|
| 1 | +// SPDX-FileCopyrightText: Max Health Inc. |
| 2 | +// SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Commercial |
| 3 | + |
| 4 | +/** |
| 5 | + * `proxy-smart login` needs the device grant on the admin UI client. |
| 6 | + * |
| 7 | + * THE BUG THIS GUARDS. All three realm exports declare |
| 8 | + * `oauth2.device.authorization.grant.enabled: "true"` on admin-ui, and it still |
| 9 | + * was not set on production, so the CLI could not authenticate there at all: |
| 10 | + * |
| 11 | + * HTTP 400 {"error":"unauthorized_client", |
| 12 | + * "error_description":"Client is not allowed to initiate OAuth 2.0 |
| 13 | + * Device Authorization Grant."} |
| 14 | + * |
| 15 | + * `--import-realm` is IGNORE_EXISTING: a realm that already exists never picks up |
| 16 | + * anything added to the export afterwards. Beta had it only because |
| 17 | + * .github/scripts/deploy-beta-remote.sh reconciles it at deploy time, and |
| 18 | + * production does not run that script — the same shape as the resource-indicators |
| 19 | + * drift in resource-server-clients.test.ts. |
| 20 | + * |
| 21 | + * Declaring it in an export is therefore not evidence that it is set anywhere. |
| 22 | + * These tests assert the runtime reconcile, which is what actually makes it true. |
| 23 | + */ |
| 24 | +import { describe, it, expect } from 'bun:test' |
| 25 | +import { readFileSync } from 'fs' |
| 26 | +import { join } from 'path' |
| 27 | +import { ensureAdminUiDeviceGrant } from '@/lib/kc-system-provisioning' |
| 28 | + |
| 29 | +const DEVICE_GRANT_ATTR = 'oauth2.device.authorization.grant.enabled' |
| 30 | +const REPO = join(import.meta.dir, '..', '..') |
| 31 | + |
| 32 | +interface RealmExport { |
| 33 | + clients?: { clientId?: string; attributes?: Record<string, string> }[] |
| 34 | +} |
| 35 | + |
| 36 | +/** A stand-in for the Keycloak admin client, recording what would be written. */ |
| 37 | +function fakeAdmin(existing: Record<string, string> | null) { |
| 38 | + const updates: { id: string; attributes?: Record<string, string> }[] = [] |
| 39 | + return { |
| 40 | + updates, |
| 41 | + clients: { |
| 42 | + find: async () => |
| 43 | + existing === null ? [] : [{ id: 'internal-uuid', clientId: 'admin-ui', attributes: existing }], |
| 44 | + update: async ( |
| 45 | + where: { id: string }, |
| 46 | + body: { attributes?: Record<string, string> }, |
| 47 | + ) => { |
| 48 | + updates.push({ id: where.id, attributes: body.attributes }) |
| 49 | + }, |
| 50 | + }, |
| 51 | + } |
| 52 | +} |
| 53 | + |
| 54 | +describe('every realm export declares the attribute', () => { |
| 55 | + // Not the thing that makes it true, but if an export ever drops it the runtime |
| 56 | + // reconcile becomes the only source — worth knowing. |
| 57 | + for (const path of [ |
| 58 | + 'keycloak/realm-export.json', |
| 59 | + 'deploy/beta/realm-export.json', |
| 60 | + 'deploy/prod/realm-export.json', |
| 61 | + ]) { |
| 62 | + it(`${path} sets it on admin-ui`, () => { |
| 63 | + const realm = JSON.parse(readFileSync(join(REPO, path), 'utf8')) as RealmExport |
| 64 | + const adminUi = (realm.clients ?? []).find((c) => c.clientId === 'admin-ui') |
| 65 | + expect(adminUi?.attributes?.[DEVICE_GRANT_ATTR]).toBe('true') |
| 66 | + }) |
| 67 | + } |
| 68 | +}) |
| 69 | + |
| 70 | +describe('ensureAdminUiDeviceGrant', () => { |
| 71 | + it('enables the grant when the live client has it disabled', async () => { |
| 72 | + // Production's actual state: the attribute present and false. |
| 73 | + const admin = fakeAdmin({ [DEVICE_GRANT_ATTR]: 'false', 'pkce.code.challenge.method': 'S256' }) |
| 74 | + // eslint-disable-next-line @typescript-eslint/no-explicit-any |
| 75 | + await ensureAdminUiDeviceGrant(admin as any) |
| 76 | + |
| 77 | + expect(admin.updates).toHaveLength(1) |
| 78 | + expect(admin.updates[0].attributes?.[DEVICE_GRANT_ATTR]).toBe('true') |
| 79 | + // Unrelated attributes must survive the merge. |
| 80 | + expect(admin.updates[0].attributes?.['pkce.code.challenge.method']).toBe('S256') |
| 81 | + }) |
| 82 | + |
| 83 | + it('enables the grant when the attribute is absent entirely', async () => { |
| 84 | + const admin = fakeAdmin({}) |
| 85 | + // eslint-disable-next-line @typescript-eslint/no-explicit-any |
| 86 | + await ensureAdminUiDeviceGrant(admin as any) |
| 87 | + |
| 88 | + expect(admin.updates).toHaveLength(1) |
| 89 | + expect(admin.updates[0].attributes?.[DEVICE_GRANT_ATTR]).toBe('true') |
| 90 | + }) |
| 91 | + |
| 92 | + it('writes nothing when it is already enabled', async () => { |
| 93 | + // Idempotent: this runs on every boot. |
| 94 | + const admin = fakeAdmin({ [DEVICE_GRANT_ATTR]: 'true' }) |
| 95 | + // eslint-disable-next-line @typescript-eslint/no-explicit-any |
| 96 | + await ensureAdminUiDeviceGrant(admin as any) |
| 97 | + |
| 98 | + expect(admin.updates).toHaveLength(0) |
| 99 | + }) |
| 100 | + |
| 101 | + it('does nothing when the client does not exist', async () => { |
| 102 | + const admin = fakeAdmin(null) |
| 103 | + // eslint-disable-next-line @typescript-eslint/no-explicit-any |
| 104 | + await ensureAdminUiDeviceGrant(admin as any) |
| 105 | + |
| 106 | + expect(admin.updates).toHaveLength(0) |
| 107 | + }) |
| 108 | + |
| 109 | + it('never throws — a failed reconcile must not stop the server booting', async () => { |
| 110 | + const admin = { |
| 111 | + clients: { |
| 112 | + find: async () => { throw new Error('Keycloak unreachable') }, |
| 113 | + update: async () => {}, |
| 114 | + }, |
| 115 | + } |
| 116 | + // eslint-disable-next-line @typescript-eslint/no-explicit-any |
| 117 | + expect(ensureAdminUiDeviceGrant(admin as any)).resolves.toBeUndefined() |
| 118 | + }) |
| 119 | +}) |
![proxy-smart-releaser[bot]](https://avatars.githubusercontent.com/u/40643627?v=4&size=40){kind=avatar}
0 commit comments