Guided-auth removal, OAuth smoke testing, and TUI/CLI support (#1531)
* refactor(web): update OAuth E2E tests to use new authentication method - Replaced `runGuidedAuth` with `authenticate` in the InspectorClient OAuth end-to-end tests to support quick authentication with CIMD pre-registration. - Updated comments to reflect the change in authentication method and its support for HTTP test metadata URLs. - Ensured that the tests continue to validate the expected authorization URL after the change. Additionally, imported `ensureCimdClientRegistration` in the OAuthManager to streamline client registration during the authentication process. * Guided-auth removal, OAuth smoke testing, and TUI/CLI support * Added CLI OAuth runner flags tests * Added clarifying comment on port 0 binding * README notes on TUI oauth callback port, prettier fixes for CLI tests * CIMD validation uses inline like EMA IdP * Fixed TUI test failures from merge * test: bring 5 OAuth files over the 90 per-file coverage gate The guided-auth-removal work added/touched several files that fell below the repo's >=90 per-file coverage gate (npm run coverage). CI doesn't run the gate (it's local-only), so validate + test:integration passed while these gaps slipped through. Bring them all back over the line: - core/auth/node/runner-oauth-callback.ts: test bad-URL/non-http-scheme throws, no-port->80 default, and IPv6 hostname bracketing. Annotate the provably-dead guards (empty host, out-of-range port, String(err) fallback, pathname "/" fallback) -- all rejected by new URL() upstream -- with justified v8 ignore comments instead of lowering the gate. - core/auth/cimd.ts: test the AS-doesn't-support-CIMD early return. - core/react/useClientSettingsDraft.ts: test the functional-updater path, the stale-onChange-after-close prev===null guard, and the timer-fires-after-close value===null guard. - ClientSettingsForm.tsx: test the CIMD checkbox toggle and CIMD URL clear. - clients/tui/src/utils/oauthDisplay.ts: test static/dcr registration kinds, the expired IdP session, and the configured-scope/empty-scope branches of formatScopes. npm run coverage now passes (exit 0) across web, cli, tui, launcher. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: cliffhall <cliff@futurescale.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Bob Dickinson
GitHub
parent
4a927d3978
commit
13dafe457b
4 changed files with 5702 additions and 4444 deletions
|
|
@ -3,23 +3,38 @@ import { describe, it, expect, vi } from "vitest";
|
|||
import userEvent from "@testing-library/user-event";
|
||||
import { renderWithMantine, screen } from "../../../test/renderWithMantine";
|
||||
import { ClientSettingsForm } from "./ClientSettingsForm";
|
||||
import {
|
||||
CIMD_METADATA_URL_HTTPS_ERROR,
|
||||
CIMD_METADATA_URL_INVALID_ERROR,
|
||||
} from "@inspector/core/client/config-parse.js";
|
||||
import {
|
||||
EMPTY_CLIENT_SETTINGS,
|
||||
ISSUER_URL_ERROR,
|
||||
type ClientSettingsFormValues,
|
||||
} from "./clientSettingsValues";
|
||||
|
||||
function resolveSettingsChange(
|
||||
call: unknown,
|
||||
prev: ClientSettingsFormValues,
|
||||
): ClientSettingsFormValues {
|
||||
return typeof call === "function"
|
||||
? (call as (p: ClientSettingsFormValues) => ClientSettingsFormValues)(prev)
|
||||
: (call as ClientSettingsFormValues);
|
||||
}
|
||||
|
||||
/** Stateful host so the controlled issuer input reflects edits, like the app. */
|
||||
function ClientSettingsFormHarness({
|
||||
initial,
|
||||
expandedSections = ["ema"],
|
||||
}: {
|
||||
initial: ClientSettingsFormValues;
|
||||
expandedSections?: ClientSettingsSection[];
|
||||
}) {
|
||||
const [settings, setSettings] = useState(initial);
|
||||
return (
|
||||
<ClientSettingsForm
|
||||
settings={settings}
|
||||
expandedSections={["ema"]}
|
||||
expandedSections={expandedSections}
|
||||
onExpandedSectionsChange={vi.fn()}
|
||||
onSettingsChange={setSettings}
|
||||
emaIdpLoginState="none"
|
||||
|
|
@ -27,6 +42,8 @@ function ClientSettingsFormHarness({
|
|||
);
|
||||
}
|
||||
|
||||
type ClientSettingsSection = "ema" | "cimd";
|
||||
|
||||
describe("ClientSettingsForm EMA IdP session", () => {
|
||||
it("shows signed-in state and sign out", async () => {
|
||||
const user = userEvent.setup();
|
||||
|
|
@ -180,6 +197,102 @@ describe("ClientSettingsForm EMA IdP session", () => {
|
|||
expect(screen.queryByText(ISSUER_URL_ERROR)).not.toBeInTheDocument();
|
||||
});
|
||||
|
||||
it("defers the invalid CIMD URL error until the field is blurred", async () => {
|
||||
const user = userEvent.setup();
|
||||
renderWithMantine(
|
||||
<ClientSettingsForm
|
||||
settings={{
|
||||
...EMPTY_CLIENT_SETTINGS,
|
||||
cimdEnabled: true,
|
||||
clientMetadataUrl: "not-a-url",
|
||||
}}
|
||||
expandedSections={["cimd"]}
|
||||
onExpandedSectionsChange={vi.fn()}
|
||||
onSettingsChange={vi.fn()}
|
||||
emaIdpLoginState="none"
|
||||
/>,
|
||||
);
|
||||
|
||||
expect(
|
||||
screen.queryByText(CIMD_METADATA_URL_INVALID_ERROR),
|
||||
).not.toBeInTheDocument();
|
||||
|
||||
await user.click(screen.getByLabelText("Client ID metadata document URL"));
|
||||
await user.tab();
|
||||
expect(
|
||||
screen.getByText(CIMD_METADATA_URL_INVALID_ERROR),
|
||||
).toBeInTheDocument();
|
||||
});
|
||||
|
||||
it("clears the CIMD URL error live once a valid URL is entered after blur", async () => {
|
||||
const user = userEvent.setup();
|
||||
renderWithMantine(
|
||||
<ClientSettingsFormHarness
|
||||
initial={{
|
||||
...EMPTY_CLIENT_SETTINGS,
|
||||
cimdEnabled: true,
|
||||
clientMetadataUrl: "not-a-url",
|
||||
}}
|
||||
expandedSections={["cimd"]}
|
||||
/>,
|
||||
);
|
||||
|
||||
const url = screen.getByLabelText("Client ID metadata document URL");
|
||||
await user.click(url);
|
||||
await user.tab();
|
||||
expect(
|
||||
screen.getByText(CIMD_METADATA_URL_INVALID_ERROR),
|
||||
).toBeInTheDocument();
|
||||
|
||||
await user.clear(url);
|
||||
await user.type(url, "https://example.com/cimd.json");
|
||||
expect(
|
||||
screen.queryByText(CIMD_METADATA_URL_INVALID_ERROR),
|
||||
).not.toBeInTheDocument();
|
||||
});
|
||||
|
||||
it("reveals the CIMD URL error without blur when revealClientMetadataUrlError is set", () => {
|
||||
renderWithMantine(
|
||||
<ClientSettingsForm
|
||||
settings={{
|
||||
...EMPTY_CLIENT_SETTINGS,
|
||||
cimdEnabled: true,
|
||||
clientMetadataUrl: "http://example.com/cimd.json",
|
||||
}}
|
||||
expandedSections={["cimd"]}
|
||||
onExpandedSectionsChange={vi.fn()}
|
||||
onSettingsChange={vi.fn()}
|
||||
emaIdpLoginState="none"
|
||||
revealClientMetadataUrlError
|
||||
/>,
|
||||
);
|
||||
|
||||
expect(screen.getByText(CIMD_METADATA_URL_HTTPS_ERROR)).toBeInTheDocument();
|
||||
});
|
||||
|
||||
it("shows no CIMD URL error for a valid URL", () => {
|
||||
renderWithMantine(
|
||||
<ClientSettingsForm
|
||||
settings={{
|
||||
...EMPTY_CLIENT_SETTINGS,
|
||||
cimdEnabled: true,
|
||||
clientMetadataUrl: "https://example.com/cimd.json",
|
||||
}}
|
||||
expandedSections={["cimd"]}
|
||||
onExpandedSectionsChange={vi.fn()}
|
||||
onSettingsChange={vi.fn()}
|
||||
emaIdpLoginState="none"
|
||||
/>,
|
||||
);
|
||||
|
||||
expect(
|
||||
screen.queryByText(CIMD_METADATA_URL_INVALID_ERROR),
|
||||
).not.toBeInTheDocument();
|
||||
expect(
|
||||
screen.queryByText(CIMD_METADATA_URL_HTTPS_ERROR),
|
||||
).not.toBeInTheDocument();
|
||||
});
|
||||
|
||||
it("shows expired state with sign out", () => {
|
||||
renderWithMantine(
|
||||
<ClientSettingsForm
|
||||
|
|
@ -241,18 +354,79 @@ describe("ClientSettingsForm interactions", () => {
|
|||
name: "Enable enterprise IdP configuration",
|
||||
}),
|
||||
);
|
||||
expect(onSettingsChange).toHaveBeenCalledWith({
|
||||
expect(onSettingsChange).toHaveBeenCalledWith(expect.any(Function));
|
||||
expect(
|
||||
resolveSettingsChange(
|
||||
onSettingsChange.mock.calls[0]![0],
|
||||
EMPTY_CLIENT_SETTINGS,
|
||||
),
|
||||
).toEqual({
|
||||
...EMPTY_CLIENT_SETTINGS,
|
||||
emaEnabled: true,
|
||||
});
|
||||
});
|
||||
|
||||
it("edits the IdP text fields via onSettingsChange", async () => {
|
||||
it("toggles the CIMD enable checkbox via onSettingsChange", async () => {
|
||||
const user = userEvent.setup();
|
||||
const onSettingsChange = vi.fn();
|
||||
renderWithMantine(
|
||||
<ClientSettingsForm
|
||||
settings={{ ...EMPTY_CLIENT_SETTINGS, emaEnabled: true }}
|
||||
settings={EMPTY_CLIENT_SETTINGS}
|
||||
expandedSections={["cimd"]}
|
||||
onExpandedSectionsChange={vi.fn()}
|
||||
onSettingsChange={onSettingsChange}
|
||||
/>,
|
||||
);
|
||||
|
||||
await user.click(
|
||||
screen.getByRole("checkbox", {
|
||||
name: "Use Client ID Metadata Document",
|
||||
}),
|
||||
);
|
||||
expect(onSettingsChange).toHaveBeenCalledWith(expect.any(Function));
|
||||
expect(
|
||||
resolveSettingsChange(
|
||||
onSettingsChange.mock.calls[0]![0],
|
||||
EMPTY_CLIENT_SETTINGS,
|
||||
),
|
||||
).toEqual({
|
||||
...EMPTY_CLIENT_SETTINGS,
|
||||
cimdEnabled: true,
|
||||
});
|
||||
});
|
||||
|
||||
it("clears the CIMD metadata URL via its clear button", async () => {
|
||||
const user = userEvent.setup();
|
||||
const onSettingsChange = vi.fn();
|
||||
const filled = {
|
||||
...EMPTY_CLIENT_SETTINGS,
|
||||
cimdEnabled: true,
|
||||
clientMetadataUrl: "https://example.com/cimd.json",
|
||||
};
|
||||
renderWithMantine(
|
||||
<ClientSettingsForm
|
||||
settings={filled}
|
||||
expandedSections={["cimd"]}
|
||||
onExpandedSectionsChange={vi.fn()}
|
||||
onSettingsChange={onSettingsChange}
|
||||
/>,
|
||||
);
|
||||
|
||||
await user.click(screen.getByRole("button", { name: "Clear" }));
|
||||
expect(onSettingsChange).toHaveBeenCalledWith(expect.any(Function));
|
||||
expect(
|
||||
resolveSettingsChange(onSettingsChange.mock.calls[0]![0], filled)
|
||||
.clientMetadataUrl,
|
||||
).toBe("");
|
||||
});
|
||||
|
||||
it("edits the IdP text fields via onSettingsChange", async () => {
|
||||
const user = userEvent.setup();
|
||||
const onSettingsChange = vi.fn();
|
||||
const initial = { ...EMPTY_CLIENT_SETTINGS, emaEnabled: true };
|
||||
renderWithMantine(
|
||||
<ClientSettingsForm
|
||||
settings={initial}
|
||||
expandedSections={["ema"]}
|
||||
onExpandedSectionsChange={vi.fn()}
|
||||
onSettingsChange={onSettingsChange}
|
||||
|
|
@ -260,19 +434,23 @@ describe("ClientSettingsForm interactions", () => {
|
|||
);
|
||||
|
||||
await user.type(screen.getByLabelText("Client ID"), "x");
|
||||
expect(onSettingsChange).toHaveBeenLastCalledWith({
|
||||
...EMPTY_CLIENT_SETTINGS,
|
||||
emaEnabled: true,
|
||||
clientId: "x",
|
||||
});
|
||||
expect(onSettingsChange).toHaveBeenLastCalledWith(expect.any(Function));
|
||||
expect(
|
||||
resolveSettingsChange(
|
||||
onSettingsChange.mock.calls[onSettingsChange.mock.calls.length - 1]![0],
|
||||
initial,
|
||||
).clientId,
|
||||
).toBe("x");
|
||||
|
||||
onSettingsChange.mockClear();
|
||||
await user.type(screen.getByLabelText("Client Secret"), "s");
|
||||
expect(onSettingsChange).toHaveBeenLastCalledWith({
|
||||
...EMPTY_CLIENT_SETTINGS,
|
||||
emaEnabled: true,
|
||||
clientSecret: "s",
|
||||
});
|
||||
expect(onSettingsChange).toHaveBeenLastCalledWith(expect.any(Function));
|
||||
expect(
|
||||
resolveSettingsChange(
|
||||
onSettingsChange.mock.calls[onSettingsChange.mock.calls.length - 1]![0],
|
||||
{ ...initial, clientId: "x" },
|
||||
).clientSecret,
|
||||
).toBe("s");
|
||||
});
|
||||
|
||||
it("clears each populated IdP field via its clear button", async () => {
|
||||
|
|
@ -300,20 +478,28 @@ describe("ClientSettingsForm interactions", () => {
|
|||
|
||||
// Issuer clear -> patch({ issuer: "" })
|
||||
await user.click(clearButtons[0]);
|
||||
expect(onSettingsChange).toHaveBeenCalledWith({ ...filled, issuer: "" });
|
||||
expect(onSettingsChange).toHaveBeenCalledWith(expect.any(Function));
|
||||
expect(
|
||||
resolveSettingsChange(onSettingsChange.mock.calls[0]![0], filled).issuer,
|
||||
).toBe("");
|
||||
|
||||
// Client ID clear -> patch({ clientId: "" })
|
||||
onSettingsChange.mockClear();
|
||||
await user.click(clearButtons[1]);
|
||||
expect(onSettingsChange).toHaveBeenCalledWith({ ...filled, clientId: "" });
|
||||
expect(onSettingsChange).toHaveBeenCalledWith(expect.any(Function));
|
||||
expect(
|
||||
resolveSettingsChange(onSettingsChange.mock.calls[0]![0], filled)
|
||||
.clientId,
|
||||
).toBe("");
|
||||
|
||||
// Client Secret clear -> patch({ clientSecret: "" })
|
||||
onSettingsChange.mockClear();
|
||||
await user.click(clearButtons[2]);
|
||||
expect(onSettingsChange).toHaveBeenCalledWith({
|
||||
...filled,
|
||||
clientSecret: "",
|
||||
});
|
||||
expect(onSettingsChange).toHaveBeenCalledWith(expect.any(Function));
|
||||
expect(
|
||||
resolveSettingsChange(onSettingsChange.mock.calls[0]![0], filled)
|
||||
.clientSecret,
|
||||
).toBe("");
|
||||
});
|
||||
|
||||
it("omits clear buttons when IdP fields are empty", () => {
|
||||
|
|
|
|||
|
|
@ -16,13 +16,17 @@ import {
|
|||
type ClientSettingsFormValues,
|
||||
} from "./clientSettingsValues.js";
|
||||
|
||||
export type ClientSettingsSection = "ema";
|
||||
export type ClientSettingsSection = "ema" | "cimd";
|
||||
|
||||
export interface ClientSettingsFormProps {
|
||||
settings: ClientSettingsFormValues;
|
||||
expandedSections: ClientSettingsSection[];
|
||||
onExpandedSectionsChange: (sections: ClientSettingsSection[]) => void;
|
||||
onSettingsChange: (settings: ClientSettingsFormValues) => void;
|
||||
onSettingsChange: (
|
||||
settings:
|
||||
| ClientSettingsFormValues
|
||||
| ((prev: ClientSettingsFormValues) => ClientSettingsFormValues),
|
||||
) => void;
|
||||
emaIdpLoginState?: EmaIdpLoginState;
|
||||
onEmaIdpLogout?: () => void;
|
||||
/**
|
||||
|
|
@ -31,6 +35,11 @@ export interface ClientSettingsFormProps {
|
|||
* isn't left with a silently-dropped value and no explanation.
|
||||
*/
|
||||
revealIssuerError?: boolean;
|
||||
/**
|
||||
* Force the CIMD metadata URL error to show even before the field is blurred.
|
||||
* Same contract as {@link revealIssuerError} for the CIMD URL field.
|
||||
*/
|
||||
revealClientMetadataUrlError?: boolean;
|
||||
}
|
||||
|
||||
const HintText = Text.withProps({
|
||||
|
|
@ -46,9 +55,10 @@ export function ClientSettingsForm({
|
|||
emaIdpLoginState = "none",
|
||||
onEmaIdpLogout,
|
||||
revealIssuerError = false,
|
||||
revealClientMetadataUrlError = false,
|
||||
}: ClientSettingsFormProps) {
|
||||
function patch(partial: Partial<ClientSettingsFormValues>) {
|
||||
onSettingsChange({ ...settings, ...partial });
|
||||
onSettingsChange((prev) => ({ ...prev, ...partial }));
|
||||
}
|
||||
|
||||
// Defer the issuer error until the field has been blurred so it doesn't nag
|
||||
|
|
@ -59,12 +69,19 @@ export function ClientSettingsForm({
|
|||
// without explanation. The persist gate (canPersistClientSettingsDraft)
|
||||
// validates independently — an invalid issuer is never written regardless.
|
||||
const [issuerTouched, setIssuerTouched] = useState(false);
|
||||
const [clientMetadataUrlTouched, setClientMetadataUrlTouched] =
|
||||
useState(false);
|
||||
|
||||
const errors = validateClientSettings(settings);
|
||||
const showIssuerError =
|
||||
(issuerTouched || revealIssuerError) && errors.issuer
|
||||
? errors.issuer
|
||||
: undefined;
|
||||
const showClientMetadataUrlError =
|
||||
(clientMetadataUrlTouched || revealClientMetadataUrlError) &&
|
||||
errors.clientMetadataUrl
|
||||
? errors.clientMetadataUrl
|
||||
: undefined;
|
||||
|
||||
const showIdpSession =
|
||||
settings.emaEnabled &&
|
||||
|
|
@ -197,6 +214,48 @@ export function ClientSettingsForm({
|
|||
</Stack>
|
||||
</Accordion.Panel>
|
||||
</Accordion.Item>
|
||||
<Accordion.Item value="cimd">
|
||||
<Accordion.Control>OAuth Client ID Metadata Document</Accordion.Control>
|
||||
<Accordion.Panel>
|
||||
<Stack gap="md">
|
||||
<Checkbox
|
||||
label="Use Client ID Metadata Document"
|
||||
description="When the authorization server supports CIMD, Inspector uses this metadata document URL as the client id. The server fetches and verifies the document during OAuth."
|
||||
checked={settings.cimdEnabled}
|
||||
onChange={(e) => patch({ cimdEnabled: e.currentTarget.checked })}
|
||||
/>
|
||||
{settings.cimdEnabled && (
|
||||
<>
|
||||
<HintText>
|
||||
The metadata document must be served over HTTPS and list this
|
||||
redirect URI:{" "}
|
||||
{typeof window !== "undefined"
|
||||
? `${window.location.origin}/oauth/callback`
|
||||
: "http://localhost:6274/oauth/callback"}
|
||||
</HintText>
|
||||
<TextInput
|
||||
label="Client ID metadata document URL"
|
||||
description="Public HTTPS URL of your OAuth client metadata JSON document."
|
||||
value={settings.clientMetadataUrl}
|
||||
onChange={(e) =>
|
||||
patch({ clientMetadataUrl: e.currentTarget.value })
|
||||
}
|
||||
onBlur={() => setClientMetadataUrlTouched(true)}
|
||||
error={showClientMetadataUrlError}
|
||||
rightSectionPointerEvents="auto"
|
||||
rightSection={
|
||||
settings.clientMetadataUrl ? (
|
||||
<ClearButton
|
||||
onClick={() => patch({ clientMetadataUrl: "" })}
|
||||
/>
|
||||
) : null
|
||||
}
|
||||
/>
|
||||
</>
|
||||
)}
|
||||
</Stack>
|
||||
</Accordion.Panel>
|
||||
</Accordion.Item>
|
||||
</Accordion>
|
||||
);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,9 @@
|
|||
import { describe, it, expect } from "vitest";
|
||||
import {
|
||||
CIMD_METADATA_URL_HTTPS_ERROR,
|
||||
CIMD_METADATA_URL_INVALID_ERROR,
|
||||
CIMD_METADATA_URL_PATH_ERROR,
|
||||
} from "@inspector/core/client/config-parse.js";
|
||||
import {
|
||||
canPersistClientSettingsDraft,
|
||||
clientConfigToFormValues,
|
||||
|
|
@ -8,6 +13,8 @@ import {
|
|||
validateClientSettings,
|
||||
} from "./clientSettingsValues";
|
||||
|
||||
const emptyCimd = { cimdEnabled: false, clientMetadataUrl: "" };
|
||||
|
||||
describe("clientSettingsValues", () => {
|
||||
it("clientConfigToFormValues returns empty settings when there is no enterpriseManagedAuth", () => {
|
||||
// Exercises the `!idp` early return (line 24) via an absent EMA block.
|
||||
|
|
@ -30,6 +37,7 @@ describe("clientSettingsValues", () => {
|
|||
issuer: "https://idp.test",
|
||||
clientId: "cid",
|
||||
clientSecret: "sec",
|
||||
...emptyCimd,
|
||||
});
|
||||
});
|
||||
|
||||
|
|
@ -50,6 +58,60 @@ describe("clientSettingsValues", () => {
|
|||
issuer: "https://idp.test",
|
||||
clientId: "cid",
|
||||
clientSecret: "sec",
|
||||
...emptyCimd,
|
||||
});
|
||||
});
|
||||
|
||||
it("clientConfigToFormValues maps cimd when EMA is absent", () => {
|
||||
expect(
|
||||
clientConfigToFormValues({
|
||||
cimd: {
|
||||
enabled: true,
|
||||
clientMetadataUrl: "https://example.com/cimd.json",
|
||||
},
|
||||
}),
|
||||
).toEqual({
|
||||
emaEnabled: false,
|
||||
issuer: "",
|
||||
clientId: "",
|
||||
clientSecret: "",
|
||||
cimdEnabled: true,
|
||||
clientMetadataUrl: "https://example.com/cimd.json",
|
||||
});
|
||||
});
|
||||
|
||||
it("clientConfigToFormValues preserves CIMD URL when disabled", () => {
|
||||
expect(
|
||||
clientConfigToFormValues({
|
||||
cimd: {
|
||||
enabled: false,
|
||||
clientMetadataUrl: "https://example.com/cimd.json",
|
||||
},
|
||||
}),
|
||||
).toEqual({
|
||||
emaEnabled: false,
|
||||
issuer: "",
|
||||
clientId: "",
|
||||
clientSecret: "",
|
||||
cimdEnabled: false,
|
||||
clientMetadataUrl: "https://example.com/cimd.json",
|
||||
});
|
||||
});
|
||||
|
||||
it("formValuesToClientConfig always writes the cimd block from the dialog", () => {
|
||||
expect(
|
||||
formValuesToClientConfig({
|
||||
emaEnabled: false,
|
||||
issuer: "",
|
||||
clientId: "",
|
||||
clientSecret: "",
|
||||
...emptyCimd,
|
||||
}),
|
||||
).toEqual({
|
||||
cimd: {
|
||||
enabled: false,
|
||||
clientMetadataUrl: "",
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
|
|
@ -60,6 +122,7 @@ describe("clientSettingsValues", () => {
|
|||
issuer: "https://idp.test",
|
||||
clientId: "cid",
|
||||
clientSecret: "sec",
|
||||
...emptyCimd,
|
||||
}),
|
||||
).toEqual({
|
||||
enterpriseManagedAuth: {
|
||||
|
|
@ -70,18 +133,55 @@ describe("clientSettingsValues", () => {
|
|||
clientSecret: "sec",
|
||||
},
|
||||
},
|
||||
cimd: {
|
||||
enabled: false,
|
||||
clientMetadataUrl: "",
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
it("formValuesToClientConfig omits block when disabled with no stored fields", () => {
|
||||
it("formValuesToClientConfig keeps CIMD URL when disabled", () => {
|
||||
expect(
|
||||
formValuesToClientConfig({
|
||||
emaEnabled: false,
|
||||
issuer: "",
|
||||
clientId: "",
|
||||
clientSecret: "",
|
||||
cimdEnabled: false,
|
||||
clientMetadataUrl: "https://example.com/cimd.json",
|
||||
}),
|
||||
).toEqual({});
|
||||
).toEqual({
|
||||
cimd: {
|
||||
enabled: false,
|
||||
clientMetadataUrl: "https://example.com/cimd.json",
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
it("formValuesToClientConfig serializes EMA and CIMD together", () => {
|
||||
expect(
|
||||
formValuesToClientConfig({
|
||||
emaEnabled: true,
|
||||
issuer: "https://idp.test",
|
||||
clientId: "cid",
|
||||
clientSecret: "",
|
||||
cimdEnabled: true,
|
||||
clientMetadataUrl: "https://example.com/cimd.json",
|
||||
}),
|
||||
).toEqual({
|
||||
enterpriseManagedAuth: {
|
||||
enabled: true,
|
||||
idp: {
|
||||
issuer: "https://idp.test",
|
||||
clientId: "cid",
|
||||
clientSecret: "",
|
||||
},
|
||||
},
|
||||
cimd: {
|
||||
enabled: true,
|
||||
clientMetadataUrl: "https://example.com/cimd.json",
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
it("formValuesToClientConfig trims issuer and clientId when enabled", () => {
|
||||
|
|
@ -91,6 +191,7 @@ describe("clientSettingsValues", () => {
|
|||
issuer: " https://idp.test ",
|
||||
clientId: " cid ",
|
||||
clientSecret: "sec",
|
||||
...emptyCimd,
|
||||
}),
|
||||
).toEqual({
|
||||
enterpriseManagedAuth: {
|
||||
|
|
@ -101,6 +202,28 @@ describe("clientSettingsValues", () => {
|
|||
clientSecret: "sec",
|
||||
},
|
||||
},
|
||||
cimd: {
|
||||
enabled: false,
|
||||
clientMetadataUrl: "",
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
it("formValuesToClientConfig trims CIMD URL", () => {
|
||||
expect(
|
||||
formValuesToClientConfig({
|
||||
emaEnabled: false,
|
||||
issuer: "",
|
||||
clientId: "",
|
||||
clientSecret: "",
|
||||
cimdEnabled: true,
|
||||
clientMetadataUrl: " https://example.com/cimd.json ",
|
||||
}),
|
||||
).toEqual({
|
||||
cimd: {
|
||||
enabled: true,
|
||||
clientMetadataUrl: "https://example.com/cimd.json",
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
|
|
@ -111,6 +234,7 @@ describe("clientSettingsValues", () => {
|
|||
issuer: "",
|
||||
clientId: "",
|
||||
clientSecret: "",
|
||||
...emptyCimd,
|
||||
}),
|
||||
).toBe(true);
|
||||
expect(
|
||||
|
|
@ -119,6 +243,7 @@ describe("clientSettingsValues", () => {
|
|||
issuer: "https://idp.test",
|
||||
clientId: "cid",
|
||||
clientSecret: "",
|
||||
...emptyCimd,
|
||||
}),
|
||||
).toBe(true);
|
||||
expect(
|
||||
|
|
@ -127,10 +252,47 @@ describe("clientSettingsValues", () => {
|
|||
issuer: "",
|
||||
clientId: "cid",
|
||||
clientSecret: "",
|
||||
...emptyCimd,
|
||||
}),
|
||||
).toBe(false);
|
||||
});
|
||||
|
||||
it("canPersistClientSettingsDraft requires CIMD URL when enabled", () => {
|
||||
expect(
|
||||
canPersistClientSettingsDraft({
|
||||
emaEnabled: false,
|
||||
issuer: "",
|
||||
clientId: "",
|
||||
clientSecret: "",
|
||||
cimdEnabled: true,
|
||||
clientMetadataUrl: "",
|
||||
}),
|
||||
).toBe(false);
|
||||
expect(
|
||||
canPersistClientSettingsDraft({
|
||||
emaEnabled: false,
|
||||
issuer: "",
|
||||
clientId: "",
|
||||
clientSecret: "",
|
||||
cimdEnabled: true,
|
||||
clientMetadataUrl: "https://example.com/cimd.json",
|
||||
}),
|
||||
).toBe(true);
|
||||
});
|
||||
|
||||
it("canPersistClientSettingsDraft allows disabling CIMD while keeping the URL", () => {
|
||||
expect(
|
||||
canPersistClientSettingsDraft({
|
||||
emaEnabled: false,
|
||||
issuer: "",
|
||||
clientId: "",
|
||||
clientSecret: "",
|
||||
cimdEnabled: false,
|
||||
clientMetadataUrl: "https://example.com/cimd.json",
|
||||
}),
|
||||
).toBe(true);
|
||||
});
|
||||
|
||||
it("canPersistClientSettingsDraft blocks an invalid issuer URL", () => {
|
||||
expect(
|
||||
canPersistClientSettingsDraft({
|
||||
|
|
@ -138,6 +300,7 @@ describe("clientSettingsValues", () => {
|
|||
issuer: "not-a-url",
|
||||
clientId: "cid",
|
||||
clientSecret: "",
|
||||
...emptyCimd,
|
||||
}),
|
||||
).toBe(false);
|
||||
});
|
||||
|
|
@ -149,6 +312,7 @@ describe("clientSettingsValues", () => {
|
|||
issuer: "not-a-url",
|
||||
clientId: "cid",
|
||||
clientSecret: "",
|
||||
...emptyCimd,
|
||||
}),
|
||||
).toEqual({ issuer: ISSUER_URL_ERROR });
|
||||
});
|
||||
|
|
@ -160,6 +324,7 @@ describe("clientSettingsValues", () => {
|
|||
issuer: "https://idp.test",
|
||||
clientId: "cid",
|
||||
clientSecret: "",
|
||||
...emptyCimd,
|
||||
}),
|
||||
).toEqual({});
|
||||
});
|
||||
|
|
@ -171,6 +336,7 @@ describe("clientSettingsValues", () => {
|
|||
issuer: "",
|
||||
clientId: "cid",
|
||||
clientSecret: "",
|
||||
...emptyCimd,
|
||||
}),
|
||||
).toEqual({});
|
||||
});
|
||||
|
|
@ -182,6 +348,112 @@ describe("clientSettingsValues", () => {
|
|||
issuer: "not-a-url",
|
||||
clientId: "cid",
|
||||
clientSecret: "",
|
||||
...emptyCimd,
|
||||
}),
|
||||
).toEqual({});
|
||||
});
|
||||
|
||||
it("canPersistClientSettingsDraft blocks an invalid CIMD URL", () => {
|
||||
expect(
|
||||
canPersistClientSettingsDraft({
|
||||
emaEnabled: false,
|
||||
issuer: "",
|
||||
clientId: "",
|
||||
clientSecret: "",
|
||||
cimdEnabled: true,
|
||||
clientMetadataUrl: "not-a-url",
|
||||
}),
|
||||
).toBe(false);
|
||||
expect(
|
||||
canPersistClientSettingsDraft({
|
||||
emaEnabled: false,
|
||||
issuer: "",
|
||||
clientId: "",
|
||||
clientSecret: "",
|
||||
cimdEnabled: true,
|
||||
clientMetadataUrl: "http://example.com/cimd.json",
|
||||
}),
|
||||
).toBe(false);
|
||||
expect(
|
||||
canPersistClientSettingsDraft({
|
||||
emaEnabled: false,
|
||||
issuer: "",
|
||||
clientId: "",
|
||||
clientSecret: "",
|
||||
cimdEnabled: true,
|
||||
clientMetadataUrl: "https://example.com/",
|
||||
}),
|
||||
).toBe(false);
|
||||
});
|
||||
|
||||
it("validateClientSettings flags an invalid CIMD URL", () => {
|
||||
expect(
|
||||
validateClientSettings({
|
||||
emaEnabled: false,
|
||||
issuer: "",
|
||||
clientId: "",
|
||||
clientSecret: "",
|
||||
cimdEnabled: true,
|
||||
clientMetadataUrl: "not-a-url",
|
||||
}),
|
||||
).toEqual({ clientMetadataUrl: CIMD_METADATA_URL_INVALID_ERROR });
|
||||
expect(
|
||||
validateClientSettings({
|
||||
emaEnabled: false,
|
||||
issuer: "",
|
||||
clientId: "",
|
||||
clientSecret: "",
|
||||
cimdEnabled: true,
|
||||
clientMetadataUrl: "http://example.com/cimd.json",
|
||||
}),
|
||||
).toEqual({ clientMetadataUrl: CIMD_METADATA_URL_HTTPS_ERROR });
|
||||
expect(
|
||||
validateClientSettings({
|
||||
emaEnabled: false,
|
||||
issuer: "",
|
||||
clientId: "",
|
||||
clientSecret: "",
|
||||
cimdEnabled: true,
|
||||
clientMetadataUrl: "https://example.com/",
|
||||
}),
|
||||
).toEqual({ clientMetadataUrl: CIMD_METADATA_URL_PATH_ERROR });
|
||||
});
|
||||
|
||||
it("validateClientSettings passes a valid CIMD URL", () => {
|
||||
expect(
|
||||
validateClientSettings({
|
||||
emaEnabled: false,
|
||||
issuer: "",
|
||||
clientId: "",
|
||||
clientSecret: "",
|
||||
cimdEnabled: true,
|
||||
clientMetadataUrl: "https://example.com/cimd.json",
|
||||
}),
|
||||
).toEqual({});
|
||||
});
|
||||
|
||||
it("validateClientSettings ignores an empty CIMD URL", () => {
|
||||
expect(
|
||||
validateClientSettings({
|
||||
emaEnabled: false,
|
||||
issuer: "",
|
||||
clientId: "",
|
||||
clientSecret: "",
|
||||
cimdEnabled: true,
|
||||
clientMetadataUrl: "",
|
||||
}),
|
||||
).toEqual({});
|
||||
});
|
||||
|
||||
it("validateClientSettings ignores CIMD URL when CIMD disabled", () => {
|
||||
expect(
|
||||
validateClientSettings({
|
||||
emaEnabled: false,
|
||||
issuer: "",
|
||||
clientId: "",
|
||||
clientSecret: "",
|
||||
cimdEnabled: false,
|
||||
clientMetadataUrl: "not-a-url",
|
||||
}),
|
||||
).toEqual({});
|
||||
});
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
import type { ClientConfig } from "@inspector/core/client/types.js";
|
||||
import { isAbsoluteHttpUrl } from "@inspector/core/client/config-parse.js";
|
||||
import {
|
||||
getCimdClientMetadataUrlError,
|
||||
isAbsoluteHttpUrl,
|
||||
} from "@inspector/core/client/config-parse.js";
|
||||
|
||||
/** Field-level error message for an issuer that is not an http(s) URL. */
|
||||
export const ISSUER_URL_ERROR =
|
||||
|
|
@ -8,6 +11,7 @@ export const ISSUER_URL_ERROR =
|
|||
/** Field-level validation errors for the client settings form. */
|
||||
export interface ClientSettingsErrors {
|
||||
issuer?: string;
|
||||
clientMetadataUrl?: string;
|
||||
}
|
||||
|
||||
/**
|
||||
|
|
@ -26,6 +30,12 @@ export function validateClientSettings(
|
|||
) {
|
||||
errors.issuer = ISSUER_URL_ERROR;
|
||||
}
|
||||
if (values.cimdEnabled && values.clientMetadataUrl.trim() !== "") {
|
||||
const cimdError = getCimdClientMetadataUrlError(values.clientMetadataUrl);
|
||||
if (cimdError) {
|
||||
errors.clientMetadataUrl = cimdError;
|
||||
}
|
||||
}
|
||||
return errors;
|
||||
}
|
||||
|
||||
|
|
@ -35,6 +45,8 @@ export interface ClientSettingsFormValues {
|
|||
issuer: string;
|
||||
clientId: string;
|
||||
clientSecret: string;
|
||||
cimdEnabled: boolean;
|
||||
clientMetadataUrl: string;
|
||||
}
|
||||
|
||||
export const EMPTY_CLIENT_SETTINGS: ClientSettingsFormValues = {
|
||||
|
|
@ -42,6 +54,8 @@ export const EMPTY_CLIENT_SETTINGS: ClientSettingsFormValues = {
|
|||
issuer: "",
|
||||
clientId: "",
|
||||
clientSecret: "",
|
||||
cimdEnabled: false,
|
||||
clientMetadataUrl: "",
|
||||
};
|
||||
|
||||
export function clientConfigToFormValues(
|
||||
|
|
@ -49,14 +63,15 @@ export function clientConfigToFormValues(
|
|||
): ClientSettingsFormValues {
|
||||
const ema = config.enterpriseManagedAuth;
|
||||
const idp = ema?.idp;
|
||||
if (!idp) {
|
||||
return { ...EMPTY_CLIENT_SETTINGS };
|
||||
}
|
||||
const cimd = config.cimd;
|
||||
|
||||
return {
|
||||
emaEnabled: ema.enabled !== false,
|
||||
issuer: idp.issuer,
|
||||
clientId: idp.clientId,
|
||||
clientSecret: idp.clientSecret ?? "",
|
||||
emaEnabled: idp ? ema!.enabled !== false : false,
|
||||
issuer: idp?.issuer ?? "",
|
||||
clientId: idp?.clientId ?? "",
|
||||
clientSecret: idp?.clientSecret ?? "",
|
||||
cimdEnabled: cimd?.enabled === true,
|
||||
clientMetadataUrl: cimd?.clientMetadataUrl ?? "",
|
||||
};
|
||||
}
|
||||
|
||||
|
|
@ -68,36 +83,43 @@ function hasStoredIdpFields(values: ClientSettingsFormValues): boolean {
|
|||
);
|
||||
}
|
||||
|
||||
/** Serialize the full dialog state. POST replaces client.json wholesale. */
|
||||
export function formValuesToClientConfig(
|
||||
values: ClientSettingsFormValues,
|
||||
): ClientConfig {
|
||||
if (!hasStoredIdpFields(values)) {
|
||||
return {};
|
||||
}
|
||||
|
||||
const idp = {
|
||||
issuer: values.issuer.trim(),
|
||||
clientId: values.clientId.trim(),
|
||||
clientSecret: values.clientSecret,
|
||||
};
|
||||
|
||||
return {
|
||||
enterpriseManagedAuth: {
|
||||
enabled: values.emaEnabled,
|
||||
idp,
|
||||
const result: ClientConfig = {
|
||||
cimd: {
|
||||
enabled: values.cimdEnabled,
|
||||
clientMetadataUrl: values.clientMetadataUrl.trim(),
|
||||
},
|
||||
};
|
||||
|
||||
if (hasStoredIdpFields(values) || values.emaEnabled) {
|
||||
result.enterpriseManagedAuth = {
|
||||
enabled: values.emaEnabled,
|
||||
idp: {
|
||||
issuer: values.issuer.trim(),
|
||||
clientId: values.clientId.trim(),
|
||||
clientSecret: values.clientSecret,
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
/** Skip debounced persist while EMA is enabled but required IdP fields are blank. */
|
||||
/** Skip debounced persist while required fields are blank for enabled features. */
|
||||
export function canPersistClientSettingsDraft(
|
||||
values: ClientSettingsFormValues,
|
||||
): boolean {
|
||||
if (!values.emaEnabled) return true;
|
||||
if (values.issuer.trim() === "" || values.clientId.trim() === "")
|
||||
return false;
|
||||
// Defer to validateClientSettings so the persist gate and the inline field
|
||||
// errors can never drift: an invalid issuer is never sent to the backend, and
|
||||
// the field error guides the user instead of a raw validation failure toast.
|
||||
if (values.emaEnabled) {
|
||||
if (values.issuer.trim() === "" || values.clientId.trim() === "")
|
||||
return false;
|
||||
}
|
||||
if (values.cimdEnabled) {
|
||||
if (!values.clientMetadataUrl.trim()) return false;
|
||||
}
|
||||
// Defer to validateClientSettings so the persist gate and inline field errors
|
||||
// can never drift — invalid values are never sent to the backend.
|
||||
return Object.keys(validateClientSettings(values)).length === 0;
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue