kebandClaude Opus 5.5
18918db1d4
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
68 lines
2.0 KiB
Go
68 lines
2.0 KiB
Go
package azure
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"git.kebcloud.no/keb/lazysecrets/internal/provider"
|
|
)
|
|
|
|
func TestAccount(t *testing.T) {
|
|
claims := map[string]any{
|
|
"name": "Alice Example", "oid": "11111111-2222-3333-4444-555555555555",
|
|
"amr": []any{"pwd", "mfa"},
|
|
"wids": []any{"62e90394-69f5-4237-9190-012177145e10", memberRole, "aaaaaaaa-0000-0000-0000-000000000000"},
|
|
}
|
|
p := &Provider{account: &accountDetails{
|
|
account: account{user: "alice@contoso.com", tenant: "t1", tenantName: "Contoso", subscriptions: 3, defaultSub: "platform"},
|
|
claims: func() map[string]any { return claims },
|
|
}}
|
|
a, ok := p.Account()
|
|
if !ok {
|
|
t.Fatal("no account")
|
|
}
|
|
got := map[string]string{}
|
|
for _, f := range a.Fields {
|
|
got[f.Label] = f.Value
|
|
}
|
|
want := map[string]string{
|
|
"name": "Alice Example", "user": "alice@contoso.com", "tenant": "Contoso", "tenant ID": "t1",
|
|
"object ID": "11111111-2222-3333-4444-555555555555", "sign-in": "MFA · password",
|
|
"roles": "Global Administrator, role aaaaaaaa", "subs": "3 · default platform",
|
|
}
|
|
for k, v := range want {
|
|
if got[k] != v {
|
|
t.Errorf("%s = %q, want %q", k, got[k], v)
|
|
}
|
|
}
|
|
if len(got) != len(want) {
|
|
t.Errorf("fields %v", got)
|
|
}
|
|
if a.Copy != claims["oid"] || a.CopyLabel != "object ID" {
|
|
t.Errorf("copy %q %q", a.Copy, a.CopyLabel)
|
|
}
|
|
|
|
// Before any token: what az's list says.
|
|
claims = nil
|
|
a, _ = p.Account()
|
|
if len(a.Fields) != 4 || a.Copy != "" {
|
|
t.Errorf("without a token: %+v", a)
|
|
}
|
|
if _, ok := (&Provider{}).Account(); ok {
|
|
t.Error("a service principal from AZURE_* has no account details")
|
|
}
|
|
var _ provider.Accounts = p
|
|
}
|
|
|
|
func TestSignInMethods(t *testing.T) {
|
|
for want, amr := range map[string][]any{
|
|
"MFA · password": {"pwd", "mfa"},
|
|
"MFA · Windows Hello or certificate": {"rsa", "ngcmfa"},
|
|
"no MFA · password": {"pwd"},
|
|
"": nil,
|
|
} {
|
|
if got := signInMethods(amr); got != want {
|
|
t.Errorf("%v: %q, want %q", amr, got, want)
|
|
}
|
|
}
|
|
}
|