nodedb 0.2.0

Local-first, real-time, edge-to-cloud hybrid database for multi-modal workloads
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129

// SPDX-License-Identifier: BUSL-1.1

//! Integration tests for OIDC provider DDL + claim mapping.

mod common;

use common::pgwire_auth_helpers::{
    ddl_err, ddl_ok, make_state_with_catalog, readonly_user, superuser,
};
use nodedb::control::security::oidc::claim_mapping::apply_claim_mapping;

// ── CREATE OIDC PROVIDER ────────────────────────────────────────────────────

#[tokio::test]
async fn create_oidc_provider_persists_in_catalog() {
    let state = make_state_with_catalog();
    let su = superuser();
    ddl_ok(
        &state,
        &su,
        "CREATE OIDC PROVIDER okta \
         ISSUER 'https://acme.okta.com' \
         JWKS_URI 'https://acme.okta.com/.well-known/jwks.json' \
         AUDIENCE 'nodedb'",
    )
    .await;

    let cat = state.credentials.catalog();
    let cat = cat.as_ref().expect("catalog must be present");
    let stored = cat
        .get_oidc_provider("okta")
        .expect("catalog read must succeed")
        .expect("provider must exist after CREATE");
    assert_eq!(stored.issuer, "https://acme.okta.com");
    assert_eq!(stored.audience.as_deref(), Some("nodedb"));
}

#[tokio::test]
async fn create_oidc_provider_requires_superuser() {
    let state = make_state_with_catalog();
    let viewer = readonly_user();
    let err = ddl_err(
        &state,
        &viewer,
        "CREATE OIDC PROVIDER bad \
         ISSUER 'https://x.example/' \
         JWKS_URI 'https://x.example/jwks'",
    )
    .await;
    assert!(
        err.contains("42501") || err.contains("permission denied"),
        "expected permission denied, got: {err}"
    );
}

// ── DROP OIDC PROVIDER ──────────────────────────────────────────────────────

#[tokio::test]
async fn drop_oidc_provider_removes_record() {
    let state = make_state_with_catalog();
    let su = superuser();
    ddl_ok(
        &state,
        &su,
        "CREATE OIDC PROVIDER auth0 \
         ISSUER 'https://x.auth0.com' \
         JWKS_URI 'https://x.auth0.com/.well-known/jwks.json'",
    )
    .await;
    ddl_ok(&state, &su, "DROP OIDC PROVIDER auth0").await;

    let cat = state.credentials.catalog();
    let cat = cat.as_ref().expect("catalog must be present");
    let stored = cat
        .get_oidc_provider("auth0")
        .expect("catalog read must succeed");
    assert!(stored.is_none(), "provider must be absent after DROP");
}

#[tokio::test]
async fn drop_oidc_provider_unknown_returns_not_found() {
    let state = make_state_with_catalog();
    let su = superuser();
    let err = ddl_err(&state, &su, "DROP OIDC PROVIDER does_not_exist").await;
    assert!(
        err.contains("42704") || err.contains("does not exist"),
        "expected not-found error, got: {err}"
    );
}

#[tokio::test]
async fn drop_oidc_provider_if_exists_unknown_succeeds() {
    let state = make_state_with_catalog();
    let su = superuser();
    ddl_ok(&state, &su, "DROP OIDC PROVIDER IF EXISTS does_not_exist").await;
}

// ── SHOW OIDC PROVIDERS ─────────────────────────────────────────────────────

#[tokio::test]
async fn show_oidc_providers_lists_registered() {
    let state = make_state_with_catalog();
    let su = superuser();
    ddl_ok(
        &state,
        &su,
        "CREATE OIDC PROVIDER p1 \
         ISSUER 'https://p1.example/' \
         JWKS_URI 'https://p1.example/jwks'",
    )
    .await;
    ddl_ok(
        &state,
        &su,
        "CREATE OIDC PROVIDER p2 \
         ISSUER 'https://p2.example/' \
         JWKS_URI 'https://p2.example/jwks'",
    )
    .await;
    ddl_ok(&state, &su, "SHOW OIDC PROVIDERS").await;
}

// ── Claim-mapping public surface smoke check ────────────────────────────────

#[test]
fn claim_mapping_apply_function_is_public() {
    // Verifies that `apply_claim_mapping` is accessible from integration tests.
    let _ = apply_claim_mapping;
}