Skip to content

Commit 1fd5a56

Browse files
xynicolexynicole
committed
NLB-6350: add OIDC unit tests and fix some unit tests' directives
1 parent 241fda3 commit 1fd5a56

File tree

6 files changed

+267
-9
lines changed

6 files changed

+267
-9
lines changed

‎analyze.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ package crossplane
4242
//go:generate sh -c "sh ./scripts/generate/generate.sh --url https://github.com/leev/ngx_http_geoip2_module.git --config-path ./scripts/generate/configs/geoip2_config.json > ./analyze_geoip2_directives.gen.go"
4343

4444
// Update for NPlus.
45-
// NPlus source code is private. Please ensure you have the correct access
45+
// NPlus source code is private. Please ensure you have the correct access
4646
// and set the URL and branch in the environment variables NPLUS_URL and NPLUS_BRANCH.
4747
// Filter in config is the directives not in https://nginx.org/en/docs/dirindex.html but in source code.
4848
// Override for NPlus R33 and the latest version is for mgmt directives and if directive.

‎analyze_map.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,10 @@ var mapBodies = map[string]mapParameterMasks{
4545
"otel_exporter": {
4646
defaultMasks: ngxConfTake1,
4747
},
48+
"oidc_provider": {
49+
specialParameterMasks: map[string]uint{"session_timeout": ngxConf1More, "scope": ngxConf1More},
50+
defaultMasks: ngxConfTake1,
51+
},
4852
}
4953

5054
// analyzeMapBody validates the body of a map-like directive. Map-like directives are block directives

‎analyze_map_test.go

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -239,6 +239,48 @@ func TestAnalyzeMapBody(t *testing.T) {
239239
term: "}",
240240
wantErr: &ParseError{What: `unexpected "}"`, BlockCtx: "map"},
241241
},
242+
"valid oidc_provider": {
243+
mapDirective: "oidc_provider",
244+
parameter: &Directive{
245+
Directive: "client_id",
246+
Args: []string{"unique_id"},
247+
Line: 5,
248+
Block: Directives{},
249+
},
250+
term: ";",
251+
},
252+
"invalid oidc_provider": {
253+
mapDirective: "oidc_provider",
254+
parameter: &Directive{
255+
Directive: "client_id ",
256+
Args: []string{},
257+
Line: 5,
258+
Block: Directives{},
259+
},
260+
term: ";",
261+
wantErr: &ParseError{What: "invalid number of parameters", BlockCtx: "oidc_provider"},
262+
},
263+
"valid oidc_provider scope": {
264+
mapDirective: "oidc_provider",
265+
parameter: &Directive{
266+
Directive: "scope",
267+
Args: []string{"openid"},
268+
Line: 5,
269+
Block: Directives{},
270+
},
271+
term: ";",
272+
},
273+
"invalid oidc_provider scope": {
274+
mapDirective: "oidc_provider",
275+
parameter: &Directive{
276+
Directive: "scope",
277+
Args: []string{},
278+
Line: 5,
279+
Block: Directives{},
280+
},
281+
term: ";",
282+
wantErr: &ParseError{What: "invalid number of parameters", BlockCtx: "oidc_provider"},
283+
},
242284
}
243285

244286
for name, tc := range testcases {

‎analyze_test.go

Lines changed: 123 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ func TestAnalyze(t *testing.T) {
4545
// the state directive should only be in the "good" contexts
4646
if _, ok := goodMap[key]; !ok {
4747
actx := blockCtx(strings.Split(key, ">"))
48-
if err := analyze(fname, stmt, ";", actx, &ParseOptions{}); err == nil {
48+
if err := analyze(fname, stmt, ";", actx, &ParseOptions{DirectiveSources: []MatchFunc{MatchNginxPlusR33}}); err == nil {
4949
t.Fatalf("expected error to not be nil: %v", err)
5050
} else if e, ok := err.(*ParseError); !ok {
5151
t.Fatalf("error was not a ParseError: %v", err)
@@ -106,7 +106,7 @@ func TestAnalyze_auth_jwt(t *testing.T) {
106106
tc := tc
107107
t.Run(name, func(t *testing.T) {
108108
t.Parallel()
109-
err := analyze("nginx.conf", tc.stmt, ";", tc.ctx, &ParseOptions{})
109+
err := analyze("nginx.conf", tc.stmt, ";", tc.ctx, &ParseOptions{DirectiveSources: []MatchFunc{MatchNginxPlusR33}})
110110

111111
if !tc.wantErr && err != nil {
112112
t.Fatal(err)
@@ -159,7 +159,7 @@ func TestAnalyze_auth_jwt_require(t *testing.T) {
159159
tc := tc
160160
t.Run(name, func(t *testing.T) {
161161
t.Parallel()
162-
err := analyze("nginx.conf", tc.stmt, ";", tc.ctx, &ParseOptions{})
162+
err := analyze("nginx.conf", tc.stmt, ";", tc.ctx, &ParseOptions{DirectiveSources: []MatchFunc{MatchNginxPlusR33}})
163163

164164
if !tc.wantErr && err != nil {
165165
t.Fatal(err)
@@ -531,7 +531,7 @@ func TestAnalyze_zone_sync(t *testing.T) {
531531
tc := tc
532532
t.Run(name, func(t *testing.T) {
533533
t.Parallel()
534-
err := analyze("nginx.conf", tc.stmt, ";", tc.ctx, &ParseOptions{})
534+
err := analyze("nginx.conf", tc.stmt, ";", tc.ctx, &ParseOptions{DirectiveSources: []MatchFunc{MatchNginxPlusR33}})
535535
if !tc.wantErr && err != nil {
536536
t.Fatal(err)
537537
}
@@ -2338,7 +2338,7 @@ func TestAnalyze_mgmt(t *testing.T) {
23382338
tc := tc
23392339
t.Run(name, func(t *testing.T) {
23402340
t.Parallel()
2341-
err := analyze("nginx.conf", tc.stmt, ";", tc.ctx, &ParseOptions{})
2341+
err := analyze("nginx.conf", tc.stmt, ";", tc.ctx, &ParseOptions{DirectiveSources: []MatchFunc{MatchNginxPlusR33}})
23422342
if !tc.wantErr && err != nil {
23432343
t.Fatal(err)
23442344
}
@@ -2593,6 +2593,7 @@ func TestAnalyze_directiveSources_defaultBehavior(t *testing.T) {
25932593
t.Run(name, func(t *testing.T) {
25942594
t.Parallel()
25952595
err := analyze("nginx.conf", tc.stmt, ";", tc.ctx, &ParseOptions{
2596+
DirectiveSources: []MatchFunc{MatchNginxPlusR33},
25962597
ErrorOnUnknownDirectives: true,
25972598
})
25982599

@@ -2617,7 +2618,7 @@ func TestAnalyze_limit_req_zone(t *testing.T) {
26172618
"limit_req_zone_4_args_nplus_latest": {
26182619
args: []string{"$binary_remote_addr", "zone=one:10m", "rate=1r/s", "sync"},
26192620
sources: []MatchFunc{MatchNginxPlusLatest},
2620-
wantErr: false,
2621+
wantErr: true,
26212622
},
26222623
"limit_req_zone_3_args_nplus_latest": {
26232624
args: []string{"$binary_remote_addr", "zone=one:10m", "rate=1r/s"},
@@ -2636,7 +2637,7 @@ func TestAnalyze_limit_req_zone(t *testing.T) {
26362637
},
26372638
"limit_req_zone_4_args_default_sources": {
26382639
args: []string{"$binary_remote_addr", "zone=one:10m", "rate=1r/s", "sync"},
2639-
wantErr: false,
2640+
wantErr: true,
26402641
},
26412642
"limit_req_zone_3_args_default_sources": {
26422643
args: []string{"$binary_remote_addr", "zone=one:10m", "rate=1r/s"},
@@ -2795,3 +2796,118 @@ func TestAnalyze_geoip2(t *testing.T) {
27952796
})
27962797
}
27972798
}
2799+
2800+
//nolint:funlen
2801+
func TestAnalyze_oidc(t *testing.T) {
2802+
t.Parallel()
2803+
testcases := map[string]struct {
2804+
stmt *Directive
2805+
ctx blockCtx
2806+
wantErr bool
2807+
}{
2808+
"oidc ok": {
2809+
&Directive{
2810+
Directive: "oidc_provider",
2811+
Args: []string{"my_idp"},
2812+
Line: 5,
2813+
Block: Directives{
2814+
{
2815+
Directive: "issuer",
2816+
Args: []string{"https://provider.domain"},
2817+
Line: 6,
2818+
Block: Directives{},
2819+
},
2820+
{
2821+
Directive: "client_id",
2822+
Args: []string{"unique_id"},
2823+
Line: 7,
2824+
Block: Directives{},
2825+
},
2826+
{
2827+
Directive: "client_secret",
2828+
Args: []string{"unique_secret"},
2829+
Line: 8,
2830+
Block: Directives{},
2831+
},
2832+
},
2833+
},
2834+
blockCtx{"http"},
2835+
false,
2836+
},
2837+
2838+
"oidc not ok": {
2839+
&Directive{
2840+
Directive: "oidc_provider",
2841+
Args: []string{"my_idp"},
2842+
Line: 5,
2843+
Block: Directives{
2844+
{
2845+
Directive: "issuer",
2846+
Args: []string{"https://provider.domain"},
2847+
Line: 6,
2848+
Block: Directives{},
2849+
},
2850+
{
2851+
Directive: "client_id",
2852+
Args: []string{"unique_id"},
2853+
Line: 7,
2854+
Block: Directives{},
2855+
},
2856+
{
2857+
Directive: "client_secret",
2858+
Args: []string{"unique_secret"},
2859+
Line: 8,
2860+
Block: Directives{},
2861+
},
2862+
},
2863+
},
2864+
blockCtx{"stream"},
2865+
true,
2866+
},
2867+
"auth_oidc ok": {
2868+
&Directive{
2869+
Directive: "auth_oidc",
2870+
Args: []string{"my_idp"},
2871+
Line: 5,
2872+
},
2873+
blockCtx{"http"},
2874+
false,
2875+
},
2876+
"auth_oidc args not ok": {
2877+
&Directive{
2878+
Directive: "auth_oidc",
2879+
Args: []string{"my_idp", "my_realm"},
2880+
Line: 5,
2881+
},
2882+
blockCtx{"http"},
2883+
true,
2884+
},
2885+
"auth_oidc not ok": {
2886+
&Directive{
2887+
Directive: "auth_oidc",
2888+
Args: []string{"203.0.113.0/24"},
2889+
Line: 5,
2890+
},
2891+
blockCtx{"stream"},
2892+
true,
2893+
},
2894+
}
2895+
2896+
for name, tc := range testcases {
2897+
tc := tc
2898+
t.Run(name, func(t *testing.T) {
2899+
t.Parallel()
2900+
err := analyze("nginx.conf", tc.stmt, ";", tc.ctx, &ParseOptions{
2901+
DirectiveSources: []MatchFunc{MatchNginxPlusR34},
2902+
})
2903+
2904+
if !tc.wantErr && err != nil {
2905+
t.Fatal(err)
2906+
}
2907+
2908+
if tc.wantErr && err == nil {
2909+
t.Fatal("expected error, got nil")
2910+
}
2911+
})
2912+
}
2913+
}

‎parse_test.go

Lines changed: 84 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2024,7 +2024,11 @@ var parseFixtures = []parseFixture{
20242024
},
20252025
},
20262026
}},
2027-
{"limit-req-zone", "", ParseOptions{SingleFile: true}, Payload{
2027+
{"limit-req-zone", "", ParseOptions{
2028+
SingleFile: true,
2029+
ErrorOnUnknownDirectives: true,
2030+
DirectiveSources: []MatchFunc{MatchNginxPlusR33},
2031+
}, Payload{
20282032
Status: "ok",
20292033
Errors: []PayloadError{},
20302034
Config: []Config{
@@ -2297,6 +2301,85 @@ var parseFixtures = []parseFixture{
22972301
},
22982302
},
22992303
}},
2304+
{"oidc", "", ParseOptions{
2305+
SingleFile: true,
2306+
ErrorOnUnknownDirectives: true,
2307+
DirectiveSources: []MatchFunc{MatchNginxPlusR34},
2308+
}, Payload{
2309+
Status: "ok",
2310+
Errors: []PayloadError{},
2311+
Config: []Config{
2312+
{
2313+
File: getTestConfigPath("oidc", "nginx.conf"),
2314+
Status: "ok",
2315+
Parsed: Directives{
2316+
{
2317+
Directive: "http",
2318+
Line: 1,
2319+
Args: []string{},
2320+
Block: Directives{
2321+
{
2322+
Directive: "oidc_provider",
2323+
Line: 2,
2324+
Args: []string{"my_idp"},
2325+
Block: Directives{
2326+
{
2327+
Directive: "issuer",
2328+
Args: []string{"https://provider.domain"},
2329+
Line: 3,
2330+
Block: Directives{},
2331+
IsMapBlockParameter: true,
2332+
},
2333+
{
2334+
Directive: "client_id",
2335+
Args: []string{"unique_id"},
2336+
Line: 4,
2337+
Block: Directives{},
2338+
IsMapBlockParameter: true,
2339+
},
2340+
{
2341+
Directive: "client_secret",
2342+
Args: []string{"unique_secret"},
2343+
Line: 5,
2344+
Block: Directives{},
2345+
IsMapBlockParameter: true,
2346+
},
2347+
},
2348+
},
2349+
{
2350+
Directive: "server",
2351+
Line: 7,
2352+
Args: []string{},
2353+
Block: Directives{
2354+
{
2355+
Directive: "auth_oidc",
2356+
Line: 8,
2357+
Args: []string{"my_idp"},
2358+
Block: Directives{},
2359+
},
2360+
{
2361+
Directive: "location",
2362+
Line: 9,
2363+
Args: []string{"/"},
2364+
Block: Directives{
2365+
{
2366+
Directive: "return",
2367+
Line: 10,
2368+
Args: []string{
2369+
"200",
2370+
"Hello",
2371+
},
2372+
},
2373+
},
2374+
},
2375+
},
2376+
},
2377+
},
2378+
},
2379+
},
2380+
},
2381+
},
2382+
}},
23002383
}
23012384

23022385
func TestParse(t *testing.T) {

‎testdata/configs/oidc/nginx.conf

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
http {
2+
oidc_provider my_idp {
3+
issuer "https://provider.domain";
4+
client_id "unique_id";
5+
client_secret "unique_secret";
6+
}
7+
server {
8+
auth_oidc my_idp;
9+
location / {
10+
return 200 "Hello";
11+
}
12+
}
13+
}

0 commit comments

Comments
 (0)