Publish curated Unraid-AppOps-Gateway source from 68878c3167dacf2b424c16780e60e0d60815e477

backend/tests/test_enrollment_plane.py

@@ -202,6 +202,9 @@ class _Authentik:
         assert role_claim == "roles"
         return {"status": "ready", "missing": []}
 
+    def validate_deployment_oidc_template(self, *, role_claim, role_groups):
+        return self.deployment_oidc_template_status(role_claim=role_claim)
+
     def ensure_deployment_oidc_application(self, **kwargs):
         assert kwargs["application_slug"] == "wsbc-portal"
         assert kwargs["client_secret"]
@@ -434,6 +437,79 @@ def test_capabilities_require_a_live_bootstrap_controller_contract(tmp_path):
         assert result["controller"]["status"] == "ready"
 
 
+@pytest.mark.parametrize("failure", ["template", "groups", "unreachable"])
+def test_capabilities_do_not_advertise_unusable_oidc_profile(tmp_path, failure):
+    class UnavailableAuthentik(_Authentik):
+        def deployment_oidc_template_status(self, *, role_claim):
+            return {"status": "missing_config" if failure == "template" else "ready"}
+
+        def groups(self):
+            if failure == "groups":
+                return {"success": True, "items": [{"name": "Administrator"}]}
+            if failure == "unreachable":
+                return {"success": False, "message": "SECRET_SENTINEL"}
+            return super().groups()
+
+    with _session(tmp_path) as session:
+        _configure(session)
+        result = _plane(authentik=UnavailableAuthentik()).capabilities(session)
+        assert result["oidcProvisioning"] == {
+            "status": "unavailable", "blockerCode": "oidc_profile_unavailable",
+        }
+        assert "SECRET_SENTINEL" not in str(result)
+        assert result["targetEnrollment"]["status"] == "ready"
+        assert session.exec(select(Enrollment)).all() == []
+        assert session.exec(select(Policy)).all() == []
+
+
+def test_capabilities_advertise_oidc_only_with_template_and_all_role_groups(tmp_path):
+    with _session(tmp_path) as session:
+        _configure(session)
+        assert _plane().capabilities(session)["oidcProvisioning"]["status"] == "ready"
+
+
+@pytest.mark.parametrize('issuer', ['https://auth.example.com/unsupported-path/', 'https://auth.example.com/application/o/bad/path/'])
+def test_capabilities_refuse_unusable_issuer_paths(tmp_path, issuer):
+    with _session(tmp_path) as session:
+        _configure(session)
+        EnrollmentPlane.set_trust_config(session, _trust().model_copy(update={'oidc_issuer': issuer}))
+        assert _plane().capabilities(session)['oidcProvisioning']['status'] == 'unavailable'
+
+
+def test_enrollment_refuses_another_applications_oidc_issuer(tmp_path):
+    with _session(tmp_path) as session:
+        _configure(session)
+        EnrollmentPlane.set_trust_config(
+            session, _trust().model_copy(update={
+                "oidc_issuer": "https://auth.example.com/application/o/another-project/",
+            }),
+        )
+        result = _plane().preflight(session, _plan())
+        assert result["status"] == "blocked"
+        assert "oidc_issuer_mismatch" in result["blockers"]
+        assert session.exec(select(Enrollment)).all() == []
+
+
+@pytest.mark.parametrize("configured", [
+    "https://auth.example.com",
+    "https://auth.example.com/application/o/",
+    "https://auth.example.com/application/o/wsbc-portal",
+])
+def test_enrollment_seals_its_own_per_provider_issuer(tmp_path, configured):
+    class RuntimeBroker(_Broker):
+        def configure_enrollment_runtime(self, runtime, *, secret):
+            self.issuer = runtime["values"]["OIDC_ISSUER"]
+            return super().configure_enrollment_runtime(runtime, secret=secret)
+
+    broker = RuntimeBroker()
+    with _session(tmp_path) as session:
+        _configure(session)
+        EnrollmentPlane.set_trust_config(session, _trust().model_copy(update={"oidc_issuer": configured}))
+        result = _plane(broker=broker).enroll(session, _plan(), idempotency_key="own-issuer-test-0001")
+        assert result["enrollment"]["status"] == "ready"
+        assert broker.issuer == "https://auth.example.com/application/o/wsbc-portal/"
+
+
 def test_capabilities_block_when_controller_root_differs_from_operator_trust(tmp_path):
     class AlternateRootBroker(_Broker):
         appdata_root = "/var/lib/docker/volumes/itworx-managed-appdata/_data"