{{.}}
{{end}}{{end}}{{.Message}}
{{if .Error}}{{.Error}}
{{end}}{{if .Form}}{{end}}{{if .Enrolled}}{{end}}Your name is an unverified label, not a verified identity. It is shown to the application you are joining, together with the address above.{{.}}
{{end}}{{end}}{{.Message}}
{{if .Error}}{{.Error}}
{{end}}{{if .Form}}{{end}}{{if .Enrolled}}{{end}}{{if .Question}}Your name and your answer are unverified labels, not a verified identity. Both are shown to the application you are joining, together with the address above.{{else}}Your name is an unverified label, not a verified identity. It is shown to the application you are joining, together with the address above.{{end}}Welcome, {{.Name}}.
{{.Result}}This uses your demo identity. Work resources are outside its permissions.
{{else}}Join the room, then make a real Kubernetes change.
{{end}}{{if .Name}}Sign in again{{else}}Join the demo{{end}}
`)) + page := template.Must(template.New("app").Parse(`Welcome, {{.Name}}.
Your groups: {{.Groups}}
{{.Result}}This uses your demo identity. Work resources are outside its permissions.
{{else}}Join the room, then make a real Kubernetes change.
{{end}}`)) http.HandleFunc("/app/", func(w http.ResponseWriter, r *http.Request) { w.Header().Set("Cache-Control", "no-store") - w.Header().Set("Referrer-Policy", "no-referrer") + // same-origin, not no-referrer: under no-referrer a browser sends the + // write form's Origin as "null", and the check below refused every real + // browser while Go clients, which set Origin themselves, passed. Room + // Pass learned the same thing the same way. + w.Header().Set("Referrer-Policy", "same-origin") w.Header().Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'") s, e := get(r) switch r.URL.Path { @@ -130,11 +134,14 @@ func main() { http.Error(w, "Token invalid", 403) return } + // The groups are shown so the browser suite can read what a Room's + // question added, from the token Dex actually issued. var claims struct { - Name string `json:"name"` + Name string `json:"name"` + Groups []string `json:"groups"` } _ = verified.Claims(&claims) - set(w, session{Token: raw, Name: claims.Name, State: id()}) + set(w, session{Token: raw, Name: claims.Name, Groups: strings.Join(claims.Groups, ", "), State: id()}) http.Redirect(w, r, "/app/", 303) return case "/app/write": @@ -156,11 +163,11 @@ func main() { b, _ := io.ReadAll(io.LimitReader(resp.Body, 16384)) result := fmt.Sprintf("Kubernetes returned %d\n%s", resp.StatusCode, b) w.Header().Set("Content-Type", "text/html; charset=utf-8") - _ = page.Execute(w, map[string]string{"Name": s.Name, "CSRF": s.State, "Result": result}) + _ = page.Execute(w, map[string]string{"Name": s.Name, "Groups": s.Groups, "CSRF": s.State, "Result": result}) return case "/app/": w.Header().Set("Content-Type", "text/html; charset=utf-8") - _ = page.Execute(w, map[string]string{"Name": s.Name, "CSRF": s.State}) + _ = page.Execute(w, map[string]string{"Name": s.Name, "Groups": s.Groups, "CSRF": s.State}) return default: http.NotFound(w, r) diff --git a/test/integration/api_test.go b/test/integration/api_test.go index 38c0520..43424d5 100644 --- a/test/integration/api_test.go +++ b/test/integration/api_test.go @@ -3,6 +3,7 @@ package integration import ( "context" "os" + "reflect" "strings" "testing" "time" @@ -62,7 +63,20 @@ func TestAPISchemaAndReconcile(t *testing.T) { func(r *api.Room) { r.Spec.Appearance = &api.RoomAppearance{Picture: "//evil.test/logo.png"} }, func(r *api.Room) { r.Spec.Appearance = &api.RoomAppearance{BackgroundImage: `/a")`} }, func(r *api.Room) { r.Spec.Appearance = &api.RoomAppearance{Tagline: "bold"} }, - func(r *api.Room) { r.Spec.Appearance = &api.RoomAppearance{PictureAlt: strings.Repeat("x", 121)} }} { + func(r *api.Room) { r.Spec.Appearance = &api.RoomAppearance{PictureAlt: strings.Repeat("x", 121)} }, + // A question's answers are groups, so they follow audienceGroup's rules. + func(r *api.Room) { r.Spec.Question = question(answer("A", "system:masters"), answer("B", "demo:b")) }, + func(r *api.Room) { + r.Spec.Question = question(answer("A", "demo:a,system:masters"), answer("B", "demo:b")) + }, + func(r *api.Room) { r.Spec.Question = question(answer("A", "demo:a")) }, + func(r *api.Room) { r.Spec.Question = question(answer("A", "demo:a"), answer("B", "demo:a")) }, + func(r *api.Room) { r.Spec.Question = question(answer("Same", "demo:a"), answer("Same", "demo:b")) }, + func(r *api.Room) { r.Spec.Question = question(answer("A", "demo:a"), answer("B", "demo:b")) }, + func(r *api.Room) { + r.Spec.Question = question(answer("A", "demo:a"), answer("B", "demo:b")) + r.Spec.Question.Prompt = "" + }} { bad := room.DeepCopy() mutate(bad) if db.Update(ctx, bad) == nil { @@ -89,6 +103,14 @@ func TestAPISchemaAndReconcile(t *testing.T) { if e = db.Update(ctx, room); e != nil { t.Fatalf("appearance cannot be removed: %v", e) } + asked := question(answer("React", "demo:framework-react"), answer("Svelte", "demo:framework-svelte")) + room.Spec.Question = asked + if e = db.Update(ctx, room); e != nil { + t.Fatalf("question rejected: %v", e) + } + if e = db.Get(ctx, key, room); e != nil || room.Spec.Question == nil || !reflect.DeepEqual(*room.Spec.Question, *asked) { + t.Fatalf("question did not round-trip: %+v %v", room.Spec.Question, e) + } rec := &controller.Reconciler{Client: db, Room: key} if _, e = rec.Reconcile(ctx, ctrl.Request{NamespacedName: key}); e != nil { t.Fatal(e) @@ -114,10 +136,23 @@ func TestAPISchemaAndReconcile(t *testing.T) { if db.Update(ctx, room) == nil { t.Fatal("stop reversed") } - p := &api.Participant{ObjectMeta: metav1.ObjectMeta{Name: "p-test", Namespace: room.Namespace}, Spec: api.ParticipantSpec{RoomRef: api.RoomRef{Name: room.Name, UID: string(room.UID)}, DisplayName: "Ada"}} + // A Participant's groups follow the same rules as the answers they come from. + for _, groups := range [][]string{{"system:masters"}, {"demo:a,system:masters"}, {"demo:a", "demo:a"}} { + bad := &api.Participant{ObjectMeta: metav1.ObjectMeta{Name: "p-bad", Namespace: room.Namespace}, Spec: api.ParticipantSpec{RoomRef: api.RoomRef{Name: room.Name, UID: string(room.UID)}, DisplayName: "Bad", Groups: groups}} + if db.Create(ctx, bad) == nil { + t.Fatalf("invalid groups accepted: %v", groups) + } + } + p := &api.Participant{ObjectMeta: metav1.ObjectMeta{Name: "p-test", Namespace: room.Namespace}, Spec: api.ParticipantSpec{RoomRef: api.RoomRef{Name: room.Name, UID: string(room.UID)}, DisplayName: "Ada", Groups: []string{"demo:framework-svelte"}}} if e = db.Create(ctx, p); e != nil { t.Fatal(e) } + // An operator may move a participant to another group; their next sign-in + // carries it. + p.Spec.Groups = []string{"demo:framework-react"} + if e = db.Update(ctx, p); e != nil { + t.Fatalf("groups are not editable: %v", e) + } p.Spec.Revoked = true if e = db.Update(ctx, p); e != nil { t.Fatal(e) @@ -127,3 +162,9 @@ func TestAPISchemaAndReconcile(t *testing.T) { t.Fatal("revocation reversed") } } + +func question(answers ...api.RoomAnswer) *api.RoomQuestion { + return &api.RoomQuestion{Prompt: "Your favourite frontend framework?", Answers: answers} +} + +func answer(label, group string) api.RoomAnswer { return api.RoomAnswer{Label: label, Group: group} }