feat(scim): generate SCIM token

Author: xlgmokha

internal/models/sso.go

@@ -1,6 +1,7 @@
 package models
 
 import (
+	"crypto/rand"
 	"crypto/sha256"
 	"database/sql"
 	"database/sql/driver"
@@ -43,9 +44,12 @@ func (p SSOProvider) Type() string {
 	return "saml"
 }
 
-func (p *SSOProvider) UpdateSCIMToken(token string) {
+func (p *SSOProvider) GenerateSCIMToken() string {
+	token := rand.Text()
 	hash := toSHA256(token)
 	p.SCIMTokenHash = &hash
+
+	return token
 }
 
 func toSHA256(token string) string {

internal/models/sso_test.go

@@ -1,6 +1,9 @@
 package models
 
 import (
+	"crypto/sha256"
+	"encoding/base32"
+	"encoding/hex"
 	"net/url"
 	"slices"
 	"testing"
@@ -470,12 +473,7 @@ func (ts *SSOTestSuite) TestFindSSOProviderByResourceID() {
 	}
 }
 
-func (ts *SSOTestSuite) TestUpdateSCIMToken() {
-	hashes := map[string]string{
-		"scim_test_token":    "dcbcd9ffd696ae1f2ee0f035fa17680d78175020a5fa1aadc758dbd681e0fe1d",
-		"scim_rotated_token": "289adb37f8946571bb4aea1e663281126c7f2d84d929ff09429fcaa1eb3f27bf",
-	}
-
+func (ts *SSOTestSuite) TestGenerateSCIMToken() {
 	provider := &SSOProvider{
 		SAMLProvider: SAMLProvider{
 			EntityID:    "https://example.com/saml/metadata/",
@@ -484,23 +482,40 @@ func (ts *SSOTestSuite) TestUpdateSCIMToken() {
 	}
 	require.Nil(ts.T(), provider.SCIMTokenHash)
 
-	for token, hash := range hashes {
-		provider.UpdateSCIMToken(token)
+	token := provider.GenerateSCIMToken()
+
+	ts.Run("returns at least 128 bits of base32 randomness", func() {
+		decoded, err := base32.StdEncoding.WithPadding(base32.NoPadding).DecodeString(token)
+
+		require.NoError(ts.T(), err)
+		require.GreaterOrEqual(ts.T(), len(decoded), 16)
+	})
+
+	ts.Run("stores the SHA-256 digest of the token", func() {
+		sum := sha256.Sum256([]byte(token))
+
 		require.NotNil(ts.T(), provider.SCIMTokenHash)
-		require.Equal(ts.T(), hash, *provider.SCIMTokenHash)
-	}
+		require.Equal(ts.T(), hex.EncodeToString(sum[:]), *provider.SCIMTokenHash)
+	})
+
+	ts.Run("never stores the token itself", func() {
+		require.NotContains(ts.T(), *provider.SCIMTokenHash, token)
+	})
+
+	ts.Run("generates a distinct token on every call", func() {
+		require.NotEqual(ts.T(), token, provider.GenerateSCIMToken())
+	})
 }
 
 func (ts *SSOTestSuite) TestFindSSOProviderBySCIMToken() {
-	token := "scim_test_token"
 	provider := &SSOProvider{
 		SAMLProvider: SAMLProvider{
 			EntityID:    "https://example.com/saml/metadata/1",
 			MetadataXML: "<example />",
 		},
 	}
 
-	provider.UpdateSCIMToken(token)
+	token := provider.GenerateSCIMToken()
 	require.NoError(ts.T(), ts.db.Eager().Create(provider))
 
 	withoutToken := &SSOProvider{
@@ -533,8 +548,7 @@ func (ts *SSOTestSuite) TestFindSSOProviderBySCIMToken() {
 	})
 
 	ts.Run("rotation stops the previous token from resolving", func() {
-		newToken := "scim_rotated_token"
-		provider.UpdateSCIMToken(newToken)
+		newToken := provider.GenerateSCIMToken()
 		require.NoError(ts.T(), ts.db.Update(provider))
 
 		found, err := FindSSOProviderBySCIMToken(ts.db, newToken)