adding a new OAuth identity' do
|
|
it 'does not promote an external user to internal' do
|
|
user = create(:user, email: 'john@mail.com', external: true)
|
|
user.identities.create(provider: provider, extern_uid: uid)
|
|
|
|
oauth_user.save
|
|
expect(gl_user).to be_valid
|
|
expect(gl_user.external).to be_truthy
|
|
end
|
|
end
|
|
end
|
|
|
|
context 'with new allow_single_sign_on enabled syntax' do
|
|
before do
|
|
stub_omniauth_config(allow_single_sign_on: [provider])
|
|
end
|
|
|
|
it "creates a user from Omniauth" do
|
|
oauth_user.save
|
|
|
|
expect(gl_user).to be_valid
|
|
identity = gl_user.identities.first
|
|
expect(identity.extern_uid).to eql uid
|
|
expect(identity.provider).to eql provider
|
|
end
|
|
end
|
|
|
|
context "with old allow_single_sign_on enabled syntax" do
|
|
before do
|
|
stub_omniauth_config(allow_single_sign_on: true)
|
|
end
|
|
|
|
it "creates a user from Omniauth" do
|
|
oauth_user.save
|
|
|
|
expect(gl_user).to be_valid
|
|
identity = gl_user.identities.first
|
|
expect(identity.extern_uid).to eql uid
|
|
expect(identity.provider).to eql provider
|
|
end
|
|
end
|
|
|
|
context 'with new allow_single_sign_on disabled syntax' do
|
|
before do
|
|
stub_omniauth_config(allow_single_sign_on: [])
|
|
end
|
|
|
|
it 'throws an error' do
|
|
expect { oauth_user.save }.to raise_error StandardError
|
|
end
|
|
end
|
|
|
|
context 'with old allow_single_sign_on disabled (Default)' do
|
|
before do
|
|
stub_omniauth_config(allow_single_sign_on: false)
|
|
end
|
|
|
|
it 'throws an error' do
|
|
expect { oauth_user.save }.to raise_error StandardError
|
|
end
|
|
end
|
|
end
|
|
|
|
context "with auto_link_ldap_user disabled (default)" do
|
|
before do
|
|
stub_omniauth_config(auto_link_ldap_user: false)
|
|
end
|
|
|
|
include_examples "to verify compliance with allow_single_sign_on"
|
|
end
|
|
|
|
context "with auto_link_ldap_user enabled" do
|
|
before do
|
|
stub_omniauth_config(auto_link_ldap_user: true)
|
|
end
|
|
|
|
context "and no LDAP provider defined" do
|
|
before do
|
|
stub_ldap_config(providers: [])
|
|
end
|
|
|
|
include_examples "to verify compliance with allow_single_sign_on"
|
|
end
|
|
|
|
context "and at least one LDAP provider is defined" do
|
|
before do
|
|
stub_ldap_config(providers: %w(ldapmain))
|
|
end
|
|
|
|
context "and a corresponding LDAP person" do
|
|
before do
|
|
allow(ldap_user).to receive(:uid) { uid }
|
|
allow(ldap_user).to receive(:username) { uid }
|
|
allow(ldap_user).to receive(:email) { ['johndoe@example.com', 'john2@example.com'] }
|
|
allow(ldap_user).to receive(:dn) { dn }
|
|
end
|
|
|
|
context "and no account for the LDAP user" do
|
|
before do
|
|
allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_uid).and_return(ldap_user)
|
|
|
|
oauth_user.save
|
|
end
|
|
|
|
it "creates a user with dual LDAP and omniauth identities" do
|
|
expect(gl_user).to be_valid
|
|
expect(gl_user.username).to eql uid
|
|
expect(gl_user.email).to eql 'johndoe@example.com'
|
|
expect(gl_user.identities.length).to be 2
|
|
identities_as_hash = gl_user.identities.map { |id| { provider: id.provider, extern_uid: id.extern_uid } }
|
|
expect(identities_as_hash).to match_array(
|
|
[
|
|
{ provider: 'ldapmain', extern_uid: dn },
|
|
{ provider: 'twitter', extern_uid: uid }
|
|
]
|
|
)
|
|
end
|
|
|
|
it "has email set as synced" do
|
|
expect(gl_user.user_synced_attributes_metadata.email_synced).to be_truthy
|
|
end
|
|
|
|
it "has email set as read-only" do
|
|
expect(gl_user.read_only_attribute?(:email)).to be_truthy
|
|
end
|
|
|
|
it "has synced attributes provider set to ldapmain" do
|
|
expect(gl_user.user_synced_attributes_metadata.provider).to eql 'ldapmain'
|
|
end
|
|
end
|
|
|
|
context "and LDAP user has an account already" do
|
|
let!(:existing_user) { create(:omniauth_user, email: 'john@example.com', extern_uid: dn, provider: 'ldapmain', username: 'john') }
|
|
it "adds the omniauth identity to the LDAP account" do
|
|
allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_uid).and_return(ldap_user)
|
|
|
|
oauth_user.save
|
|
|
|
expect(gl_user).to be_valid
|
|
expect(gl_user.username).to eql 'john'
|
|
expect(gl_user.email).to eql 'john@example.com'
|
|
expect(gl_user.identities.length).to be 2
|
|
identities_as_hash = gl_user.identities.map { |id| { provider: id.provider, extern_uid: id.extern_uid } }
|
|
expect(identities_as_hash).to match_array(
|
|
[
|
|
{ provider: 'ldapmain', extern_uid: dn },
|
|
{ provider: 'twitter', extern_uid: uid }
|
|
]
|
|
)
|
|
end
|
|
end
|
|
|
|
context 'when an LDAP person is not found by uid' do
|
|
it 'tries to find an LDAP person by email and adds the omniauth identity to the user' do
|
|
allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_uid).and_return(nil)
|
|
allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_email).and_return(ldap_user)
|
|
|
|
oauth_user.save
|
|
|
|
identities_as_hash = gl_user.identities.map { |id| { provider: id.provider, extern_uid: id.extern_uid } }
|
|
expect(identities_as_hash).to match_array(result_identities(dn, uid))
|
|
end
|
|
|
|
context 'when also not found by email' do
|
|
it 'tries to find an LDAP person by DN and adds the omniauth identity to the user' do
|
|
allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_uid).and_return(nil)
|
|
allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_email).and_return(nil)
|
|
allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_dn).and_return(ldap_user)
|
|
|
|
oauth_user.save
|
|
|
|
identities_as_hash = gl_user.identities.map { |id| { provider: id.provider, extern_uid: id.extern_uid } }
|
|
expect(identities_as_hash).to match_array(result_identities(dn, uid))
|
|
end
|
|
end
|
|
end
|
|
|
|
def result_identities(dn, uid)
|
|
[
|
|
{ provider: 'ldapmain', extern_uid: dn },
|
|
{ provider: 'twitter', extern_uid: uid }
|
|
]
|
|
end
|
|
|
|
context 'when there is an LDAP connection error' do
|
|
before do
|
|
raise_ldap_connection_error
|
|
end
|
|
|
|
it 'does not save the identity' do
|
|
oauth_user.save
|
|
|
|
identities_as_hash = gl_user.identities.map { |id| { provider: id.provider, extern_uid: id.extern_uid } }
|
|
expect(identities_as_hash).to match_array([{ provider: 'twitter', extern_uid: uid }])
|
|
end
|
|
end
|
|
end
|
|
|
|
context 'and a corresponding LDAP person with a non-default username' do
|
|
before do
|
|
allow(ldap_user).to receive(:uid) { uid }
|
|
allow(ldap_user).to receive(:username) { 'johndoe@example.com' }
|
|
allow(ldap_user).to receive(:email) { %w(johndoe@example.com john2@example.com) }
|
|
allow(ldap_user).to receive(:dn) { dn }
|
|
end
|
|
|
|
context 'and no account for the LDAP user' do
|
|
it 'creates a user favoring the LDAP username and strips email domain' do
|
|
allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_uid).and_return(ldap_user)
|
|
|
|
oauth_user.save
|
|
|
|
expect(gl_user).to be_valid
|
|
expect(gl_user.username).to eql 'johndoe'
|
|
end
|
|
end
|
|
end
|
|
|
|
context "and no corresponding LDAP person" do
|
|
before do
|
|
allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_uid).and_return(nil)
|
|
end
|
|
|
|
include_examples "to verify compliance with allow_single_sign_on"
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
describe 'blocking' do
|
|
let(:provider) { 'twitter' }
|
|
|
|
before do
|
|
stub_omniauth_config(allow_single_sign_on: ['twitter'])
|
|
end
|
|
|
|
context 'signup with omniauth only' do
|
|
context 'dont block on create' do
|
|
before do
|
|
stub_omniauth_config(block_auto_created_users: false)
|
|
end
|
|
|
|
it do
|
|
oauth_user.save
|
|
expect(gl_user).to be_valid
|
|
expect(gl_user).not_to be_blocked
|
|
end
|
|
end
|
|
|
|
context 'block on create' do
|
|
before do
|
|
stub_omniauth_config(block_auto_created_users: true)
|
|
end
|
|
|
|
it do
|
|
oauth_user.save
|
|
expect(gl_user).to be_valid
|
|
expect(gl_user).to be_blocked
|
|
end
|
|
end
|
|
end
|
|
|
|
context 'signup with linked omniauth and LDAP account' do
|
|
before do
|
|
stub_omniauth_config(auto_link_ldap_user: true)
|
|
allow(ldap_user).to receive(:uid) { uid }
|
|
allow(ldap_user).to receive(:username) { uid }
|
|
allow(ldap_user).to receive(:email) { ['johndoe@example.com', 'john2@example.com'] }
|
|
allow(ldap_user).to receive(:dn) { dn }
|
|
allow(Gitlab::Auth::LDAP::Person).to receive(:find_by_uid).and_return(ldap_user)
|
|
end
|
|
|
|
context "and no account for the LDAP user" do
|
|
context 'dont block on create (LDAP)' do
|
|
before do
|
|
allow_any_instance_of(Gitlab::Auth::LDAP::Config).to receive_messages(block_auto_created_users: false)
|
|
end
|
|
|
|
it do
|
|
oauth_user.save
|
|
expect(gl_user).to be_valid
|
|
expect(gl_user).not_to be_blocked
|
|
end
|
|
end
|
|
|
|
context 'block on create (LDAP)' do
|
|
before do
|
|
allow_any_instance_of(Gitlab::Auth::LDAP::Config).to receive_messages(block_auto_created_users: true)
|
|
end
|
|
|
|
it do
|
|
oauth_user.save
|
|
expect(gl_user).to be_valid
|
|
expect(gl_user).to be_blocked
|
|
end
|
|
end
|
|
end
|
|
|
|
context 'and LDAP user has an account already' do
|
|
let!(:existing_user) { create(:omniauth_user, email: 'john@example.com', extern_uid: dn, provider: 'ldapmain', username: 'john') }
|
|
|
|
context 'dont block on create (LDAP)' do
|
|
before do
|
|
allow_any_instance_of(Gitlab::Auth::LDAP::Config).to receive_messages(block_auto_created_users: false)
|
|
end
|
|
|
|
it do
|
|
oauth_user.save
|
|
expect(gl_user).to be_valid
|
|
expect(gl_user).not_to be_blocked
|
|
end
|
|
end
|
|
|
|
context 'block on create (LDAP)' do
|
|
before do
|
|
allow_any_instance_of(Gitlab::Auth::LDAP::Config).to receive_messages(block_auto_created_users: true)
|
|
end
|
|
|
|
it do
|
|
oauth_user.save
|
|
expect(gl_user).to be_valid
|
|
expect(gl_user).not_to be_blocked
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
context 'sign-in' do
|
|
before do
|
|
oauth_user.save
|
|
oauth_user.gl_user.activate
|
|
end
|
|
|
|
context 'dont block on create' do
|
|
before do
|
|
stub_omniauth_config(block_auto_created_users: false)
|
|
end
|
|
|
|
it do
|
|
oauth_user.save
|
|
expect(gl_user).to be_valid
|
|
expect(gl_user).not_to be_blocked
|
|
end
|
|
end
|
|
|
|
context 'block on create' do
|
|
before do
|
|
stub_omniauth_config(block_auto_created_users: true)
|
|
end
|
|
|
|
it do
|
|
oauth_user.save
|
|
expect(gl_user).to be_valid
|
|
expect(gl_user).not_to be_blocked
|
|
end
|
|
end
|
|
|
|
context 'dont block on create (LDAP)' do
|
|
before do
|
|
allow_any_instance_of(Gitlab::Auth::LDAP::Config).to receive_messages(block_auto_created_users: false)
|
|
end
|
|
|
|
it do
|
|
oauth_user.save
|
|
expect(gl_user).to be_valid
|
|
expect(gl_user).not_to be_blocked
|
|
end
|
|
end
|
|
|
|
context 'block on create (LDAP)' do
|
|
before do
|
|
allow_any_instance_of(Gitlab::Auth::LDAP::Config).to receive_messages(block_auto_created_users: true)
|
|
end
|
|
|
|
it do
|
|
oauth_user.save
|
|
expect(gl_user).to be_valid
|
|
expect(gl_user).not_to be_blocked
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
describe 'ensure backwards compatibility with with sync email from provider option' do
|
|
let!(:existing_user) { create(:omniauth_user, extern_uid: 'my-uid', provider: 'my-provider') }
|
|
|
|
before do
|
|
stub_omniauth_config(sync_email_from_provider: 'my-provider')
|
|
stub_omniauth_config(sync_profile_from_provider: ['my-provider'])
|
|
end
|
|
|
|
context "when provider sets an email" do
|
|
it "updates the user email" do
|
|
expect(gl_user.email).to eq(info_hash[:email])
|
|
end
|
|
|
|
it "has email set as synced" do
|
|
expect(gl_user.user_synced_attributes_metadata.email_synced).to be_truthy
|
|
end
|
|
|
|
it "has email set as read-only" do
|
|
expect(gl_user.read_only_attribute?(:email)).to be_truthy
|
|
end
|
|
|
|
it "has synced attributes provider set to my-provider" do
|
|
expect(gl_user.user_synced_attributes_metadata.provider).to eql 'my-provider'
|
|
end
|
|
end
|
|
|
|
context "when provider doesn't set an email" do
|
|
before do
|
|
info_hash.delete(:email)
|
|
end
|
|
|
|
it "does not update the user email" do
|
|
expect(gl_user.email).not_to eq(info_hash[:email])
|
|
end
|
|
|
|
it "has email set as not synced" do
|
|
expect(gl_user.user_synced_attributes_metadata.email_synced).to be_falsey
|
|
end
|
|
|
|
it "does not have email set as read-only" do
|
|
expect(gl_user.read_only_attribute?(:email)).to be_falsey
|
|
end
|
|
end
|
|
end
|
|
|
|
describe 'generating username' do
|
|
context 'when no collision with existing user' do
|
|
it 'generates the username with no counter' do
|
|
expect(gl_user.username).to eq('johngitlab-ETC')
|
|
end
|
|
end
|
|
|
|
context 'when collision with existing user' do
|
|
it 'generates the username with a counter' do
|
|
oauth_user.save
|
|
oauth_user2 = described_class.new(OmniAuth::AuthHash.new(uid: 'my-uid2', provider: provider, info: { nickname: 'johngitlab-ETC@othermail.com', email: 'john@othermail.com' }))
|
|
|
|
expect(oauth_user2.gl_user.username).to eq('johngitlab-ETC1')
|
|
end
|
|
end
|
|
|
|
context 'when username is a reserved word' do
|
|
let(:info_hash) do
|
|
{
|
|
nickname: 'admin@othermail.com',
|
|
email: 'admin@othermail.com'
|
|
}
|
|
end
|
|
|
|
it 'generates the username with a counter' do
|
|
expect(gl_user.username).to eq('admin1')
|
|
end
|
|
end
|
|
end
|
|
|
|
describe 'updating email with sync profile' do
|
|
let!(:existing_user) { create(:omniauth_user, extern_uid: 'my-uid', provider: 'my-provider') }
|
|
|
|
before do
|
|
stub_omniauth_config(sync_profile_from_provider: ['my-provider'])
|
|
stub_omniauth_config(sync_profile_attributes: true)
|
|
end
|
|
|
|
context "when provider sets an email" do
|
|
it "updates the user email" do
|
|
expect(gl_user.email).to eq(info_hash[:email])
|
|
end
|
|
|
|
it "has email set as synced" do
|
|
expect(gl_user.user_synced_attributes_metadata.email_synced).to be(true)
|
|
end
|
|
|
|
it "has email set as read-only" do
|
|
expect(gl_user.read_only_attribute?(:email)).to be_truthy
|
|
end
|
|
|
|
it "has synced attributes provider set to my-provider" do
|
|
expect(gl_user.user_synced_attributes_metadata.provider).to eql 'my-provider'
|
|
end
|
|
end
|
|
|
|
context "when provider doesn't set an email" do
|
|
before do
|
|
info_hash.delete(:email)
|
|
end
|
|
|
|
it "does not update the user email" do
|
|
expect(gl_user.email).not_to eq(info_hash[:email])
|
|
end
|
|
|
|
it "has email set as not synced" do
|
|
expect(gl_user.user_synced_attributes_metadata.email_synced).to be_falsey
|
|
end
|
|
|
|
it "does not have email set as read-only" do
|
|
expect(gl_user.read_only_attribute?(:email)).to be_falsey
|
|
end
|
|
end
|
|
end
|
|
|
|
describe 'updating name' do
|
|
let!(:existing_user) { create(:omniauth_user, extern_uid: 'my-uid', provider: 'my-provider') }
|
|
|
|
before do
|
|
stub_omniauth_setting(sync_profile_from_provider: ['my-provider'])
|
|
stub_omniauth_setting(sync_profile_attributes: true)
|
|
end
|
|
|
|
context "when provider sets a name" do
|
|
it "updates the user name" do
|
|
expect(gl_user.name).to eq(info_hash[:name])
|
|
end
|
|
end
|
|
|
|
context "when provider doesn't set a name" do
|
|
before do
|
|
info_hash.delete(:name)
|
|
end
|
|
|
|
it "does not update the user name" do
|
|
expect(gl_user.name).not_to eq(info_hash[:name])
|
|
expect(gl_user.user_synced_attributes_metadata.name_synced).to be(false)
|
|
end
|
|
end
|
|
end
|
|
|
|
describe 'updating location' do
|
|
let!(:existing_user) { create(:omniauth_user, extern_uid: 'my-uid', provider: 'my-provider') }
|
|
|
|
before do
|
|
stub_omniauth_setting(sync_profile_from_provider: ['my-provider'])
|
|
stub_omniauth_setting(sync_profile_attributes: true)
|
|
end
|
|
|
|
context "when provider sets a location" do
|
|
it "updates the user location" do
|
|
expect(gl_user.location).to eq(info_hash[:address][:locality] + ', ' + info_hash[:address][:country])
|
|
expect(gl_user.user_synced_attributes_metadata.location_synced).to be(true)
|
|
end
|
|
end
|
|
|
|
context "when provider doesn't set a location" do
|
|
before do
|
|
info_hash[:address].delete(:country)
|
|
info_hash[:address].delete(:locality)
|
|
end
|
|
|
|
it "does not update the user location" do
|
|
expect(gl_user.location).to be_nil
|
|
expect(gl_user.user_synced_attributes_metadata.location_synced).to be(false)
|
|
end
|
|
end
|
|
end
|
|
|
|
describe 'updating user info' do
|
|
let!(:existing_user) { create(:omniauth_user, extern_uid: 'my-uid', provider: 'my-provider') }
|
|
|
|
context "update all info" do
|
|
before do
|
|
stub_omniauth_setting(sync_profile_from_provider: ['my-provider'])
|
|
stub_omniauth_setting(sync_profile_attributes: true)
|
|
end
|
|
|
|
it "updates the user email" do
|
|
expect(gl_user.email).to eq(info_hash[:email])
|
|
expect(gl_user.user_synced_attributes_metadata.email_synced).to be(true)
|
|
end
|
|
|
|
it "updates the user name" do
|
|
expect(gl_user.name).to eq(info_hash[:name])
|
|
expect(gl_user.user_synced_attributes_metadata.name_synced).to be(true)
|
|
end
|
|
|
|
it "updates the user location" do
|
|
expect(gl_user.location).to eq(info_hash[:address][:locality] + ', ' + info_hash[:address][:country])
|
|
expect(gl_user.user_synced_attributes_metadata.location_synced).to be(true)
|
|
end
|
|
|
|
it "sets my-provider as the attributes provider" do
|
|
expect(gl_user.user_synced_attributes_metadata.provider).to eql('my-provider')
|
|
end
|
|
end
|
|
|
|
context "update only requested info" do
|
|
before do
|
|
stub_omniauth_setting(sync_profile_from_provider: ['my-provider'])
|
|
stub_omniauth_setting(sync_profile_attributes: %w(name location))
|
|
end
|
|
|
|
it "updates the user name" do
|
|
expect(gl_user.name).to eq(info_hash[:name])
|
|
expect(gl_user.user_synced_attributes_metadata.name_synced).to be(true)
|
|
end
|
|
|
|
it "updates the user location" do
|
|
expect(gl_user.location).to eq(info_hash[:address][:locality] + ', ' + info_hash[:address][:country])
|
|
expect(gl_user.user_synced_attributes_metadata.location_synced).to be(true)
|
|
end
|
|
|
|
it "does not update the user email" do
|
|
expect(gl_user.user_synced_attributes_metadata.email_synced).to be(false)
|
|
end
|
|
end
|
|
|
|
context "update default_scope" do
|
|
before do
|
|
stub_omniauth_setting(sync_profile_from_provider: ['my-provider'])
|
|
end
|
|
|
|
it "updates the user email" do
|
|
expect(gl_user.email).to eq(info_hash[:email])
|
|
expect(gl_user.user_synced_attributes_metadata.email_synced).to be(true)
|
|
end
|
|
end
|
|
|
|
context "update no info when profile sync is nil" do
|
|
it "does not have sync_attribute" do
|
|
expect(gl_user.user_synced_attributes_metadata).to be(nil)
|
|
end
|
|
|
|
it "does not update the user email" do
|
|
expect(gl_user.email).not_to eq(info_hash[:email])
|
|
end
|
|
|
|
it "does not update the user name" do
|
|
expect(gl_user.name).not_to eq(info_hash[:name])
|
|
end
|
|
|
|
it "does not update the user location" do
|
|
expect(gl_user.location).not_to eq(info_hash[:address][:country])
|
|
end
|
|
|
|
it 'does not create associated user synced attributes metadata' do
|
|
expect(gl_user.user_synced_attributes_metadata).to be_nil
|
|
end
|
|
end
|
|
end
|
|
|
|
describe '.find_by_uid_and_provider' do
|
|
let!(:existing_user) { create(:omniauth_user, extern_uid: 'my-uid', provider: 'my-provider') }
|
|
|
|
it 'normalizes extern_uid' do
|
|
allow(oauth_user.auth_hash).to receive(:uid).and_return('MY-UID')
|
|
expect(oauth_user.find_user).to eql gl_user
|
|
end
|
|
end
|
|
|
|
describe '#find_ldap_person' do
|
|
context 'when LDAP connection fails' do
|
|
before do
|
|
raise_ldap_connection_error
|
|
end
|
|
|
|
it 'returns nil' do
|
|
adapter = Gitlab::Auth::LDAP::Adapter.new('ldapmain')
|
|
hash = OmniAuth::AuthHash.new(uid: 'whatever', provider: 'ldapmain')
|
|
|
|
expect(oauth_user.send(:find_ldap_person, hash, adapter)).to be_nil
|
|
end
|
|
end
|
|
end
|
|
|
|
describe '#bypass_two_factor?' do
|
|
subject { oauth_user.bypass_two_factor? }
|
|
|
|
it 'returns always false' do
|
|
is_expected.to be_falsey
|
|
end
|
|
end
|
|
end
|